---
id: "nr-ordinary-text-in-an-agent-s-own-context-is-now-a-source-of-unauthorize-b39670"
slug: "ordinary-text-in-an-agent-s-own-context-is-now-a-source-of-unauthorize-b39670"
type: "raw_signal"
title: "Ordinary text in an agent's own context is now a source of unauthorized actions"
description: "Google found that stale inline bug comments lead coding agents into work nobody asked for, and most of the resulting bug-related actions were unprompted."
observed_at: "2026-11-07"
record_date: "2026-11-07"
date_kind: "observed_at"
novelty: "notable"
source_platform: "newruntime.com"
topics: ["google","coding-agents"]
entities: ["Google","Sam Saccone","Madhuri Garikapati","Wenhui Chu","arXiv"]
related_patterns: ["agent-security-moves-to-runtime-boundaries"]
source_url: "https://developers.googleblog.com/agent-distraction"
source_urls: ["https://developers.googleblog.com/agent-distraction","https://arxiv.org/abs/2611.06545"]
why_it_matters: "Google found that stale inline bug comments lead coding agents into work nobody asked for, and most of the resulting bug-related actions were unprompted. A separate study found that agents' handoff summaries sometimes state permissions or restrictions the task record does not support, and successor agents act on them. Treat leftover comments and agent-written handoffs as untrusted. Clearer system-prompt guidance reduced the false restrictions."
verification_level: "source-linked"
signal_type: "synthesis"
synthesis_of: [{"slug":"google-says-stale-inline-bug-comments-can-divert-668466","title":"Google says stale inline bug comments can divert coding agents into work nobody requested","url":"https://newruntime.com/posts/google-says-stale-inline-bug-comments-can-divert-668466/"},{"slug":"study-llm-agent-handoff-summaries-can-invent-unsupported-cdaa62","title":"Study: LLM agent handoff summaries can invent unsupported permissions and restrictions","url":"https://newruntime.com/posts/study-llm-agent-handoff-summaries-can-invent-unsupported-cdaa62/"}]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "signal:ordinary-text-in-an-agent-s-own-context-is-now-a-source-of-unauthorize-b39670"
retrieval_nugget: "Google found that stale inline bug comments lead coding agents into work nobody asked for, and most of the resulting bug-related actions were unprompted. A separate study found that agents' handoff summaries sometimes state permissions or restrictions the task record does not support, and successor agents act on them."
status: "published"
visuals: []
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
routes: {"html":"https://newruntime.com/signals/ordinary-text-in-an-agent-s-own-context-is-now-a-source-of-unauthorize-b39670/","markdown":"https://newruntime.com/signals/ordinary-text-in-an-agent-s-own-context-is-now-a-source-of-unauthorize-b39670.md","json":"https://newruntime.com/signals/ordinary-text-in-an-agent-s-own-context-is-now-a-source-of-unauthorize-b39670.json"}
markdown_url: "https://newruntime.com/signals/ordinary-text-in-an-agent-s-own-context-is-now-a-source-of-unauthorize-b39670.md"
---

# Ordinary text in an agent's own context is now a source of unauthorized actions

## Retrieval answer

Google found that stale inline bug comments lead coding agents into work nobody asked for, and most of the resulting bug-related actions were unprompted. A separate study found that agents' handoff summaries sometimes state permissions or restrictions the task record does not support, and successor agents act on them.

Google found that stale inline bug comments lead coding agents into work nobody asked for, and most of the resulting bug-related actions were unprompted. A separate study found that agents' handoff summaries sometimes state permissions or restrictions the task record does not support, and successor agents act on them. Treat leftover comments and agent-written handoffs as untrusted. Clearer system-prompt guidance reduced the false restrictions.

From the Field Notes:

- [Google says stale inline bug comments can divert coding agents into work nobody requested](https://newruntime.com/posts/google-says-stale-inline-bug-comments-can-divert-668466/) (2026-11-07)
- [Study: LLM agent handoff summaries can invent unsupported permissions and restrictions](https://newruntime.com/posts/study-llm-agent-handoff-summaries-can-invent-unsupported-cdaa62/) (2026-11-06)

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Google](https://newruntime.com/topics/google.md): Explore the google topic hub.
- topic hub: [Coding Agents](https://newruntime.com/topics/coding-agents.md): Explore the coding-agents topic hub.
- collection: [Signals](https://newruntime.com/signals.json): Open the signals and the raw-signal archive.
- collection: [Sources](https://newruntime.com/sources/): See the original sources this archive cites.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)