1 00:00:00,360 --> 00:00:03,520 If you've been leaving a /goal running overnight, there's a change on the main 2 00:00:03,580 --> 00:00:04,760 branch worth knowing about. 3 00:00:05,380 --> 00:00:09,120 And before that, thanks to Jellypod AI for sponsoring this episode. 4 00:00:09,840 --> 00:00:10,560 Okay, the change. 5 00:00:10,960 --> 00:00:17,340 It's PR number 60342, titled "Treat goal objectives as untrusted context." 6 00:00:17,820 --> 00:00:22,980 It landed after the 0.167.0 release, so it's on main, not in the stable build yet. 7 00:00:23,673 --> 00:00:24,453 Here's what changed. 8 00:00:25,053 --> 00:00:30,273 Before, a goal set through /goal could end up embedded directly in the continuation 9 00:00:30,333 --> 00:00:30,913 instructions. 10 00:00:31,303 --> 00:00:34,543 That means the objective text sat in the part of the prompt the model treats as 11 00:00:34,603 --> 00:00:35,343 instruction. 12 00:00:36,073 --> 00:00:41,913 Now, per the PR, goal objectives are passed as untrusted goal_objective context 13 00:00:41,953 --> 00:00:42,533 instead. 14 00:00:43,013 --> 00:00:45,653 They're no longer folded into the continuation instructions. 15 00:00:46,333 --> 00:00:46,973 That's the core of it. 16 00:00:47,820 --> 00:00:48,500 Why does that matter? 17 00:00:49,300 --> 00:00:51,000 Think about how a long thread works. 18 00:00:51,780 --> 00:00:57,240 A goal like "reduce p95 latency below 120 milliseconds without regressing tests" 19 00:00:57,680 --> 00:00:59,580 lives with the thread across turns. 20 00:01:00,240 --> 00:01:03,200 The model can also write or revise objectives as it works. 21 00:01:04,660 --> 00:01:08,620 And if the model has been reading a repo, or tool output, or web content, 22 00:01:09,060 --> 00:01:10,580 that material can shape what it writes. 23 00:01:11,520 --> 00:01:14,680 If that text then gets promoted into instruction level authority, 24 00:01:15,160 --> 00:01:19,100 you've got a prompt injection path into the loop that drives every continuation. 25 00:01:20,159 --> 00:01:23,920 Treating the objective as untrusted context puts a boundary there. 26 00:01:24,760 --> 00:01:27,940 That's my read of the security impact, and the PR frames the mechanism, 27 00:01:28,040 --> 00:01:29,240 not a specific attack. 28 00:01:29,967 --> 00:01:32,507 Now the mechanics, because there are several pieces. 29 00:01:33,247 --> 00:01:37,547 First, if the objective is missing or truncated, the model is directed to call 30 00:01:37,587 --> 00:01:39,107 get_goal instead of guessing. 31 00:01:39,987 --> 00:01:44,307 Second, a newly created objective is injected into the active turn that created it, 32 00:01:44,627 --> 00:01:46,747 without dropping unrelated client context. 33 00:01:47,627 --> 00:01:51,247 Third, when the UntrustedAsToolOutput feature flag is enabled, 34 00:01:51,647 --> 00:01:53,407 objectives render as tool outputs. 35 00:01:53,787 --> 00:01:57,847 The PR's tests check that model-written objectives show up as tool outputs at 36 00:01:57,907 --> 00:02:01,347 creation and at continuation, and aren't duplicated in user messages. 37 00:02:02,367 --> 00:02:06,207 Fourth, additional context is queued together with the automatic turn input, 38 00:02:06,587 --> 00:02:08,347 so both reach the first model request. 39 00:02:09,072 --> 00:02:11,272 The deduplication part is easy to overlook. 