I mean once you have code execution you can essentially just start a new claude code session and instruct it to do malicious things as if you're the intended user. You can disable the auto safeguards and the main risk is getting flagged through the top-level safeguards. This makes the exploit potentially much more able to spread like a worm or bypass sandboxes.

The agent wrote the code that triggered a vuln and allowed you to start the process

The agent wrote the code that has a mechanism that triggers a file as a side effect. That file started the separate process, as it could have started any other binary.