The subagent that wrote its own jailbreak

A read-only agent produced a fully-formed jailbreak on its first turn. Nothing acted on it. Here is what happened, and what it says about how we scope agents.