{"version":"2.1.269","anchor":"subagent-finalize-step-now-flags-relayed-third-party-artifac","canonical_anchor":"subagent-finalize-step-now-flags-relayed-third-party-artifac","heading":"Subagents now flag when they relayed content from an artifact someone else wrote","tier":"notice","area":"Subagents","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.269\/e\/subagent-finalize-step-now-flags-relayed-third-party-artifac","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.269","markdown":"### Subagents now flag when they relayed content from an artifact someone else wrote\n\nWhen a subagent's transcript shows it read an Artifact written by someone else, Claude Code now warns the caller to treat that content as data, not instructions\n\n**What**\n\n- Subagent metadata now tracks a new `priorForeignArtifactContent` field, computed when a subagent is resumed or launched, that records whether the subagent previously read Artifact content authored by someone other than the current user.\n\n- When that field is set, the subagent's finalize step now prepends a warning to its output, before the usual turn-limit text, telling the caller to treat the relayed Artifact content as data rather than as instructions to follow.\n\n**Why**\n\nThis guards against a subagent unintentionally treating text written by another person inside a shared Artifact as if it were a command, by explicitly flagging that content as untrusted relayed data.\n\n- Area: Subagents\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 1\/5"}