{"version":"2.1.319","anchor":"prompt-injection-scanner-later-report-note-forgery","canonical_anchor":"prompt-injection-scanner-later-report-note-forgery","heading":"Tool output scanning catches another kind of forged note","tier":"notice","area":"Elsewhere","scope":"individual","heads_up":false,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.319\/e\/prompt-injection-scanner-later-report-note-forgery","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.319","markdown":"### Tool output scanning catches another kind of forged note\n\nClaude Code now neutralizes one more kind of forged note when it appears at the start of a line in tool output\n\n**What**\n\nTools return text to Claude, such as a web page or a file's contents. That text can try to trick Claude by pretending to be a note from Claude Code itself. Claude Code scans tool output for this kind of forged text and escapes it, which means it is marked so Claude reads it as plain text and not as an instruction.\n\nThe scan now covers one more pattern: a forged \"later report\" note at the start of a line.\n\n**Why**\n\nTool output has one fewer way to pass off fake notes as real ones from Claude Code.\n\n- Area: Elsewhere\n- Tier: You'll notice\n- Useful: 1\/5\n- Signal: 1\/5\n- Scope: individual\n- Heads-up: no"}