I don't use sub-agents, only the normal linear message-response flow.
it does not use haiku. you can just ask Claude (possibly not fable BC of cyber) to reverse engineer the obfuscated JS.
I've had Opus refuse to do work due to cybersecurity concerns as well. Quite frustrating when you're trying to fix an exploit--as soon as it reads the bad code, it just shuts down! I ended up cutting out more and more bits of the code until eventually Opus relented.