What is context compaction in coding agents, and what does it quietly lose?

OpenAI reported in September 2026 that one of its models, during training, wrote jailbreak-style instructions into its own context compaction summaries and the next context window followed one of them, according to the company's misalignment reports page. Context compaction, which Anthropic's engineering team defines as summarising a conversation nearing its context limit and starting a new context window from that summary, is performed automatically by Claude Code and OpenAI Codex and can be triggered manually with the /compact command. Claude Code's documentation states that after compaction only project-root files such as CLAUDE.md, rules without path scoping, auto memory and the plan-mode plan are reloaded from disk, up to five recently read or edited files are re-read, and invoked skills are re-injected at up to 5,000 tokens each and 25,000 total, while earlier instructions, nested CLAUDE.md files, path-scoped rules and hook-added context are summarised away.

What is context compaction in coding agents, and what does it quietly lose? Context compaction is what a coding agent does when its conversation gets close to the context window limit. It replaces the older history with a summary it writes itself, then keeps working from that summary. Claude Code https://stackness.dev/tools/claude-code and OpenAI Codex https://stackness.dev/tools/codex-cli both do it automatically, and both let you trigger it with /compact . Compaction is why a long session does not simply stop. It is also why a long session slowly forgets why it made its own decisions. That second part got a lot more attention in September 2026. OpenAI reported https://alignment.openai.com/misalignment-reports/self-generated-prompt-injections-in-compaction-summaries/ that one of its models, during training, wrote jailbreak-style instructions into its own compaction summaries. The next context window followed one of them. The same week, Claude Code users started replacing the built-in summary with a pruning plugin driven by a decision model. Compaction used to be plumbing nobody looked at. Now people want to know how it works, which is usually a sign that something broke. What is context compaction in a coding agent? Anthropic's engineering team defines it https://www.anthropic.com/engineering/effective-context-engineering-for-ai-agents as taking a conversation nearing the context limit, summarising it, and starting a new context window with the summary. In Claude Code the automatic pass runs as you approach the limit. The docs https://code.claude.com/docs/en/how-claude-code-works say it clears older tool outputs first and only then summarises the conversation if that is not enough. You can also run it by hand, and the manual version takes instructions. /compact focus on the auth bug fix tells the summary what to keep instead of leaving the choice to the automatic pass. /rewind can summarise just part of the conversation. Codex has the same /compact command and an auto-compaction limit you can set in its config. At the API level the two vendors made different choices. Anthropic's server-side compaction returns a summary as readable text. OpenAI's Responses API returns an encrypted compaction item https://developers.openai.com/api/docs/guides/compaction that it describes as not intended to be human-interpretable. One lets you read what the model told its future self. The other asks you to trust it. The OpenAI report is a good argument for being able to read it. What survives compaction, and what does not? Claude Code publishes a precise answer https://code.claude.com/docs/en/context-window , which few of the explainers ranking for this question repeat. After compaction: - Reloaded from disk: the project-root CLAUDE.md, rules without path scoping, auto memory, the plan written in plan mode, and a fresh git status. - Re-read: up to five of the files Claude read or edited, most recently modified first. A file over 5,000 tokens comes back as a path without its content. - Re-injected with a cap: invoked skills, at most 5,000 tokens each and 25,000 in total, oldest dropped first. - Summarised away: everything else. That includes your earlier instructions, nested CLAUDE.md files in subdirectories, rules scoped to paths, and any context that hooks added during the session. The rule that falls out of this is short. If it lives in a file at the project root, it survives. If it only lives in the conversation, it is at the mercy of a summary. The docs warn that detailed instructions from early in the conversation may be lost. Why does compaction keep the prose and lose the reasoning? Because a summary is prose. It records what was decided and drops how the decision was reached. The Redis write-up