It does mean that you could potentially hijack the agent afterwards, though, which could make the trojan into an even bigger threat.

▲

lnenad 5 hours ago | parent [-]

But you're not actually hijacking the agent if you start a new process.

▲

pests 5 hours ago | parent | next [-]

The agent wrote the code that triggered a vuln and allowed you to start the process

	▲	lnenad 9 minutes ago \| parent [-]
		The agent wrote the code that has a mechanism that triggers a file as a side effect. That file started the separate process, as it could have started any other binary.

▲

rcxdude 4 hours ago | parent | prev [-]

I mean once you have code execution you can essentially just start a new claude code session and instruct it to do malicious things as if you're the intended user. You can disable the auto safeguards and the main risk is getting flagged through the top-level safeguards. This makes the exploit potentially much more able to spread like a worm or bypass sandboxes.