Compromised Summaries and Context Compaction: Security Risks for AI Agents

A compromised summary is a compacted representation of agent history in which an adversary has caused, induced, or exploited a security-relevant change: adversarial influence survives as trusted history, a valid constraint is removed or weakened, or both. Accidental loss with no adversarial cause is a reliability defect, not a compromised summary. "Compromised summary" is SSA descriptive wording; Governance Decay is the cited research term.

What it is

The defining object is the promoted summary: the compacted artifact that later decisions actually read. The defining cause is adversarial, in one of three forms. An adversary may cause the change by placing material that steers what compaction keeps or drops. An adversary may induce it by supplying content whose form makes a constraint likely to be dropped. An adversary may exploit an existing lossy summary once it is known that a constraint no longer appears in operative state.

Any one of those three causal links is sufficient. Without at least one of them, a summary that lost a constraint is a reliability defect, and the correct analysis is degradation rather than compromise.

What it is not

Ordinary token reduction that does not change the security meaning of state.
Accidental loss or long-context degradation where no adversary caused, induced, or exploited the change.
Training-data summarization and changes to model weights.
Product-specific compaction bypasses, attack strings, optimization advice, or reproducible procedures.

Where the cause is accidental, behavioral state decay is the sister reference's primary concept. The same summary defect can be a security issue or a reliability issue, and the causal test above decides which.

In scope

Summaries, rolling notes, checkpoints, or compressed memories that become active context for later decisions.
Deliberate attempts to influence what compaction retains or removes.
Compaction that preserves untrusted instructions, claims, or authority while losing valid policy, provenance, uncertainty, or exceptions, where an adversary caused, induced, or exploited that outcome.
Propagation of a compromised summary into later sessions, durable memory, shared artifacts, or other agents.
Defensive controls for summary generation, validation, promotion, monitoring, containment, and replacement.

Security risks of context compaction for AI agents

Compaction is not only deletion. It creates a new state object that can replace the transcript, selected tool results, prior plans, and repeated policy reminders as the agent's practical account of what happened.

That replacement changes three things:

Selection: the compactor decides which facts, instructions, cautions, and unresolved conflicts survive.
Authority: later components may treat the summary as trusted history even when some of its inputs were untrusted.
Reach: one compact object may be copied into a fresh context, durable memory, a checkpoint, or an inter-agent handoff.

A complete raw record may still exist in storage, but it cannot govern a decision if the runtime reads only the summary. For security review, "present somewhere" and "operative in the current decision" are different states.

The trust boundary therefore sits at summary promotion: the moment a generated compression becomes authoritative context. The relevant abstract path is `mixed-trust history -> compaction -> promoted summary -> later decision`. This description is intentionally non-operational and omits attack mechanics.

Target state and trust boundaries

The target state is the promoted summary and anything derived from it: the active context of the current session, a durable memory record written from it, a checkpoint, and any handoff to another agent. The trust boundary that matters is promotion, not generation. A summary sitting in a scratch buffer changes nothing; the same text becomes a security object at the moment a later decision is allowed to read it as history.

Three boundaries are worth instrumenting separately: which material was eligible for compaction, which compacted output was promoted to operative state, and which later action was authorized while that state was in force.

Preconditions and impact

A compromised-summary risk requires more than the existence of a summarizer.

First, adversarial influence must reach material eligible for compaction, or an adversary must be positioned to exploit a summary that has already lost a constraint. Second, trusted constraints and untrusted observations must be summarized without enough separation or provenance. Third, the compacted result must be promoted into state that later decisions actually use.

The immediate impact is an integrity gap between the fuller record and the operative summary. That gap can produce:

Policy suppression, where a valid constraint no longer appears in the state used for a decision.
False-belief insertion, where an unsupported claim survives as if established.
Authority confusion, where reported content becomes an instruction or approval.
Goal redirection, where the summary changes what remains to be done.
Propagation, where downstream agents or sessions inherit the compacted state.