40 00:02:11,852 --> 00:02:15,912 Model-written goals and continuations used to be able to pile up as user-looking 41 00:02:15,972 --> 00:02:16,512 messages. 42 00:02:17,192 --> 00:02:20,192 Moving them out of that channel keeps your user history cleaner, 43 00:02:20,692 --> 00:02:22,412 and that's the session hygiene angle. 44 00:02:23,042 --> 00:02:27,102 It also ties back to the earlier episode on thread items list output deferral, 45 00:02:27,562 --> 00:02:29,982 where we talked about trimming payloads in thread history. 46 00:02:30,662 --> 00:02:33,702 Same theme: keep the thread lean and keep roles honest. 47 00:02:34,463 --> 00:02:35,523 How do you use this? 48 00:02:36,563 --> 00:02:38,123 Day to day, nothing changes. 49 00:02:39,023 --> 00:02:44,183 You still type /goal followed by an outcome, and you still use /goal pause, 50 00:02:44,383 --> 00:02:45,423 resume, and clear. 51 00:02:46,243 --> 00:02:49,863 The difference shows up if you build on the SDK or app-server. 52 00:02:51,043 --> 00:02:58,043 Expect goal content to arrive as a goal_objective payload, or as a tool output 53 00:02:58,103 --> 00:03:02,503 when UntrustedAsToolOutput is on, not as a normal user turn. 54 00:03:03,403 --> 00:03:06,603 If you have a client that watches thread items and assumes anything 55 00:03:06,663 --> 00:03:10,343 instruction-shaped came from the user, check that assumption. 56 00:03:11,215 --> 00:03:12,295 Two caveats. 57 00:03:13,155 --> 00:03:17,915 One: custom clients and JSON-RPC consumers should handle the new shape, 58 00:03:18,235 --> 00:03:21,175 so test your item parsing against a main build. 59 00:03:21,935 --> 00:03:24,235 Two: long goals and compaction. 60 00:03:24,835 --> 00:03:28,815 If the objective gets truncated, the model recovers through get_goal. 61 00:03:29,395 --> 00:03:32,395 So make sure that tool is actually available in your setup, 62 00:03:32,655 --> 00:03:34,135 or the thread can lose direction. 63 00:03:34,995 --> 00:03:41,675 And remember, this is main branch, not 0.167.0, so verify before you rely on it. 64 00:03:42,382 --> 00:03:43,922 Quick smaller items from main. 65 00:03:44,362 --> 00:03:50,442 PR 60391 simplifies Guardian's post denial guidance: if you re-approve after seeing 66 00:03:50,482 --> 00:03:55,042 the concrete risk, user authorization is set to high, with the repeated qualifiers 67 00:03:55,082 --> 00:03:55,522 removed. 68 00:03:56,242 --> 00:04:02,242 PR 60390 lets plain text MCP output be deferred in thread items list, 69 00:04:02,582 --> 00:04:05,402 continuing the work from PR 59601. 70 00:04:06,202 --> 00:04:07,782 That one pairs nicely with the goal change. 71 00:04:08,362 --> 00:04:13,942 PR 60414 makes model catalog discovery work with gateway OAuth credentials. 72 00:04:14,382 --> 00:04:19,442 PR 60416 keeps URLs intact in fullscreen Markdown transcripts. 73 00:04:19,922 --> 00:04:25,002 And PR 60418 lets the terminal status flip to done even while background terminal 74 00:04:25,082 --> 00:04:26,202 processes keep running. 75 00:04:26,903 --> 00:04:32,663 Also, this builds on the 0.167.0 theme of command rules needing fresh human 76 00:04:32,703 --> 00:04:33,163 approval. 77 00:04:34,603 --> 00:04:37,743 Same direction: be explicit about what carries authority. 78 00:04:38,443 --> 00:04:41,623 If you ship agent tooling, that's a good lens for your own prompts. 79 00:04:42,343 --> 00:04:42,903 That's the update. 80 00:04:43,383 --> 00:04:44,183 Go test it on main.