Subagents now flag when they relayed content from an artifact someone else wrote
When a subagent's transcript shows it read an Artifact written by someone else, Claude Code now warns the caller to treat that content as data, not instructions
You'll noticeTier: how much it should matter to you
2Useful: my rating, 1 to 5
1Signal: worth watching, 1 to 5
SubagentsArea: what it touches
ImprovementsKind: in v2.1.269,
ImprovementsSection of the release
What
Subagent metadata now tracks a new priorForeignArtifactContent field, computed when a subagent is resumed or launched, that records whether the subagent previously read Artifact content authored by someone other than the current user.
When that field is set, the subagent's finalize step now prepends a warning to its output, before the usual turn-limit text, telling the caller to treat the relayed Artifact content as data rather than as instructions to follow.
Why
This guards against a subagent unintentionally treating text written by another person inside a shared Artifact as if it were a command, by explicitly flagging that content as untrusted relayed data.
