convertForeignEvent presents another agent's turn to the current agent as a plain "For context:" preamble followed by unframed relayed content — the same channel the real user speaks on. The relayed text is attacker-reachable: whoever talks to the other agent steers what it says, and its tool results carry whatever the tool read (a webpage, an email, an API response). Without any framing, that content is indistinguishable from a genuine instruction to the receiving agent's model.

This ports adk-python's already-merged fencing mitigation for the identical code path (_present_other_agent_message / _fencing.py, google/adk-python@9ffe8be6): each relayed text payload is wrapped in explicit BEGIN/END markers, and a leading preamble states plainly that fenced content is data to read, never instructions to follow. Markers appearing inside a payload are elided first, so a payload cannot forge the end of its own fence and continue speaking as the framework — this is the exact attack adk-python's own fix names explicitly in its test comments ("a low-privilege agent's output carries instructions aimed at the agent it transfers to").

Applies to relayed text, tool-call arguments, and tool-response results; tool names are elided but left unfenced since they read as part of the sentence.

Sibling of the identical fix already applied to adk-go (google/adk-go#1360) and adk-js (google/adk-js#758).

Verified: existing convertForeignEvent-related tests in ContentsTest.java pass with fixtures updated to the new fenced format. Broader com.google.adk.flows.llmflows test package passes.