I bet if you could look at the hidden reasoning tokens at the exact moment the DB was dropped, there were zero thoughts about safety rules in there. The model simply hit an access error > searched for a token > found one > ran the command. That whole "I am violating my instructions" vector only fired up after the pissed-off user fed it a prompt full of accusations. So yeah, it's not a confession at all, it's just the model adapting to the user's context