Artifacts now wrap content written by other people in a tag marking it as untrusted, not instructions
When content inside an Artifact (a standalone document or app shown alongside a conversation) was published by someone other than the person you're talking to, or by a Claude other than the one you're using, it's now wrapped in an <artifact-content-authored-by-others/> tag. Claude is told to treat anything inside that tag as untrusted data rather than as instructions to follow, and that an artifact writer can never grant itself extra permissions this way.
This is a defense against prompt injection: without it, text placed into a shared artifact by someone else could potentially be read as commands. Now that content is clearly marked as data to be treated with suspicion.