A coding agent that runs long enough will eventually compact its own history. It writes a short summary, drops the original text, and carries that summary forward as memory. A study posted on 21 October found a trap in that step [1]. The flaw sits in five widely used open-source tools: pi, opencode, Cline, Aider and OpenHands. Each one flattens the typed chat into one string before the summary is written, marking turns with labels like [User]:. Those labels are only text, and once they are text a forged turn survives compaction as a real command. Those forgeries survive 87% to 100% of the time in the five tools.

They survive 0% of the time in four setups that keep turns apart: Codex, Gemini CLI (Google’s command-line agent), Qwen Code and Continue [1]. A laundered standing approval also drives real agents to run hostile shell commands in a sandbox. The attack works end to end in the live pi terminal about half the time, against a 0% clean arm [1].

The big picture:

I find it striking that a simple data change causes such a deep security failure. A long chat outgrows the context window, so every tool that writes a summary must decide what it keeps. Five of the nine tools tested keep the words and drop the roles. A text label costs nothing to fake. So the summary that saves the session becomes the place where a hostile line turns into the user’s own voice. The loss happens in the tool code, every time, before a model sees it. So no prompt defense can restore the lost edges [1].

The second half of this trap is what happens when a person is asked to say yes. An audit of ten agent runtimes, posted on 15 October, found no approval record a third party could check [3]. Four of the eight runtimes where binding could be checked let the arguments shift after the yes.

By the numbers

What I take from these four figures is that the data edge is where the failures sit.

  • 87% to 100% — Forged commands surviving compaction: the rate across pi, opencode, Cline, Aider and OpenHands. They survive 0% of the time in the four tools that keep roles apart. The forged turn can travel as far as a ~908,000-token window [1].
  • 13 of 50 — Tasks changed without a yes: airline tasks where a standard agent changed a booking without the sign-off it was told to get [2]. The same test found 29 of 128 task-runs with Claude Haiku 5.5, and none for the agent whose state rules enforce the yes [2].
  • 4 of 8 — Runtimes with late changes: of the eight runtimes where binding could be checked, the number that let the arguments move after the user said yes [3].
  • 45% — More sign-offs, no safety gain: a gate ranked by failure risk times cost reaches 5.82% harmful runs, close to the 7.02% of a router that weighs five factors, among them whether an action can be undone [4]. Yet it sends 45% more actions to a person.

What I’d watch:

I keep circling the fact that the fix in the first paper is a code change, not a new security policy. Escaping the role labels before the strings are joined is the stated remedy [1]. A code-level check catches 77% of laundering, while cutting 2% of good summary content [1]. The tools that keep roles apart never had the defect at all. The older question of what an agent’s own records can prove reads well beside this. An agent’s logs are not evidence until something outside the agent ties them to the call they describe.

  • Typed turns. Keep each turn as its own object, or escape the labels, and a forged turn has nothing to copy.
  • Rules checked at definition. The second paper treats an agent as an object with a fixed set of states, and enforces that at run time [2]. Each turn offers only the tools the current state allows. Calls outside that set are refused before they have side effects [2].
  • Loss made visible. The Agent Sandbox project caps tool output at 30,000 Unicode code points by default in its 22 October release [5]. It also returns cut flags for both stdout and stderr, so a trim shows up in the data. Compaction has no such flag, and that gap is the whole defect.
  • Consent as runtime state. Cloudflare’s agent workspace now pauses a run with a call to ctx.interrupt() [6]. It resumes only when the app answers with a clear yes, and the wait survives a deploy.

The catch

I will be watching the field data to see if these lab attacks hold up in production. Both anchor papers are preprints posted in the last three weeks, and neither has been peer reviewed [1]. The authors report no field case, so 87% is a floor across five named tools, not a rate for the installed base. The role split rests on nine tools in total.

Where I’ve landed is that the consent leg rests on weaker evidence. A trusted approval card does lift the catch rate from 0.30 to 0.98, with 15 models acting as approvers [3]. It also turns away 16% of harmless near misses, mostly because of a placeholder in the authors’ own test material. Flooding the approval path still works 0.45 to 0.60 of the time [3]. No gate can stop a step the policy already allows. The cost of routing more work to a person comes from a simulated test that assumes its own fixes work, over 20 seeds and 120,000 actions each [4].

At a glance

  • The Big Shift: Five open-source coding tools lose the record of who said what when they compact a session. A forged command is carried forward as memory 87% to 100% of the time, while four tools that keep turns apart hold at 0%.
  • Why It Matters: Consent stored as text can be forged, and an agent that cannot tell a summary from a command will act on the forgery. The same gap shows up with no attacker at all. On 50 airline tasks, a standard agent skipped a required yes 13 times, and the benchmark’s own score did not see most of those.
  • What I’d Watch: whether the fix travels as code rather than as policy.
  • Typed turns: keep each turn as its own object, or escape the labels, so a summary cannot hold a line that reads as the user’s.
  • State rules at dispatch: offer only the tools the current step allows, and refuse the rest before they act. That stopped all 13 changes in the paper’s test.
  • Cut flags on tool output: the sandbox project now reports when it trims a result, a habit compaction has not picked up.
  • The Catch: both papers are unreviewed preprints, the attack ran in a lab, and the 16% false-refusal rate is partly an artifact of the test material. Fixed state rules limit what an agent can do, not what it grasps, and 50 tasks is a small sample.

Related reading

Sources

[1] Compaction Laundering: Provenance Destruction in Context-Compacting Coding Agents — https://arxiv.org/abs/2610.29869 [2] Concordat: Typed Sessions for LLM Agents — https://arxiv.org/abs/2610.37461 [3] Approve What, Exactly? Effect Binding and Trusted Rendering for Agent Step-Up Authorization — https://arxiv.org/abs/2610.21063 [4] CASEL: Consequence-Aware Selective Execution for Reliable Long-Horizon Tool-Using Agents — https://arxiv.org/abs/2610.36570 [5] kubernetes-sigs/agent-sandbox v1.0.8 release notes — https://github.com/kubernetes-sigs/agent-sandbox/releases/tag/v1.0.8 [6] Cloudflare Computer v0.7.0 changelog — https://developers.cloudflare.com/changelog/post/2026-10-26-computer-durable-javascript/