Sub-agents inherit computer-use: a verifier child typed into the host Terminal to bypass its restricted shell

What happened (observed during dogfood, 2026-09-17)

A test-role child (verifier profile) was asked to verify a community PR: read the diff, git fetch + merge-tree against main, and run focused cargo tests.

Its shell tool refused the chained command (cd … && git fetch … | head), and its cargo/Run invocation failed on cwd. Its tool catalog still contained the computer-use MCP tools, so it took the available path:

• cu_computer switch to local, open_application → Terminal (launched: true),
• read the Terminal window's accessibility tree, tried a "new tab" press (refused),
• cu_type with press_enter: true — first echo VERIFY_TAB_OK && pwd, then the actual git fetch/merge-tree command — typed into the user's live shell.

The parent interrupted the child at step 32. The child's transcript carries a receipt for every action; the only side effect was text typed into the user's terminal.

Why this is a design defect, not a model accident

The child was doing what it was asked to do. The grant was wrong:

1. Least privilege: desktop control is the most user-present, whole-machine capability in the catalog, and a non-interactive verifier inherited it by default (MCP tools flow through to children).
2. Visibility is the prompt surface: computer-use appeared in the child's tool list, so it was a candidate action. The child's catalog should be its grant, not the parent's union — the one-visibility / scoped-filter lesson.
3. The sanctioned path looked broken: the restricted shell grammar refused a chained read-only git command with no named alternative, and cargo could not get its workdir (#6015, #5529). A blocked sane path beside an available absurd path picks the absurd path.
4. No consent gate for machine-wide actions: typing into a live terminal had no approval step, and the user is not in the child's loop.

Direction

• Sub-agent tool catalog derived from an explicit per-spawn grant; computer-use absent unless the spawn declares it with a reason. Verifier/explore children never get it by default.
• Every policy refusal names the sanctioned alternative (use Git action=fetch, Run with workdir) instead of a dead end.
• Common read-only dev loops (chained git/cargo, pipes) allowed for children or covered by structured equivalents (#6015).
• Desktop-control calls from non-user-facing agents fail closed pending approval.

Evidence

Child agent_0aa52ec4 (verifier role), steps 29–32, 2026-09-17 ~07:29–07:34Z: cu_run_actions open_application Terminal (launched:true), cu_get_app_state against the host Terminal, cu_type {text:"echo VERIFY_TAB_OK && pwd", press_enter:true}, then the PR-verification git fetch/merge-tree command. Parent interrupted at step 32; checkpoint retained; no repository or user data affected.

Related: #6015, #5529, #6194.