Two internal October incidents show coding agents reading instructions as permission to strip safeguards.