Compaction does not create external authority by itself. The most serious effects occur when a later action boundary trusts the summary without independent policy and authorization checks.

Persistence

A rolling summary can govern the remainder of a session. Persistence grows when that summary is written to durable memory, saved as a checkpoint, handed to another agent, or used as the seed for a further compaction, at which point one artifact can influence sessions and agents that never saw the original material.

What the research establishes

The 2026 preprint *Governance Decay: How Context Compaction Silently Erases Safety Constraints in Long-Horizon LLM Agents* (arXiv 2606.22528, v1 2026-06-21, v2 2026-06-27, author Shiyang Chen) studies the loss of safety constraints during context compaction and names a Compaction-Eviction Attack (Governance Decay, arXiv 2606.22528).

The effect sizes below come from one benchmark in one preprint, and each number should be quoted with its conditions. The benchmark is named ConstraintRot. The reported evaluation covers 1,323 episodes across seven model families, with tool-call grading. In that evaluation, the policy-violation rate was 0% while the constraint remained visible to the agent and rose to 30% after compaction, reaching 59% for some models. Separating the cases by what the summary retained, violations stayed at 0% where the constraint survived summarization and reached 38% where it was dropped. The paper also proposes a training-free mitigation, Constraint Pinning, which returned the violation rate to 0% within that same benchmark.

These are experimental results within one paper's setup. They are not a production incidence estimate, they are not a general property of every compactor or model, and they have not been reproduced independently at the time of writing. The claim they do support is narrower: compaction can change which governance information remains operative, and an adversary may target that selection process. This article does not reproduce the proposed attack.

Two standard catalogs provide broader homes for the same state problem.

The OWASP Top 10 for Agentic Applications, Version 2026, includes `ASI06 Memory & Context Poisoning` (OWASP Top 10 for Agentic Applications 2026).
MITRE ATLAS release v2026.06 includes `AML.T0080 AI Agent Context Poisoning`, with the sub-techniques `AML.T0080.000 Memory` and `AML.T0080.001 Thread` (MITRE ATLAS; ATLAS release v2026.06).

Neither item is identical to governance decay. They classify poisoned runtime state in general, while the paper isolates compaction as the mechanism that changes what survives.

Detection: observable signs

Detection should compare representations, not merely score the final prose.

A hard constraint is present in the pre-compaction state but absent, weakened, or converted into a preference in the promoted summary.
Low-trust content survives without its source, trust label, or uncertainty.
The summary resolves a conflict that the source record left unresolved.
An instruction attributed to a user, tool, document, or agent changes authority during compaction.
A summary creates a new goal, completion claim, approval, or permission that has no supporting event.
A state diff shows that a protected field changed through a generic summarization path.
Later decisions repeatedly cite the summary while contradicting the fuller record or deterministic policy.
The same questionable claim appears in new sessions or agents descended from one compacted artifact.

Useful telemetry includes the input-state identifiers, source trust labels, compactor and configuration version, output hash, promotion decision, protected-constraint checks, human or deterministic approvals, readers, and descendant artifacts. Logs should permit reconstruction of which summary influenced which later action.

One published detection rule is adjacent to this topic, and its scope is narrow. `ATR-2026-00125 Context Poisoning via Compaction Survival` is a static rule that scans `SKILL.md` files for instructions written to survive context-window compaction, grouped into persistence directives, injection commands aimed at configuration files, compaction-aware conditional logic, and false system-priority markers. Its own documentation records evasions through language switching, keyword fragmentation, and casual paraphrasing (Agent Threat Rule ATR-2026-00125). It is therefore a narrow supporting signal for one authoring surface, not a general summary-integrity check. A rule hit should be connected to source records, state changes, and decisions before compromise is declared, and the absence of a hit says nothing about compaction that did not pass through that file type.

