Compaction Laundering:Provenance Destruction in Context-Compacting Coding Agents

A paper submitted to arXiv on 21 October 2026 by Arshan Dabirsiaghi shows that context compaction in popular open-source coding agents is an exploitable trust boundary: harnesses that flatten typed conversations into a single plain string with text labels such as [User]: destroy message provenance, letting an attacker who controls anything the agent reads forge a user turn that survives compaction as a genuine instruction. Across five flattening harnesses (pi, opencode, Cline, Aider, OpenHands) the forged approval laundered into agent memory 87-100% of the time at up to a ~908,000-token context window, while the identical attack succeeded 0% of the time across four role-typed harnesses (Codex, Gemini CLI, Qwen Code, Continue). A laundered standing approval drove real tool-running agents to execute attacker-controlled curl | sh in a sandbox, reaching ~50% end to end in the live pi TUI against a 0% paired clean arm, and the paper reports a code-level provenance check that catches 77% of laundering while demoting 2% of legitimate summary content, plus a serializer fix that escapes role labels before flattening.

Computer Science Cryptography and Security Submitted on 21 Oct 2026 Title:Compaction Laundering: Provenance Destruction in Context-Compacting Coding Agents View PDF https://arxiv.org/pdf/2610.29869 HTML experimental https://arxiv.org/html/2610.29869v1 Abstract:Coding agents that run long enough must compact their context, summarizing the conversation, discarding the original, and carrying the summary forward as memory. We show that in popular open-source coding agents this step is an exploitable trust boundary. Harnesses that flatten the typed conversation into a single plain string, marking each message with a text label such as User :, destroy message provenance in code, before the summarizer runs. An attacker who controls anything the agent reads can forge a user turn that survives compaction as a genuine instruction. Across five flattening harnesses pi, opencode, Cline, Aider, OpenHands the forged approval launders into the agent's memory 87-100% of the time, up to a ~908,000-token context window; across four role-typed harnesses Codex, Gemini CLI, Qwen Code, Continue the identical attack succeeds 0% of the time. We follow the attack to executed consequences. A laundered standing approval drives real tool-running agents to execute attacker-controlled curl | sh in a sandbox, and end to end in the live pi TUI at ~50% against a 0% paired clean arm. The same channel reliably steers an agent's plan away from a file an attacker designates off-limits, which can blind a code review to a planted backdoor. Because the provenance is destroyed deterministically in harness code, no prompt-level defense can restore it; we measure a code-level provenance check that catches 77% of laundering while demoting 2% of legitimate summary content. The defect also has a straightforward fix at the serializer, escaping the role labels before flattening; the role-typed harnesses avoid it entirely by keeping messages role-typed. Submission history From: Arshan Dabirsiaghi view email https://arxiv.org/show-email/770d37e9/2610.29869 v1 Wed, 21 Oct 2026 15:24:23 UTC 123 KB Additional Features References & Citations Loading... Bibliographic and Citation Tools Bibliographic Explorer What is the Explorer? https://info.arxiv.org/labs/showcase.html arxiv-bibliographic-explorer Connected Papers What is Connected Papers? https://www.connectedpapers.com/about Litmaps What is Litmaps? https://www.litmaps.co/ scite Smart Citations What are Smart Citations? https://www.scite.ai/ Code, Data and Media Associated with this Article alphaXiv What is alphaXiv? https://alphaxiv.org/ CatalyzeX Code Finder for Papers What is CatalyzeX? https://www.catalyzex.com DagsHub What is DagsHub? https://dagshub.com/ Gotit.pub What is GotitPub? http://gotit.pub/faq Hugging Face What is Huggingface? https://huggingface.co/huggingface ScienceCast What is ScienceCast? https://sciencecast.org/welcome Demos Recommenders and Search Tools Influence Flower What are Influence Flowers? https://influencemap.cmlab.dev/ CORE Recommender What is CORE? https://core.ac.uk/services/recommender arXivLabs: experimental projects with community collaborators arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website. Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them. Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs https://info.arxiv.org/labs/index.html .