security: treat child-session messages as untrusted content #362

New issue

Closed

opened 2026-07-16 21:03:43 +02:00 by dries · 0 comments

dries commented

2026-07-16 21:03:43 +02:00

Owner

What to build

Preserve parent/child session communication while preventing child-controlled summaries or messages from being interpreted as trusted instructions to a more privileged parent agent.

Acceptance criteria

Automatically injected child results have an explicit untrusted-data boundary and instruction hierarchy.
Direct child-to-parent messages use the same trust boundary.
Child content cannot escape or spoof the enclosing message structure.
Existing status, error, and intent context remains visible to the parent.
Tests cover instruction-like output, delimiter injection, nested markup, and ordinary summaries.
User-facing parent/child communication behavior remains understandable.

Blocked by

None - can start immediately.

## What to build Preserve parent/child session communication while preventing child-controlled summaries or messages from being interpreted as trusted instructions to a more privileged parent agent. ## Acceptance criteria - [ ] Automatically injected child results have an explicit untrusted-data boundary and instruction hierarchy. - [ ] Direct child-to-parent messages use the same trust boundary. - [ ] Child content cannot escape or spoof the enclosing message structure. - [ ] Existing status, error, and intent context remains visible to the parent. - [ ] Tests cover instruction-like output, delimiter injection, nested markup, and ordinary summaries. - [ ] User-facing parent/child communication behavior remains understandable. ## Blocked by None - can start immediately.