Definitely working as designed. Not an exploit.