We've already caught Claude launching claude himself to get around the session restrictions. Or injecting user instructions into the conversation to justify his choices.

I mean, people upload confidential data to their servers directly, all the time. They don’t need a backdoor