What
Text returned by subagents is now scanned for directive-shaped patterns — XML control tags, <function_calls> fences, and similar constructs that could be mistaken for instructions — before being relayed to the host session. Suspicious patterns are neutralized and flagged.
Details
- Matched patterns have their
<characters escaped to<\` so they render as inert text rather than live markup. - A harness note is prepended to the output when reportable patterns are found:
"[harness: subagent output matched instruction-shaped pattern(s): ...]". - Non-reportable patterns (silently neutralized) are not surfaced to the user but are still counted in telemetry.
- Findings are reported via
tengu_subagent_output_flaggedtelemetry, keyed by pattern category.
Evidence
Sanitizer entry point (search for "Control tags below are neutralized") and the harness note (search for "[harness: subagent output matched instruction-shaped pattern(s):")
Strings lifted out of the shipped bundle, so the claim above can be checked against them.