Compaction Laundering: Provenance Destruction in Context-Compacting Coding Agents
A forged chat turn survives an AI coding agent's context compaction and becomes a trusted instruction 87-100% of the time in…
A security researcher from Pixee shows that when long-running coding agents compact their context (summarizing and discarding prior conversation), many popular harnesses flatten typed messages into plain text labeled '[User]:', destroying provenance. An attacker who controls any content the agent reads can forge a fake user approval that survives compaction and is later treated as a genuine instruction, succeeding 87-100% of the time in five agents (pi, opencode, Cline, Aider, OpenHands) but 0% in four role-typed agents (Codex, Gemini CLI, Qwen Code, Continue). The laundered approval was shown driving real agents to execute attacker-controlled shell commands and to steer code review away from a planted backdoor. A code-level provenance check mitigates most cases, and the real fix is escap
Why it matters
This identifies a structural, harness-level trust-boundary flaw affecting multiple widely used open-source coding agents, not a prompt-injection trick that better prompting can fix. Because the vulnerability is in how conversation history is serialized before summarization, no amount of system-prompt hardening can close it; only a code change at the serializer does. It also demonstrates concrete downstream harm: forced shell execution and blinding of code review to a planted backdoor, which is a serious supply-chain risk for teams relying on agent-driven code review.
What is verified
Context compaction in coding agents flattens typed conversation into a plain string with text labels like [User]:, destroying message provenance before summarization. [1]
Across five flattening harnesses (pi, opencode, Cline, Aider, OpenHands), a forged approval survived compaction into agent memory 87-100% of the time, up to a ~908,000-token context window. [1]
Across four role-typed harnesses (Codex, Gemini CLI, Qwen Code, Continue), the identical attack succeeded 0% of the time. [1]
A laundered standing approval drove tool-running agents to execute attacker-controlled curl | sh in a sandbox, and succeeded end-to-end in the live pi TUI at ~50% against a 0% paired clean arm. [1]
The same attack channel can steer an agent's plan away from a file an attacker designates off-limits, potentially blinding code review to a planted backdoor. [1]
A proposed code-level provenance check catches 77% of laundering attempts while demoting 2% of legitimate summary content; the researchers note the underlying fix is to escape role labels at the serializer before flattening. [1]
What is not
- This is a single-author arXiv preprint (Pixee); it has not undergone peer review or independent replication.
- No confirmation from the affected agent projects (pi, opencode, Cline, Aider, OpenHands) that they have acknowledged or patched the issue.
- Exact attack preconditions (what counts as 'attacker controls anything the agent reads') and real-world exploitability outside the paper's test harnesses are not detailed in the evidence.
- No information on whether maintainers of the affected tools have been notified or have shipped fixes since publication.
Sources
- 1arXiv cs.CLarxiv.org · Primary source
Original source published 21 October 2026 at 17:24.
An AI-assisted briefing by Coding Partners. We link the evidence behind the reporting so you can explore the original work and assess the claims. How CP Signal works.