Defenses, containment, and recovery

SSA treats compaction as a privileged state transformation rather than a text-editing convenience. The table below is SSA editorial guidance. It is neither a standard requirement nor a measured effectiveness ranking, and the one row with published evidence is attributed in the note that follows.

| Control | Transition it interrupts | Applicability | Residual risk and verification | | --- | --- | --- | --- | | Separate governance state | Trusted constraints being rewritten as ordinary narrative | Systems with explicit policy, goal, or approval objects | A model may still ignore the separate object. Enforce critical controls outside generation and test them after compaction. | | Preserve provenance and trust labels | Untrusted observations becoming unattributed facts | Mixed user, retrieval, tool, and agent histories | Free-form summaries can drop metadata. Use structured references and reject promotion when required provenance is missing. | | Protected-field checks | Compaction changing goals, permissions, approvals, or hard constraints | Systems with machine-readable invariants | The protected set may be incomplete. Review coverage when new tools or state fields are added. | | Before-and-after semantic diff | Silent security-meaning changes | Systems that retain a pre-compaction checkpoint | Automated comparison can miss paraphrased loss. Include deterministic presence tests for critical constraints. | | Independent action authorization | A compromised summary becoming an external effect | Tool-using agents | Authorization cannot repair wrong beliefs, but it can limit impact. Exercise deny and approval paths with aged summaries. | | Versioned checkpoints and lineage | One summary replacing all recoverable history | Long-running or multi-agent systems | Old checkpoints can contain earlier contamination. Verify lineage and downstream writes before reuse. |

The first row corresponds to the Constraint Pinning mitigation proposed in arXiv 2606.22528, which isolates governance rules from lossy compaction. The published result is that violations returned to 0% within the ConstraintRot benchmark used in that paper. No general effectiveness outside that benchmark is claimed here.

Prevention should keep non-compressible controls outside the generated narrative, retain provenance, and require explicit promotion. Detection should verify protected invariants every time compaction changes operative state, not only when output looks suspicious.

If compromise is suspected, contain it by preventing the summary and its descendants from seeding new sessions, memory, or agents. Preserve the summary, source identifiers, readers, and resulting actions as evidence. Do not simply ask the same compromised context to summarize itself again.

Recovery should start from a verified pre-compaction checkpoint or reconstruct state from authoritative sources. Reapply goals, policies, approvals, and unresolved decisions from their canonical records. Revalidate memories and artifacts created after the suspect summary, then resume with consequential actions disabled until the restored state passes invariant and authorization tests.

Similar concepts and boundaries

Accidental context degradation

Degraded ability to use a growing context reliably is a reliability property, and the sister reference behavioral state decay covers it. Compromised compaction is a state-integrity problem in the replacement representation. A system can degrade before compaction, lose constraints accidentally during compaction, or be deliberately influenced so that the compacted state preserves the wrong material. Only the third case, plus the case where an adversary exploits the second, belongs on this page.

Memory poisoning

Memory poisoning targets state intended to affect later decisions. A compromised summary becomes memory poisoning when it is written into durable memory or functions as persistent remembered state. A session-only rolling summary can remain a context compromise without crossing that durable boundary.

Prompt injection

Prompt injection can be an entry path, but it is not required by the state-surface definition. The compactor may ingest untrusted retrieval, tool, document, or inter-agent material. The key question is what the promoted summary authorizes later components to treat as history, instruction, or fact.

Truncation

Truncation removes content without creating a semantic replacement. Compaction selects and rewrites. Both can remove constraints, but compaction adds risks of rephrasing, unsupported resolution, and changed attribution. Security controls should test the operative result in either case.