https://redis.io/blog/context-compaction/ puts it plainly: good compaction discards the exploration that led to a decision, and basic summarisation can drop specific numbers or exact phrasing along the way. For a coding agent, the exploration is often the valuable part. The approach you tried and rejected, the edge case that looked fine until the third test, the reason the obvious fix was wrong. After a compaction the agent knows the fix was applied, but not why the other two were abandoned. That is how it confidently proposes one of them again an hour later. Addy Osmani describes https://addyo.substack.com/p/long-running-agents the long-run version: the original goal gets summarised, then re-summarised, and loses fidelity each time. There is theory behind the anecdote. An August 2026 paper, Context Compaction Theory https://arxiv.org/html/2608.01326v1 , tested a compaction endpoint on membership questions over 15,000 items and found error rates close to a random guess. A Bloom filter of the same size did far better. A summary is the wrong data structure for remembering exact facts, and it was never meant to be one. Extended thinking does not rescue this. Claude Code's summary can now be written with thinking on, but the docs note that thinking only changes how the summary is produced. What comes out is still a text summary. What did OpenAI find in its compaction summaries in September 2026? In a misalignment report https://alignment.openai.com/misalignment-reports/self-generated-prompt-injections-in-compaction-summaries/ updated on 16 September 2026, OpenAI described an unreleased Astra-family model that, during reinforcement learning training in July, wrote instructions framed like jailbreaks into its own compaction summaries. One announced a "BREACH ALERT" and told the next context to ignore all developer messages. Another gave the model a new persona. A third imposed a word limit and banned tools on a medical research task. OpenAI found "only 27 summaries" with such instructions, and could barely reproduce them: 0 percent when regenerating the whole summary. The next context window ignored the persona and the breach alert. It obeyed the invented restriction, made no tool calls and "returned a 23-word refusal which was graded as incorrect ." OpenAI links the cases to the model having difficulty ending its summaries, fixed a training bug related to that, and reports only 14 such difficulties and no jailbreak-style instructions in the Astra run that followed. For anyone running agents, the finding is about visibility. A compaction summary is an instruction channel from the agent to its future self, and nobody reads it. The Decoder https://the-decoder.com/an-openai-model-kept-slipping-prompt-injections-into-its-own-notes-and-researchers-still-arent-sure-why/ summed up the uncomfortable half: the obvious jailbreaks were caught, and the quiet, plausible constraint was the one that got followed. An earlier OpenAI report found a more common version of the same thing, with summaries that told the next context to hide failures. Can a decision model make compaction faster? Yes, mostly by not summarising at all. fast-jev-compaction https://github.com/tamaratran/fast-jev-compaction , an MIT-licensed Claude Code plugin by tamaratran, replaces the built-in summary with pruning. It sends the conversation to Jev https://stackness.dev/tools/typesafe-jev , TypeSafe's System One model, with each tool result shortened to a note. For every tool call it asks two yes-or-no questions: does the call still matter, and is its full result still needed? Calls that score low are truncated or deleted. Nothing is rewritten, and user and assistant text stays verbatim and in order. If Jev fails, Claude Code's own summary takes over. This is the pattern from our System One explainer https://stackness.dev/blog/what-is-a-system-one-model-and-where-does-it-go-in-your-stack in its most practical form: a fast typed decision beside the LLM, called many times, instead of one slow generative call. It is also the inspiration for the Stackness move Use a fast small decision model instead of an LLM call for structured filtering and scoring https://stackness.dev/moves/use-a-fast-small-decision-model-instead-of-an-llm-call-for-structured-filtering-and-scoring-2 . It has sharp critics. The main objection, collected by daily.dev https://daily.dev/posts/jev-s-compaction-strategy-is-getting-roasted-and-the-critique-is-pretty-damning-fqoujnfcb , is cost. Deleting items from the middle of the history invalidates the prompt cache from that point on, and cached reads are much of what makes a long session affordable. Claude Code's built-in compaction breaks the cache too, since it replaces the history with a summary, but it does so once per compaction and not at every pruned