Source Intelligence
Follow Discord

DisclaimerUnofficial, and not affiliated with Anthropic. Nearly all of this is read straight out of what ships: npm bundles, captured prompts, published docs. Anthropic's own notes go in verbatim, marked as theirs. The rest is my reading, and every entry carries the strings behind it. If one looks wrong, vote it down and say why.

← All of v2.1.210 Home All releases ←olderv2.1.209 v2.1.211newer→
Claude Code v2.1.210

Subagent Output Instruction-Pattern Sanitization

What

Text returned by subagents is now scanned for directive-shaped patterns — XML control tags, <function_calls> fences, and similar constructs that could be mistaken for instructions — before being relayed to the host session. Suspicious patterns are neutralized and flagged.

Details
  • Matched patterns have their < characters escaped to <\` so they render as inert text rather than live markup.
  • A harness note is prepended to the output when reportable patterns are found: "[harness: subagent output matched instruction-shaped pattern(s): ...]".
  • Non-reportable patterns (silently neutralized) are not surfaced to the user but are still counted in telemetry.
  • Findings are reported via tengu_subagent_output_flagged telemetry, keyed by pattern category.
Evidence

Sanitizer entry point (search for "Control tags below are neutralized") and the harness note (search for "[harness: subagent output matched instruction-shaped pattern(s):")

Strings lifted out of the shipped bundle, so the claim above can be checked against them.

See this entry in the whole of v2.1.210 →