What
When a subagent finishes, the final text it hands back to the parent agent is now itself reviewed by the auto-mode safeguard, treated as untrusted agent-authored output that could relay a prompt injection. Previously only the subagent's tool calls were reviewed.
Details
- The hand-back text is wrapped in
<subagent_hand_back>tags and submitted as the action to evaluate. - The review now also runs when the subagent made no reviewable tool calls but did produce hand-back text.
- The allowed, blocked, refused and unavailable outcomes were reworked so a policy refusal is no longer reported as unavailable.
Evidence
<subagent_hand_back>
Strings lifted out of the shipped bundle, so the claim above can be checked against them.