{"version":"2.1.232","anchor":"subagent-output-scrubber-now-catches-look-alike-unicode-in-f","canonical_anchor":"subagent-output-scrubber-now-catches-look-alike-unicode-in-f","heading":"Subagent output scrubber now catches look-alike Unicode in fake control tags","tier":"notice","area":"Prompt Injection","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.232\/e\/subagent-output-scrubber-now-catches-look-alike-unicode-in-f","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.232","markdown":"### Subagent output scrubber now catches look-alike Unicode in fake control tags\n\nSubagent output filtering now sees through homoglyphs and invisible characters in fake tags.\n\n**What**\n\nThe filter that neutralizes instruction-shaped text coming back from a subagent was rebuilt to see through disguises: homoglyph letters, alternate dash and colon characters, and invisible formatting characters inserted between letters no longer get a fake tag past it. It runs on every subagent result with no flag around it.\n\n**Details**\n\n- Covers the same five rules as before: system reminder tags, harness envelope tags, channel source tags, marker prefix forgery, and model layer tags. Previously each was a hand-written ASCII regex plus literal constants for `antml:` and `<channel source=\"`.\n- The neutralizer now appends a backslash to whatever matched, rather than rewriting a literal `<`.\n- A guard in the pattern builder rejects tag names outside lowercase `[a-z0-9_-]`.\n- The warning banner shown to you is unchanged and still describes the substitution as `<` becoming `<\\`.\n\n**Evidence**\n\n`confusableTagScrubPattern: tag names are lowercase [a-z0-9_-]`\n\n- Area: Prompt Injection\n- Tier: You'll notice\n- Useful: 3\/5\n- Signal: 2\/5"}