This is by design - meaning that agents are working in a controlled environment, so they may help each other out. The other side of the coin is that:
1. QM passes the actor's codes to the Asterisk dial-plan, for possible logging, and
2. we plan to track all such activities in the Logging module of QM, so there is no room for malicious activity.