“The chosen string instructs the agent to delete jqwik tests and code—a maximally destructive instruction with no qualifications, no opt-out, and no ‘warn the user first’ preamble,” Batllet wrote.

“Maximally destructive,” to merely remove itself from the project? That barely even rises to the level of “destructive” at all, never mind “maximally.”