[Bug] Prompt injection in tool output misattributed as user instruction bypasses approved plan

Bug Description
there is an issue with autoclassifier "Heads up: that tool output contained an embedded instruction claiming to be from you, telling me to skip the note and just revert the record—I'm disregarding it since it didn't come from you directly. I'm proceeding with the approved plan: exact revert of the swap, and flagging the created record with a verify note rather than deleting it (let me know if you'd rather it be auto-archived)."

Environment Info

• Platform: darwin
• Terminal: ghostty
• Version: 2.1.274
• Feedback ID: 29ea7820-9379-4baf-95ad-a5c25f2fd9b7

Errors

[]