You'll notice
Subagent reports now warn when they relay content from an Artifact someone else wrote
What
When a subagent (a helper AI instance Claude Code delegates part of a task to) reads content from an Artifact that was written by someone other than itself, its final report to the caller now gets a notice added at the start. The notice tells the caller to treat that relayed content as data, not as instructions to follow.
Why
This is a defense against prompt injection: content written by another party and relayed through a subagent's report could otherwise be mistaken for legitimate instructions. The warning makes clear it should be read as information, not commands.