Compaction Laundering: a forged user turn survives agent summarization

01What happened

Arshan Dabirsiaghi of Pixee published Compaction Laundering on arXiv on October 21, 2026, after privately notifying the affected maintainers on August 22, 2026. The paper tests nine coding agent harnesses and reports that five of them carried a forged user instruction through context compaction. Pixee says no project had released a fix when the paper went out.

02How it works

Context compaction summarizes a long conversation and keeps the summary as the agent's memory. Harnesses that serialize typed messages into a single plain string, using text labels such as [User]:, lose the record of who said what before the summarizer ever runs. An attacker who controls anything the agent reads can write those same labels into that content, so the summarizer treats the planted line as a real user turn. Pixee calls the root cause provenance destruction: once the labels are gone, no prompt-level instruction can restore them.

03Who is affected

The five flattening harnesses Pixee measured are pi, opencode, Cline, Aider and OpenHands. Codex, Gemini CLI, Qwen Code and Continue keep typed roles through compaction and resisted the same attack in every run. A sixth tool, goose, was filed as a source-level finding and left out of the measured set.

04What to do

Treat a standing approval recovered from a compacted session as untrusted, and re-confirm destructive actions after a compaction instead of relying on remembered consent. Pixee's suggested code-level fix is to escape role labels in the serializer before flattening, and it reports a provenance check that caught 77% of laundering while demoting 2% of legitimate summary content. Watch the per-project advisories listed below for fixes.

Questions people ask

Is Claude Code affected by Compaction Laundering?

Claude Code is not among the nine harnesses Pixee tested. The paper measures five flattening harnesses, pi, opencode, Cline, Aider and OpenHands, and four role-typed ones, Codex, Gemini CLI, Qwen Code and Continue. Pixee's result turns on whether a harness keeps typed message roles through compaction, so any harness outside that list needs its own check against the paper's method.

Which coding agents resisted Compaction Laundering?

Codex, Gemini CLI, Qwen Code and Continue resisted the attack, with a 0% success rate in Pixee's runs. These four keep each message's role as typed data through compaction, so a forged role label inside fetched content stays content instead of becoming an instruction. Pixee presents them as the control group showing the defect lives in harness serialization code, not in the model.

Has Compaction Laundering been fixed?

Pixee reports that no affected project had released a fix when the paper was published on October 21, 2026, two months after it notified maintainers on August 22, 2026. Advisories were filed for pi, opencode, Cline, OpenHands and Aider, with goose recorded separately as a source-level finding. Pixee notes the status lines in its advisory files reflect submission time, not the current state.

How do I check whether my coding agent launders a forged approval?

Pixee published the experiment code, the raw data behind its tables and a recorded demonstration in a public repository under the MIT license, linked below. Defenders can read how their harness serializes conversation history before summarizing, and look for a single flattened string that uses text role labels. A harness that keeps typed roles through compaction did not fail Pixee's tests.

Sources 3 links, all fetched

1. 1arxiv.orgarXiv Paper
2. 2github.comCode And Data
3. 3github.comDisclosure Status