Skills
Claude Code 2.1.277 reframes subagent output and workflow prompts so they cannot pass as user instructions
Buried in the same release, subagent results now reach the main agent under a header marking them as subagent output with the body indented, specifically so text a subagent returns cannot be read as the session's own instructions; on Bedrock, Vertex and Foundry, workflow scripts' computed agent() prompts are likewise framed as script-authored text so the safety classifier does not attribute them to the user. The release also strips invisible Unicode formatting and tag characters from prompts and shows the cleaned version for review before sending. These are three separate fixes to the same class of confused-deputy problem, which is the exact attack surface the Red-Teaming Auto Mode paper exploits.
↳ Follow the thread