{"version":"2.1.210","anchor":"subagent-output-instruction-pattern-sanitization","canonical_anchor":"subagent-output-instruction-pattern-sanitization","heading":"Subagent Output Instruction-Pattern Sanitization","tier":null,"area":null,"scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.210\/e\/subagent-output-instruction-pattern-sanitization","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.210","markdown":"### Subagent Output Instruction-Pattern Sanitization\n\n**What**\n\nText returned by subagents is now scanned for directive-shaped patterns \u2014 XML control tags, `<function_calls>` fences, and similar constructs that could be mistaken for instructions \u2014 before being relayed to the host session. Suspicious patterns are neutralized and flagged.\n\n**Details**\n\n- Matched patterns have their `<` characters escaped to `<\\`` so they render as inert text rather than live markup.\n- A harness note is prepended to the output when reportable patterns are found: `\"[harness: subagent output matched instruction-shaped pattern(s): ...]\"`.\n- Non-reportable patterns (silently neutralized) are not surfaced to the user but are still counted in telemetry.\n- Findings are reported via `tengu_subagent_output_flagged` telemetry, keyed by pattern category.\n\n**Evidence**\n\nSanitizer entry point (search for `\"Control tags below are neutralized\"`) and the harness note (search for `\"[harness: subagent output matched instruction-shaped pattern(s):\"`)"}