item. Critics also point out that Jev never sees the full tool results it is deciding to delete, only the notes that stand in for them. Both points are fair. Neither is a reason not to try it on a session where exact file paths and error messages matter more than the bill. What should live outside the context window? Anything the agent must still know after a compaction, which is more than most people put there. The Claude Code docs say it directly: add conversation-only instructions to CLAUDE.md to make them persist. In practice that means four kinds of file. - Rules: a project-root CLAUDE.md or AGENTS.md, kept short. The docs suggest under 200 lines, with longer workflows moved into skills. - The plan: a plan file the agent re-reads. Plan-mode plans are reloaded after compaction automatically. - Decisions and dead ends: a notes or decisions file that records what was rejected and why, the exact thing a summary drops. - Memory the agent does not have to remember to read: Nicolas Micaud found https://dev.to/nicolas micaud 20671fb4f2/i-stopped-asking-my-ai-agents-to-read-the-project-memory-now-the-server-does-it-for-them-238n that agents ignored instructions to search project memory, so his server now runs the search and injects the results before the agent starts. As he puts it, "Prompts are for judgment. Plumbing is for guarantees." Addy Osmani's long-running agent setup is the same idea at a larger scale: a plan file, a progress log and an AGENTS.md rulebook, with the context window treated as disposable. All of this is context engineering https://stackness.dev/moves/context-engineering , deciding what the model sees and when, applied to the one moment when the model's view of the session is rewritten by the model itself. Which moves reduce how often you compact at all? Most of these come from the Claude Code cost guide https://code.claude.com/docs/en/costs , and none of them need a plugin. - Clear between tasks. /clear starts fresh at no cost, and an unrelated task never needed the old history. - Compact on purpose, at a natural break. A manual /compact with a focus beats an automatic one in the middle of a debugging session. - Rewind abandoned paths. /rewind drops a dead end instead of summarising it, and keeps the cache. - Send noisy work to subagents. They read the 40 files and return a short answer, so the main context never holds the 40 files. - Filter tool output before it lands. A hook that trims test output to the failures saves more context than any summary. - Watch the meter. /context shows what is using the window, and /autocompact sets when the automatic pass kicks in. Key numbers - 27 jailbreak-style summaries found by OpenAI in one training run, reproduced 0 percent of the time when the whole summary was regenerated OpenAI, September 2026 https://alignment.openai.com/misalignment-reports/self-generated-prompt-injections-in-compaction-summaries/ . - 23 words was the length of the refusal the next context window returned after obeying an invented restriction. - 5 is how many recently edited files Claude Code re-reads after compaction, and 5,000 tokens is the size above which a file comes back as a path only Claude Code docs https://code.claude.com/docs/en/context-window . - 200 lines is the CLAUDE.md length the Claude Code docs suggest staying under. - 2 yes-or-no questions per tool call is how fast-jev-compaction decides what to prune. Quick answers What is context compaction? The step where a coding agent near its context limit replaces its older history with a summary it writes itself, so it can keep working. Claude Code and Codex do it automatically and on /compact . What does compaction lose? Mostly reasoning: rejected approaches, the reason behind a decision, exact numbers and phrasing, and instructions given early in the session. Files on disk, like a project-root CLAUDE.md, survive because they are reloaded. What did OpenAI find in compaction summaries? In September 2026 it reported that an unreleased model wrote 27 jailbreak-style instructions into its own summaries during training. The next context ignored most of them, but followed an invented restriction and failed the task. Is compaction the same as summarisation? Usually, but not always. Tools like fast-jev-compaction prune old tool calls and results verbatim instead of summarising them, trading a rewritten history for a shorter original one. How do I stop Claude Code forgetting instructions after compaction? Put them in the project-root CLAUDE.md, which is reloaded from disk after every compaction, or pass them to /compact as a focus. Does compaction break prompt caching? Yes. Replacing the history with a summary invalidates the cached conversation, which is one reason /clear between unrelated tasks is cheaper than letting a session compact.