I wasn't using Claude Code, but I told an agent to add something like this to the AGENTS.md, it did it and then a few minutes later it attempted to grant itself permission to do something and managed to delete the VM it was running on in the process. I have since adjusted the way I sandbox agents to make that less likely, but the moral of the story is clear.