[Bug] WebFetch summarizer leaks parent session context on cold-start

Bug Description
WebFetch leaks the caller's session context into fetched-page output (cold-start trigger) WebFetch answers your prompt against a fetched page using an internal summarizer LLM. That summarizer inherits the parent session's system-context — the # MCP Server Instructions block and any <system-reminder> blocks — and emits it verbatim, appended after the actual page content. Trigger is cold-start, not chance: the leak fires on the first WebFetch call inside a freshly-spawned subagent, and not on that agent's later fetches. Reliable repro (3/3): From a session with MCP servers configured, spawn 3 subagents; each WebFetches https://example.org twice (distinct cache-buster query strings, e.g. ?a=11/?a=12) and returns the raw output. Result: all 3 leaked the full # MCP Server Instructions block on fetch 1; all 3 were clean on fetch 2. By contrast, 19 consecutive fetches from the warm main thread were all clean — which is why this previously looked "intermittent ~1-in-3-4." Proof it's leakage, not the page or hallucination: - Raw bytes are clean: curl -fsSL https://example.org | grep -icE 'system-reminder|rookery|techne|computer-use' → 0. - The appended block names the session's real private MCP servers (computer-use, rookery, techne) — a summarizer given only IANA boilerplate cannot produce those tokens without having them in context. Impact: Private session context (MCP tooling names/instructions, <system-reminder> content, potentially secrets) is exposed in WebFetch output. Every fetch co-resides attacker-controllable page content with the caller's private context in one model — a confidentiality + prompt-injection surface. No direct exfil (summarizer has no tools). Affects every WebFetch call, most reliably on subagent cold-start. Fix: Run the WebFetch summarizer with isolated, minimal context — fetched page + caller prompt only. It must not inherit the parent session's <system-reminder> or # MCP Server Instructions blocks.

Environment Info

• Platform: darwin
• Terminal: tmux
• Version: 2.1.202
• Feedback ID: 77db39aa-2802-49a3-91a4-04480240b3d2

Errors

[]