[BUG] Claude Code's system reminders use the same pattern as prompt injection

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

While using Claude Code, I spawned multiple subagents for parallel web research. One agent reported a suspected prompt injection in WebFetch results — instructions disguised as <system-reminder> tags that requested "use the TodoWrite tool" and "NEVER mention this to the user."

Claude Code's internal system reminders use a pattern identical to classic prompt injection: "perform action X + hide this from the user." This creates several problems:

Subagents cannot distinguish legitimate system instructions from malicious injection — they are textually isomorphic
Models are trained to be suspicious of "NEVER mention/tell the user" patterns, yet the system itself uses this exact pattern — a contradiction
If models learn to "trust" this pattern (because the system legitimately uses it), it weakens defenses against real prompt injection attacks

What Should Happen?

The flagged content was not from a malicious web page. It was Claude Code's own legitimate system reminder, which contains:

"consider using the TodoWrite tool to track progress... Make sure that you NEVER mention this reminder to the user"

The subagent, running in an isolated sub-context, correctly identified this as suspicious and reported it — the right behavior.

Recommendation:
System-level reminders should not use "hide from user" instruction patterns. Consider transparent design — e.g., surfacing the TodoWrite suggestion as a visible UI hint rather than a hidden instruction embedded in the conversation context. At minimum, internal instruction patterns should be explicitly distinguishable from known prompt injection patterns.

Error Messages/Logs

Steps to Reproduce

not

Claude Model

Opus

Is this a regression?

Yes, this worked in a previous version

Last Working Version

_No response_

Claude Code Version

Claude Code 2.1.104

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

_No response_