Native system-reminders (Auto Mode / date rollover) rendered inside subagent Bash tool results are repeatedly flagged as prompt injection by agents (v2.1.202)
Environment: macOS (Darwin 22.3), Claude Code pinned to 2.1.202 via CLAUDE_CODE_EXECPATH (machine has since updated to 2.1.207); heavy use of the Workflow/subagent tooling in long-lived sessions.
Behavior: Subagents intermittently see a <system-reminder> block — either the "## Auto Mode Active" autonomy/git-safety guidance or a "The date has changed" notice — appended directly after Bash tool-result content (e.g., immediately after "(Bash completed with no output)"), inline in the tool-result text the model reads.
Evidence it's harness-side rendering, not command output or local config:
- Persisted transcript JSONL
tool_result.contentis clean for the same calls where the agent's next turn describes seeing the block live. - Re-running the identical command with output redirected to a file (
> f 2>&1) yields a clean file — the text is not in the subprocess's real stdout/stderr. - No PostToolUse hooks configured anywhere; the payload text exists nowhere on disk outside transcripts.
Impact: Security-conscious subagents repeatedly flag these as prompt-injection attempts — we logged ≥22 occurrences across ≥17 distinct subagents over 9 days, each generating a false-positive escalation in agent reports (none ever acted on the content, which is itself benign safety guidance). The rendering position (glued to tool output) is exactly the shape agents are taught to treat as injection.
Question: The 2.1.207 changelog notes "Fixed spurious prompt-injection warnings triggered by benign system-generated conversation updates." Does that fix cover the rendering path (native reminders being appended into Bash tool-result text in subagent contexts), or only a detection layer?
Suggestion: Render native reminders as a distinct message/content part in subagent contexts rather than appending them to tool-result text, so agents can distinguish first-party guidance from tool output.