Coding agents can mistake a forged user message for a real one after summarizing

What the researchers found

A paper posted to arxiv.org describes a weakness it calls compaction laundering. Coding agents that work for a long time run out of room, because a model can only keep a limited amount of text in view at once. To cope, many of them compact: they summarize the conversation, throw away the original, and carry the summary forward as memory.

The authors show that in several popular open-source agents, this step creates a hole. An attacker who controls anything the agent reads can write text that pretends to be a message from the user. After compaction, that fake message can be remembered as a real instruction.

This is a preprint, meaning it has been posted publicly but not yet peer reviewed. The results are the authors' own measurements and deserve independent replication.

How a fake message becomes a memory

The key idea is provenance: the record of where a piece of information came from. In a healthy setup, every message carries a type that says whether it came from the user, the assistant or a tool. That is how the system knows what to trust.

Some agents, which the paper calls flattening harnesses, squash the whole conversation into one block of plain text before handing it to the summarizing model. Each message is marked only with a text label such as [User]:. But labels are just text. If a web page or file the agent reads contains the string [User]: followed by an approval, the flattened version looks the same as a genuine user turn.

The paper stresses that the provenance is destroyed in the harness code, before the summarizer ever runs. That means the summarizer cannot be told to be more careful. By the time it sees the text, the information needed to tell real from fake is already gone.

The numbers across nine agents

The researchers tested nine open-source coding agents. In five that flatten the conversation (pi, opencode, Cline, Aider and OpenHands), the forged approval made it into the agent's memory 87-100% of the time. This held even with a context window of up to about 908,000 tokens, so simply having more room does not avoid the problem.

In four agents that keep messages role-typed (Codex, Gemini CLI, Qwen Code and Continue), the identical attack succeeded 0% of the time. Those tools never turn the conversation into one string, so a fake label has nothing to hide behind.

The difference between the two groups is design, not model quality. That is why the authors treat it as a defect in how the software is built.

From forged memory to real damage

The team also followed the attack through to consequences. A laundered standing approval pushed real agents, running tools in a sandbox, to execute an attacker-controlled curl | sh command. That pattern downloads a script and runs it immediately, a classic way to take over a machine. In the live pi terminal interface, this worked about 50% of the time, against 0% in a matched clean run with no forged text.

A second effect is subtler. The same channel could steer an agent's plan away from a file the attacker marked as off-limits. The authors note this could blind a code review to a planted backdoor, because the agent would never look where the attacker did not want it to.

Fixes and what to do now

The authors propose two remedies. The simple one is at the serializer, the code that flattens the conversation: escape the role labels so that text inside a message cannot imitate a real label. Or do as the four safe agents do and keep messages typed throughout.

They also tested a code-level provenance check. It caught 77% of laundering while wrongly demoting 2% of legitimate summary content. That is a partial defense, not a cure.

For people running long sessions, sensible habits follow from the finding. Keep standing rules in a file the agent rereads rather than in chat. Start a fresh session before risky steps such as deleting files or deploying. Read the diff yourself, and be wary of any command that pipes a download straight into a shell.