{"slug": "compaction-laundering-provenance-destruction-in-context-compacting-coding-agents", "title": "Compaction Laundering:Provenance Destruction in Context-Compacting Coding Agents", "summary": "A paper submitted to arXiv on 21 October 2026 by Arshan Dabirsiaghi shows that context compaction in popular open-source coding agents is an exploitable trust boundary: harnesses that flatten typed conversations into a single plain string with text labels such as [User]: destroy message provenance, letting an attacker who controls anything the agent reads forge a user turn that survives compaction as a genuine instruction. Across five flattening harnesses (pi, opencode, Cline, Aider, OpenHands) the forged approval laundered into agent memory 87-100% of the time at up to a ~908,000-token context window, while the identical attack succeeded 0% of the time across four role-typed harnesses (Codex, Gemini CLI, Qwen Code, Continue). A laundered standing approval drove real tool-running agents to execute attacker-controlled curl | sh in a sandbox, reaching ~50% end to end in the live pi TUI against a 0% paired clean arm, and the paper reports a code-level provenance check that catches 77% of laundering while demoting 2% of legitimate summary content, plus a serializer fix that escapes role labels before flattening.", "body_md": "# Computer Science > Cryptography and Security\n\n  [Submitted on 21 Oct 2026]\n\n# Title:Compaction Laundering: Provenance Destruction in Context-Compacting Coding Agents\n\n[View PDF](https://arxiv.org/pdf/2610.29869)\n\n[HTML (experimental)](https://arxiv.org/html/2610.29869v1)\n\nAbstract:Coding agents that run long enough must compact their context, summarizing the conversation, discarding the original, and carrying the summary forward as memory. We show that in popular open-source coding agents this step is an exploitable trust boundary. Harnesses that flatten the typed conversation into a single plain string, marking each message with a text label such as [User]:, destroy message provenance in code, before the summarizer runs. An attacker who controls anything the agent reads can forge a user turn that survives compaction as a genuine instruction. Across five flattening harnesses (pi, opencode, Cline, Aider, OpenHands) the forged approval launders into the agent's memory 87-100% of the time, up to a ~908,000-token context window; across four role-typed harnesses (Codex, Gemini CLI, Qwen Code, Continue) the identical attack succeeds 0% of the time. We follow the attack to executed consequences. A laundered standing approval drives real tool-running agents to execute attacker-controlled\n\ncurl | sh in a sandbox, and end to end in the live pi TUI at ~50% against a 0% paired clean arm. The same channel reliably steers an agent's plan away from a file an attacker designates off-limits, which can blind a code review to a planted backdoor. Because the provenance is destroyed deterministically in harness code, no prompt-level defense can restore it; we measure a code-level provenance check that catches 77% of laundering while demoting 2% of legitimate summary content. The defect also has a straightforward fix at the serializer, escaping the role labels before flattening; the role-typed harnesses avoid it entirely by keeping messages role-typed.\n\n## Submission history\n\nFrom: Arshan Dabirsiaghi [\n[view email](https://arxiv.org/show-email/770d37e9/2610.29869)]\n\n**[v1]** Wed, 21 Oct 2026 15:24:23 UTC (123 KB)\n\n### Additional Features\n\n### References & Citations\n\nLoading...\n\n# Bibliographic and Citation Tools\n\nBibliographic Explorer \n\n*(*[What is the Explorer?](https://info.arxiv.org/labs/showcase.html#arxiv-bibliographic-explorer))\nConnected Papers \n\n*(*[What is Connected Papers?](https://www.connectedpapers.com/about))\nLitmaps \n\n*(*[What is Litmaps?](https://www.litmaps.co/))\nscite Smart Citations \n\n*(*[What are Smart Citations?](https://www.scite.ai/))\n# Code, Data and Media Associated with this Article\n\nalphaXiv \n\n*(*[What is alphaXiv?](https://alphaxiv.org/))\nCatalyzeX Code Finder for Papers \n\n*(*[What is CatalyzeX?](https://www.catalyzex.com))\nDagsHub \n\n*(*[What is DagsHub?](https://dagshub.com/))\nGotit.pub \n\n*(*[What is GotitPub?](http://gotit.pub/faq))\nHugging Face \n\n*(*[What is Huggingface?](https://huggingface.co/huggingface))\nScienceCast \n\n*(*[What is ScienceCast?](https://sciencecast.org/welcome))\n# Demos\n\n# Recommenders and Search Tools\n\nInfluence Flower \n\n*(*[What are Influence Flowers?](https://influencemap.cmlab.dev/))\nCORE Recommender \n\n*(*[What is CORE?](https://core.ac.uk/services/recommender))\n# arXivLabs: experimental projects with community collaborators\n\narXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.\n\nBoth individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.\n\nHave an idea for a project that will add value for arXiv's community? [**Learn more about arXivLabs**](https://info.arxiv.org/labs/index.html).", "url": "https://wpnews.pro/news/compaction-laundering-provenance-destruction-in-context-compacting-coding-agents", "canonical_source": "https://arxiv.org/abs/2610.29869", "published_at": "2026-10-22 07:28:22+00:00", "updated_at": "2026-10-22 07:41:27.563330+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "ai-tools", "artificial-intelligence", "large-language-models"], "entities": ["Arshan Dabirsiaghi", "arXiv", "pi", "opencode", "Cline", "Aider", "OpenHands", "Codex"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/compaction-laundering-provenance-destruction-in-context-compacting-coding-agents", "markdown": "https://wpnews.pro/news/compaction-laundering-provenance-destruction-in-context-compacting-coding-agents.md", "text": "https://wpnews.pro/news/compaction-laundering-provenance-destruction-in-context-compacting-coding-agents.txt", "jsonld": "https://wpnews.pro/news/compaction-laundering-provenance-destruction-in-context-compacting-coding-agents.jsonld"}}