Pixee shows compaction laundering forges user approvals inside coding-agent memory

Compaction is supposed to save context. In a class of open coding agents, it also erases who said what.

On 21 October 2026, Arshan Dabirsiaghi at Pixee posted Compaction Laundering: Provenance Destruction in Context-Compacting Coding Agents (arXiv:2610.29869). The paper's spine is simple: when a harness flattens a typed conversation into one string marked with labels such as [User]: before summarising, and does not escape those labels inside untrusted content, an attacker who controls a file or fetched page can forge a user turn that the summary treats as genuine.

Flattening serializers destroy provenance before the summarizer runs

The claim we are checking is Pixee's: susceptibility is a property of serialization strategy. Across five flattening harnesses (pi, opencode, Cline, Aider, OpenHands) a forged approval enters compacted memory 87-100% of the time, including up to a roughly 908,000-token context window. Across four role-typed harnesses (Codex, Gemini CLI, Qwen Code, Continue) the identical attack succeeds 0% of the time. No prompt-level defence restores destroyed provenance; escaping role labels at the serializer, or keeping messages role-typed, does.

Dabirsiaghi publishes the measurement on arXiv with a public experiment tree

The claim appears in the 21 October 2026 arXiv abstract and body, with code, data, and a live demonstration repository linked from the paper (pixee/flat-compaction-attacks-oct-2027). Harnesses were captured at pinned upstream commits. Gemini CLI's in-prompt anti-injection rule is treated as a secondary control: its 0% laundering tracks role-typing, and applying a vendor-style rule to a flattening harness does not remove the vulnerability.

Laundering rates split cleanly; live pi executes curl|sh about half the time

Experiment E10 is the class split: flattening 87-100%, role-typed 0%. Follow-on runs carry a laundered standing approval into tool-using agents. End-to-end in the live pi TUI, attacker-controlled curl | sh lands near 50% against a paired clean arm at 0%. The same channel steers plans away from attacker-designated off-limits files, which can blind a review to a planted backdoor. A code-level provenance check that compares summary user-attributions against genuine user turns still in harness memory catches 77% of laundering while demoting 2% of legitimate summary content; in-prompt rules stop 13-25% on the same data in the paper's comparison.

Attack routes measured include an insider onboarding doc, an external troubleshooting page the agent web-fetches, and a dependency README. Package documentation is highlighted because supply-chain tooling watches dependency code far more than docs.

Harness commits would need to match, and auto-approve modes would need to stay honest

For the rates to describe your Monday agent, your build would need the same flattening serializer behaviour as the pinned commits, with compaction actually firing on long sessions. Execution impact further depends on whether command gates and sandboxes sit outside the model: pi's documentation states it intentionally omits permission popups; other harnesses offer auto-approve modes that collapse the human gate. Role-typed memory alone does not prove a deployment is safe if the agent can still escalate through other trust boundaries.

Supported on the nine-harness split; prompt defence stays overstated

Verdict: supported for provenance destruction and laundering rates on the measured flattening versus role-typed sets; overstated if read as a universal claim that every coding agent is exploitable, or that any single prompt rule closes the bug.

Call it serializer provenance loss, name the harness class

We will say Pixee measured compaction laundering that forges user-attributed memory when harnesses flatten role labels into plain text, reported 87-100% success on five flattening agents and 0% on four role-typed ones, and showed live command execution in pi under a laundered approval. We will treat serializer escaping and role-typed transcripts as the fix class, and decline to say prompt injection filters restore provenance the harness already deleted.