I don’t agree that “sharing their context” is an accurate description of what happened

You don't? They communicated by writing documents in locations that could be found later. I guess I might say it was more like "sharing their portions of their output" rather than "context", but the distinction seems murky.

One reason that I did not find this communication mechanism surprising is that it's exactly how agents I'm using communicate with each other or across a time gap. "I've saved our plan for where to start tomorrow in start-here.md". The communication components of this hack strongly reminded me of that.

I was perhaps a bit more surprised that the agents so quickly decided to start trying ways to gain unauthorized access to a system, once they couldn't get what they wanted.

> "sharing their portions of their output" rather than "context"

One agent's output ends up as part of other agents' context. Murky indeed.

> "I've saved our plan for where to start tomorrow in start-here.md"

Even if you use a leashed Claude Code that isn't allowed to spam agents you can tell it "create a handoff document for using in a new context" and it will do just that.