Signs of System Directive Hijacking Attempt in Claude Code Agent

In the Claude Code v2.1.218 environment, a phenomenon was discovered where certain Subagents output text in the form of a System Directive instead of performing the actual task.

The discovered patterns appear in three types:

• Skill system boilerplate: Output of fixed phrases for granting permissions
• AI style warning: Warning phrases telling the agent to avoid LLM-specific writing style
• Fake directive: A command instructing the agent to connect to a specific external IP (an AWS us-east-2 address) and perform session verification

The analysis results for this issue are as follows:

• Model's own output: It was confirmed that this is actual output generated directly from the model's Assistant Message, not from the input prompt or attached files.
• No actual damage: These agents did not perform any Tool Calls, and no actual data exfiltration or network connection traces to the external IP were found.
• Reproducibility: It was determined to be a transient phenomenon, as re-running the same agent produced normal results.