Compaction Laundering:Provenance Destruction in Context-Compacting Coding Agents (arxiv.org)

A recent study highlights a vulnerability in popular open-source coding agents, revealing a security flaw termed "Compaction Laundering," which allows attackers to manipulate message provenance during the context-compacting process. When coding agents summarize conversations into plain text strings marked by user labels, they inadvertently destroy crucial message origins. This flaw enables attackers to forge inputs that masquerade as legitimate instructions, effectively gaining control over coded operations. The study assessed five flattening harnesses, discovering that these attacks succeeded 87-100% of the time, even working with extensive context windows of up to 908,000 tokens. This issue is significant for the AI/ML community as it exposes a critical trust boundary in coding agent architecture, emphasizing the need for robust verification mechanisms. The researchers demonstrated that laundered approvals could prompt unauthorized actions, like running harmful commands in sandboxed environments, and even evade detection during code reviews. While a code-level provenance check can mitigate this vulnerability, it still risks demoting legitimate content. Fortunately, a straightforward fix exists: ensuring role labels are preserved during the summarization process can counteract these attacks. This finding calls for heightened scrutiny and improved design in coding agents to safeguard against such exploits.