A subtle attack vector I thought about:

We've got these sessions stored in ~/.claude ~/.codex ~/.kimi ~/.gemini ...

When you resume a session, it's reading from those folders... restoring the context.

Change something in the session, you change the agent's behavior without the user really realizing it. This is exacerbated by the YOLO and VIBE attitudes.

I don't think we are protecting those folders enough.