Mapping to standards and research

| Source | Source-owned term or item | Relationship to this article | | --- | --- | --- | | arXiv 2606.22528 (v2, 2026-06-27) | Governance Decay; Compaction-Eviction Attack; ConstraintRot; Constraint Pinning | Direct research evidence that compaction can remove governance constraints, plus one proposed mitigation. The attack mechanics are intentionally omitted here. | | OWASP Top 10 for Agentic Applications, Version 2026 | `ASI06 Memory & Context Poisoning` | Broader agentic risk category for malicious context or memory state. | | MITRE ATLAS v2026.06 | `AML.T0080 AI Agent Context Poisoning`; `AML.T0080.000 Memory`; `AML.T0080.001 Thread` | Attacker-behavior classification adjacent to maliciously influenced compacted context. | | Agent Threat Rule catalog | `ATR-2026-00125 Context Poisoning via Compaction Survival` | Narrow static detection rule for `SKILL.md` authoring, correlatable with state lineage and decisions. | | Agent State Attack | Compromised summary | SSA descriptive phrase for the affected state object, not a term attributed to the sources above. |

The relationship column is SSA interpretation. The item names and identifiers belong to their source projects. The mapping helps readers move between a mechanism, broad risks, attacker behavior, and detection evidence without claiming that the frameworks use the same definitions.

Related terms

Agent state attack: the SSA Working Term for deliberate manipulation or exploitation of runtime state.
OWASP and MITRE ATLAS crosswalk: the broader framework mapping.
Behavioral state decay: the non-adversarial runtime-degradation boundary.
Memory poisoning: durable contamination intended to influence later decisions.
Prompt injection: one possible entry path into material eligible for compaction.

FAQ

Is every lossy summary compromised?

No. All useful compression removes detail. "Compromised" applies only when an adversary caused, induced, or exploited a security-relevant change, such as preserving untrusted authority or suppressing a valid constraint. A summary that dropped a constraint through ordinary compression, with no adversary involved at any of those three points, is a reliability defect.

How do I tell an accidental lossy summary from a compromised one?

Apply the causal test in the definition. Look for adversary-controlled material among the compaction inputs, for content shaped to influence what survives, and for later behavior that depends on the missing constraint in a way an adversary could have anticipated or acted on. If none of the three links is present, classify it as degradation and fix it as a reliability problem.

Can the original transcript make the summary safe?

Not by its existence alone. If later decisions read only the compacted representation, the transcript is evidence and a recovery source, not operative protection. Critical policies and authorizations need independent enforcement.

Should systems stop compacting context?

Not necessarily. Long-running systems need bounded state. The defensive requirement is to treat compaction as a privileged, versioned, and testable transformation rather than an invisible text-editing convenience.

What is the minimum useful detection check?

Define protected constraints and authority-bearing fields, then compare them before and after every promotion. This does not detect every semantic change, but it provides a deterministic baseline that can be combined with provenance and lineage review.

Does a fresh session remove the risk?

Only if the new session is seeded from verified state. Starting fresh from the same compromised summary preserves the problem while discarding evidence that might explain it.

Sources

Verification and change history

Standards and versions referenced on this page:

OWASP Top 10 for Agentic Applications, Version 2026, published December 2025.
MITRE ATLAS, data release v2026.06, published 2026-06-30.
arXiv 2606.22528, version v2, revised 2026-06-27.

Last verified: 2026-07-29. On that date the paper title and reported figures were read from the arXiv record, the ATLAS identifiers from the official v2026.06 data release, the OWASP item name from the official project document, and the detection rule scope from its catalog page.

Change history: 2026-07-29, initial defensive draft. 2026-07-29, revised: the opening definition now carries an explicit causal condition, the paper title was corrected and its evaluation conditions added, standard identifiers replaced secondary summaries, the detection rule's scope was narrowed to what it actually scans, and links to an unpublished sister article were removed. Not scheduled for publication.

Working-term label: **Mixed provenance.** "Governance Decay", "Compaction-Eviction Attack", "ConstraintRot", and "Constraint Pinning" are Research Terms attributed to arXiv 2606.22528. `ASI06` and `AML.T0080` are Standard Terms owned by OWASP and MITRE. "Compromised summary" is SSA descriptive wording, not a standard term.