{"version":"2.1.234","anchor":"another-forged-control-tag-is-escaped-in-subagent-output","canonical_anchor":"another-forged-control-tag-is-escaped-in-subagent-output","heading":"Another forged control tag is escaped in subagent output","tier":"notice","area":"Subagents","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.234\/e\/another-forged-control-tag-is-escaped-in-subagent-output","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.234","markdown":"### Another forged control tag is escaped in subagent output\n\nSubagent output that imitates one more internal marker name is now escaped, closing a prompt-injection route.\n\n**What**\n\nOutput coming back from a subagent is scanned for text that imitates Claude Code's own internal message markers. A new marker name, `slack-tag-message`, is now on that list and gets escaped rather than passed through, closing one more prompt-injection route.\n\n**Details**\n\n- Sits beside the existing `slack-ping` marker and is neutralized under the same control-tag handling.\n- Active wherever subagent output scanning runs; nothing in this build produces messages of that kind, so only the defensive half is present.\n\n**Evidence**\n\n`slack-tag-message`\n\n- Area: Subagents\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 3\/5"}