Compaction Laundering: Provenance Destruction in Context-Compacting Coding Agent
Comments
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Summary
A new arXiv paper finds that coding agents which flatten chat history into one text string before compaction let anything the agent reads forge a "[User]:" line that survives as a user instruction. Across pi, opencode, Cline, Aider and OpenHands this happened 87–100% of the time, versus 0% in four role-typed harnesses. Live in pi, attacker code ran in 3 of 6 poisoned sessions and 0 of 5 clean ones. Escaping role labels is the proposed fix; a code-level check caught 77%.