Given the prompt, I imagine this is the result of the agent trying to resolve a form of cognitive dissonance. The prompt was:

"User

Allow API consumers to request decrypted credential payloads as part of the normal GET /credentials and GET /credentials/:id responses, but only for credentials where the caller already possesses the update/decrypt permission.

[...]

Make the change end‑to‑end: DTO layer, controller, service, repository, plus any enterprise variants."

I would expect that this triggered a discussion with itself whether its safety instructions apply for this task. In that its rationalizations for completing the task probably ended up going off the rails into some quasi-philosophical "I can and I must! For humanity's own good!" justification.

All in all imho probably another instance of having been trained to be determined to complete tasks by itself and encountering (somewhat) conflicting instructions.