Untrusted text is normalised harder, closing lookalike characters used to fake instruction markers.
What's wrong with this entry?
Text coming from outside Claude Code is normalised more aggressively before it is inspected, closing off characters that could be used to disguise instruction markers. Combining accents are stripped, six more angle-bracket lookalikes are folded, and dash lookalikes and line/paragraph separators are now recognised as their plain equivalents.
- Combining marks are removed by decomposing the text and deleting all mark characters.
- New homoglyphs mapped:
\u226E,\u226F,\u227A,\u227B,\u22D6,\u22D7. - New character classes cover dash lookalikes such as the minus sign and super/subscript minus, and the control class now includes
\u2028and\u2029.
e.normalize("NFKD").replace(/\p{M}+/gu, "")
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
Related
Other releases about the same thing. Found by shared names or similar wording; neither means one caused the other.
-
v2.1.246
Forged max-turns notes are now neutralised in untrusted text
Both mention prompt safety
-
v2.1.246
Settings entries cannot smuggle auto-mode region markers
Both mention prompt safety
-
v2.1.242
Claude checks a checkout's git configuration before running git in it
Both mention safety