Cleaner Evidence, and New Limits on Read-Only
September 5, 2026 · InfraScout Team
Three changes worth knowing about, the first of which is worth checking your existing findings against.
Evidence is recorded verbatim again
Tool results were being escaped as though they were about to be embedded in a web page — <, > and & rewritten into escape sequences before the model ever saw them.
The model then did the reasonable thing with what it had been shown. Handed an internet message ID as <6a99…>, it re-emitted the value as <6a99…>: into a query filter, where it matched nothing, and into the evidence field of a saved finding, where it is what a human reads during review. So this was not merely wasteful encoding — it was corrupting the record of what an assessment found.
Every path that returns a tool result now passes it through unescaped, event log entries and WMI objects included, which are the densest source of angle brackets in the product. A check is in place to keep it that way.
Check findings saved before September 5, 2026
This corrects what gets recorded from now on. A finding whose evidence was written while the fault was live still holds the escape sequences it was saved with. If you see < or > where a bracket belongs, that is the cause, and the value behind it is intact.
Read-only PowerShell: one cmdlet allowed, several refused
agent_exec_powershell_readonly validates a script before dispatch and refuses anything that looks like it changes host state. Two corrections to where that line sits.
Add-PSSnapin is now allowed. It loads a snap-in already registered on the host and cannot install one — its entire syntax is a name and a switch. Refusing it meant an Exchange read on an older server failed with an unrecognized cmdlet, on the very tool built for that work.
Search-Mailbox is now partly refused. Search sits with Get and Test as a read verb, which is the right classification for every other Search-* cmdlet. This one is different: it also takes parameters that permanently purge mailbox content, or copy a target's mailbox somewhere else. Those forms are refused by name, keyed on the parameter prefixes rather than the full spellings, because PowerShell binds any unambiguous abbreviation. Discovery use — estimating what a query would match — still passes, and Search-MailboxAuditLog is unaffected.
Chat can find a playbook on its own
A published playbook used to be invisible to a conversation unless you bound the conversation to it up front. You had to say "there is a playbook" out loud before the AI went looking, and otherwise it reconstructed the recipe from memory instead — at length, and without the guidance the playbook already carried.
Playbooks are now part of what chat knows about from the start. Leave the picker on None and the AI can still discover and open a published playbook when your question turns out to match one.
Reference: Agent Tools and Chat.
Questions or feedback? Reach us at info@infrascout.cloud.