The prompt-injection screen reads a reply in its conversation
An ordinary reply such as "ignore and finish task" is no longer refused as a prompt-injection attempt.
That reply, answering our question about an empty repository, scored 84% likely to be an attack because the screen saw it without the question. On Linear the screen now reads a reply against the comments before it, a message sent mid-run is read against the request being worked on, and no single word such as ignore, stop or instead counts against a message. A reply from the person who started the task now needs 95% to be refused and everyone else's still needs 80%; that is a loosening, since an attack sent from their account needs a surer flag. One thing is stricter: code that runs a script fetched from an unexpected source is now flagged. On GitHub and Slack, a reply that starts a run is still read without the comments before it.