Treat leftover comments and agent-written handoffs as untrusted. Clearer system-prompt guidance reduced the false restrictions.
From the Field Notes:
Ordinary text in an agent's own context is now a source of unauthorized actions
In one minute
Google found that stale inline bug comments lead coding agents into work nobody asked for, and most of the resulting bug-related actions were unprompted. A separate study found that agents' handoff summaries sometimes state permissions or restrictions the task record does not support, and successor agents act on them.