{"version":"2.1.227","anchor":"subagent-hand-back-text-is-checked-by-the-safeguard-review","canonical_anchor":"subagent-hand-back-text-is-checked-by-the-safeguard-review","heading":"Subagent hand-back text is checked by the safeguard review","tier":"notice","area":"Subagents","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.227\/e\/subagent-hand-back-text-is-checked-by-the-safeguard-review","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.227","markdown":"### Subagent hand-back text is checked by the safeguard review\n\nA subagent's final text is now treated as untrusted and screened for prompt injection.\n\n**What**\n\nWhen a subagent finishes, the final text it hands back to the parent agent is now itself reviewed by the auto-mode safeguard, treated as untrusted agent-authored output that could relay a prompt injection. Previously only the subagent's tool calls were reviewed.\n\n**Details**\n\n- The hand-back text is wrapped in `<subagent_hand_back>` tags and submitted as the action to evaluate.\n- The review now also runs when the subagent made no reviewable tool calls but did produce hand-back text.\n- The allowed, blocked, refused and unavailable outcomes were reworked so a policy refusal is no longer reported as unavailable.\n\n**Evidence**\n\n`<subagent_hand_back>`\n\n- Area: Subagents\n- Tier: You'll notice\n- Useful: 4\/5\n- Signal: 4\/5"}