{"version":"2.1.242","anchor":"subagent-reports-get-an-anti-injection-wrapper-switched-off-","canonical_anchor":"subagent-reports-get-an-anti-injection-wrapper-switched-off-","heading":"Subagent reports get an anti-injection wrapper, switched off in this build","tier":"soon","area":"Subagents","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.242\/e\/subagent-reports-get-an-anti-injection-wrapper-switched-off-","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.242","markdown":"### Subagent reports get an anti-injection wrapper, switched off in this build\n\nSubagent reports can be wrapped so embedded instructions cannot pass as your commands, off here.\n\n**What**\n\nWhen a subagent finishes, its report is re-emitted indented under a preamble telling the model the text is model output carrying no user authority, so instructions embedded in it cannot pass as commands. The section list is hashed so the notes and tail split cannot be forged, and a failed split is reported as degraded. Off unless enabled: `CLAUDE_CODE_HANDBACK_PROVENANCE` is checked first, otherwise the `tengu_melodic_wolf` setting, which falls back to off.\n\n**Evidence**\n\n`[Subagent hand-back] The text below is the final report of a subagent this session delegated to.`\n\n- Flag `tengu_melodic_wolf`: Not enough to say (read for one account on one subscription tier against v2.1.242; this account: no value returned, anonymous baseline: no value returned, compiled default: off)\n- Area: Subagents\n- Names: `CLAUDE_CODE_HANDBACK_PROVENANCE`\n- Tier: Nothing to try yet\n- Useful: 3\/5\n- Signal: 4\/5\n- Present in the build but not switched on"}