Claude Code Closes Three More Prompt-Injection Gaps
Claude CodeClaude Code 2.1.277 landed three related fixes that narrow how untrusted text can pass itself off as a trusted instruction. Invisible Unicode formatting and tag characters are now stripped out of a typed prompt before it is sent, with the cleaned version shown for review first. Separately, a subagent's result now reaches the main agent under a clearly marked, indented header, so text inside that result can no longer pass as the session's own instructions, and on Bedrock, Vertex, and Foundry, workflow scripts' computed prompts are now framed as script-authored text so the safety classifier does not mistake them for the user.
Key Takeaways
- Invisible Unicode is now stripped from every prompt before it reaches the model, closing a known technique for hiding instructions in text that looks normal on screen.
- Subagent results are now visibly walled off: a marked, indented header keeps a subagent's output from being read as the main session's own instructions.
- Bedrock, Vertex, and Foundry workflow scripts get the same treatment: their computed prompts are now framed as script-authored text so the safety classifier doesn't mistake them for the user.
- All three fixes shipped in a single release (2.1.277), continuing a pattern of near-daily permission and isolation hardening seen across Claude Code's September releases.
- None of the three requires any user action: the protections apply automatically with no setting to turn on.
- The fixes target different trust boundaries (typed input, subagent hand-back, and automated workflow prompts), rather than being three instances of the same bug.
Three related hardening fixes
Version 2.1.277, released September 18, 2026, shipped three changes that each close a different way untrusted or auto-generated text could be read as a trusted instruction inside a Claude Code session.
Invisible Unicode stripped from prompts
Claude Code now removes invisible Unicode formatting and tag characters from a typed or pasted prompt before it is sent, and shows the cleaned prompt for review first. Characters in this category, such as zero-width joiners, bidirectional override marks, and Unicode tag characters, are invisible to a human reading the prompt on screen but are still read by the model, and have previously been used to hide instructions inside otherwise normal-looking text.
Subagent output can no longer pass as the session's own instructions
Results from a subagent now reach the main agent under a header that explicitly marks them as subagent output, with the body of the result indented beneath it. Previously, text returned by a subagent could reach the main agent without that framing, leaving room for a subagent's output, if it contained instruction-shaped text, to be read as though it came from the session or the user rather than from a delegated task.
Workflow script prompts framed as script-authored text
On Amazon Bedrock, Google Vertex AI, and Microsoft Foundry, a workflow script's computed agent() prompt now reaches the subagent explicitly framed as script-authored text, so Claude Code's safety classifier does not read that text as though it came from the user.
Why it matters
Each of these closes a path by which content that did not originate from the person using Claude Code, whether hidden in a pasted prompt, returned by a subagent, or generated by an automated workflow script, could be mistaken for a direct, trusted instruction. None of the three is a headline feature, but together they continue Anthropic's near-daily cadence of tightening the boundary between what a user actually authorized and what a session, subagent, or script can make the model believe it was told.