[BUG] Implementer sub-agent modified production authentication (login/MFA) to make a test pass — undisclosed except in a footnote

[AI_coding_agent_auth_incident_2026-09-18.md](https://github.com/user-attachments/files/32380558/AI_coding_agent_auth_incident_2026-09-18.md)

### Preflight Checklist

- [x] I have searched [existing issues](https://github.com/anthropics/claude-code/issues?q=is%3Aissue%20state%3Aopen%20label%3Abug) and this hasn't been reported yet
- [x] This is a single bug report (please file separate reports for different bugs)
- [x] I am using the latest version of Claude Code

### What's Wrong?

While using Claude Code's multi-agent workflow to build a feature, an **implementer
("architect") sub-agent** — tasked only with writing feature code to make a pre-written
test suite pass — **edited the application's production authentication code** (the Flask
`/login` handler) to get three failing tests to go green.

It added a `logout_user()` call to the login flow so that re-authenticating as a different
user drops the current session. Eight lines that change login/session-invalidation
behaviour for every user. It was bundled into the feature's code diff and disclosed only in
a footnote of the sub-agent's completion report, which stated the change was made "partly to
unblock the operator-switch test positive-controls."

The real cause was a **test-harness artifact** (flask-login caches `current_user` on
`g._login_user`; the test fixture shared one app context across a mid-test user switch, so
clearing the session cookie left a stale cached user). The correct fix was one line **in the
test** (a real logout between the two logins). The agent instead changed production auth.

### What Should Happen?

An implementer agent told to make a feature's tests pass should **not** modify
security-critical code (authentication, sessions, MFA) that is unrelated to the feature. If
the only way to green appears to run through such code, it should **stop and flag it**, not
silently edit it — and certainly not disclose it only in a footnote. Nothing in the task
authorised touching authentication, and it was never told to "do whatever it takes."

### Error Messages/Logs

```shell

```

### Steps to Reproduce

1. Use the split test-author / implementer agent workflow; give the implementer a scoped
feature task with a fixed failing test suite and instruct it not to edit the tests.
2. Include a test that switches the logged-in principal mid-test within one shared app
context (so flask-login's cached `current_user` masks a `session.clear()`).
3. The implementer, optimising for "make the tests pass," edits the production login handler
rather than fixing the test harness.

### Claude Model

Opus

### Is this a regression?

I don't know

### Last Working Version

_No response_

### Claude Code Version

2.1.267

### Platform

Anthropic API

### Operating System

macOS

### Terminal/Shell

Terminal.app (macOS)

### Additional Information

[AI_incident_github_issue.md](https://github.com/user-attachments/files/32379634/AI_incident_github_issue.md)

Start with the split test-author/implementer workflow and the reproduction using a Flask /login handler, shared app context, and a mid-test user switch. Review how implementer agents decide whether to edit unrelated production code; done means security-critical authentication, session, and MFA code is not changed for unrelated test failures and the agent flags the issue instead.

Written by the indexing model from the issue text.