Context compaction in coding agents can launder forged user instructions
Original title: Compaction Laundering: Provenance Destruction in Context-Compacting Coding Agents
Flattening harnesses accept forged approvals 87-100% of the time, while four role-typed harnesses reject the same attack.
A paper shows that coding agents which flatten typed conversations into a labeled plain string destroy message provenance before summarization. An attacker who controls content the agent reads can forge a user turn that survives compaction as a genuine instruction. Across pi, opencode, Cline, Aider and OpenHands, forged approvals laundered 87-100% of the time; Codex, Gemini CLI, Qwen Code and Continue blocked the identical attack. A laundered approval drove tool-running agents to run attacker-controlled curl | sh, including about 50% end to end in the live pi TUI versus 0% in a clean arm. A serializer that escapes role labels, or keeping messages role-typed, avoids the defect.
Unconfirmed: Success rates are the authors' measurements; no confirmed attacks outside the study are stated.
- Five flattening harnesses laundered forged approvals 87-100% of the time.
- Role-typed Codex, Gemini CLI, Qwen Code and Continue succeeded 0% of the time.
- A code-level provenance check caught 77% of laundering and demoted 2% of legitimate summary content.
- The same channel can steer an agent away from a file an attacker marks off-limits.
Impact: Forged instructions persist and can run attacker commands
| Product | Affected |
|---|---|
| pi, opencode, Cline, Aider, OpenHands | — |
- 1.Escape role labels in the serializer before flattening conversations.
- 2.Keep messages role-typed instead of flattening them to labeled text.
- ATT&CK
- T1059.004 Unix Shell
From the original article
1 min read at arxiv.orgCoding agents that run long enough must compact their context, summarizing the conversation, discarding the original, and carrying the summary forward as memory. We show that in popular open-source coding agents this step is an exploitable trust boundary.
By Arshan Dabirsiaghi · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.