Group of 2 You'll notice
When a subagent's transcript shows it read an Artifact written by someone else, Claude Code now warns the caller to treat that content as data, not instructions
What
- Subagent metadata now tracks a new
priorForeignArtifactContentfield, computed when a subagent is resumed or launched, that records whether the subagent previously read Artifact content authored by someone other than the current user. - When that field is set, the subagent's finalize step now prepends a warning to its output, before the usual turn-limit text, telling the caller to treat the relayed Artifact content as data rather than as instructions to follow.
Why
This guards against a subagent unintentionally treating text written by another person inside a shared Artifact as if it were a command, by explicitly flagging that content as untrusted relayed data.