Many-Shot Context Poisoning: Security Risks of Long-Context Demonstration Flooding

Many-shot context poisoning is SSA descriptive wording for a security-relevant change to an agent's active context that works through volume and repetition rather than a single false claim or hidden instruction. The defining mechanism is in-context learning itself: a context window filled with many examples of one behavior pattern makes the model more likely to continue that pattern on the next, unrelated input, the same statistical effect that lets well-chosen examples steer a model in ordinary use.

What it is

The defining object is the raw content occupying an agent's active context window, distinct from a durable memory record, a retrieved document treated as a fact, or a compacted summary. The defining cause is volume: many repeated demonstrations of one behavior pattern, embedded in one long input or accumulated across a session's turns. The defining consequence is that the model's next completion follows the pattern the flood established, not because any one item persuaded it, but because enough repetition shifts what the model treats as the expected continuation.

Anthropic's research names the underlying technique many-shot jailbreaking and grounds it in in-context learning: many examples of an assistant persona answering harmful requests, followed by a final harmful request, produce answers that follow the established pattern instead of the model's trained refusal behavior, with effectiveness scaling with example count, following a power-law comparable to ordinary in-context learning (Anthropic, Many-shot jailbreaking, 2024-04-02). This is a state-attack surface, not only a jailbreak technique, because the mechanism applies to any content reaching an agent's context, not only a typed prompt.

What it is not

A single, cleverly worded jailbreak prompt that works through persuasion or roleplay framing rather than volume of repeated examples.
RAG poisoning or compromised summaries, where a single planted fact or a compactor's own choices do the work, both covered separately.
Reproducible jailbreak prompts, shot counts, or phrasing recipes tuned to bypass a specific model's guardrails.

In scope

A single, unusually long input containing many repeated examples of one behavior pattern.
A tool result or retrieved document, disproportionately large for that tool call, embedding many such examples inside content an agent ingests as ordinary data.
Gradual accumulation of the same pattern across many turns of one long-running session.
The risk multiplier from growing context-window sizes, which extends how much repeated content an attacker can place before generation.

Target state and trust boundaries

The target state is the agent's active context window at generation time. The trust boundary that fails is not "is this content true" or "did the user approve this write," the boundaries RAG poisoning and memory injection each examine, but "how much of this pattern is present in context." Most agent architectures weight every context token the same regardless of source, so a long tool result or document carries the same weight per token as a short one, and enough repetition inside it can outweigh a brief system prompt. No memory-write call, summarization step, or instruction-override phrase needs to appear anywhere in the flow.

Persistence

A poisoned pattern confined to one oversized input persists only for the turn it appears in, but that is enough runway to reach a consequential output or tool call before the turn ends. A pattern built up gradually across a long-running session persists for as long as that session's context accumulates it, with no need to cross into durable memory to matter. MITRE ATLAS's Thread sub-technique makes the same point directly: malicious instructions introduced into a chat thread can "persist for the remainder of the thread," and "as the token limits for LLMs rise, AI systems can make use of larger context windows which allow malicious instructions to persist longer" (MITRE ATLAS, AML.T0080.001 Thread).

What the research establishes

Anthropic's many-shot jailbreaking research, presented at NeurIPS 2024, tested prompts with up to 256 faux dialogue turns showing a model persona complying with harmful requests, and found harmful-response rates rose as example count increased beyond a threshold, consistent with the power-law scaling of ordinary in-context learning (Anthropic, Many-shot jailbreaking, 2024-04-02; Anil et al., Many-shot Jailbreaking, NeurIPS 2024). It reported the technique transferring across model providers, not only its own. Of the mitigations tested, classifying and modifying the prompt before the model processed it was most effective, cutting one measured attack success rate from 61 percent to 2 percent; fine-tuning the model to refuse jailbreak-shaped queries only delayed the attack as prompt length grew further.

A 2025 Anthropic-authored follow-up combined fine-tuning with input sanitization, reporting the combination "significantly reduces] the effectiveness of MSJ attacks, while retaining model performance in benign in-context learning and conversational tasks" ([Ackerman and Panickssery, Mitigating Many-Shot Jailbreaking, arXiv 2504.09604). Agent-focused research tested detection and defense against many-shot jailbreaking across Gemini 1.5 Pro, Llama-3.3-70B, and DeepSeek R1, reporting 94 percent detection accuracy for Gemini 1.5 Pro via a reverse-Turing-test method, while attack success rate still rose with prompt length regardless of detection accuracy (Barua et al., Guardians of the Agentic System, arXiv 2502.16750). None documents delivery through a tool result or document rather than a direct prompt; that extension is this article's own reasoning, since the mechanism acts on whatever tokens occupy the window, and agents routinely ingest long tool outputs into that same context.

Detection: observable signs

A single input, tool result, or retrieved document contains an unusually large number of repeated dialogue-like exchanges or examples of one behavior pattern.
Input or ingested-content length spikes well outside a session's historical baseline immediately before a policy-inconsistent output or tool call.
The agent's output shifts to match a repeated in-context example rather than its configured system instructions, with no corresponding change to those instructions.
A tool result is disproportionately large relative to what that specific tool call would normally return.

Useful telemetry includes per-turn and per-source token counts against a session's baseline, a repetition or near-duplicate-span detector run before generation, and a record of which context contribution preceded a policy-inconsistent output.

Defenses, containment, and recovery

The table below is SSA editorial guidance for defenders. It is neither a standard requirement nor a measured effectiveness ranking, and the classification-and-modification row reflects Anthropic's own reported mitigation, not an independently verified result.

Control	Transition it interrupts	Applicability	Residual risk and verification
Input classification and modification before generation	A high-volume repeated pattern reaching the model unmodified	Any agent accepting long user input, tool results, or retrieved content	Anthropic's most effective tested mitigation, cutting one measured attack success rate from 61 to 2 percent, but classifiers can be evaded by novel phrasing.
Context-length and repetition anomaly detection	Volume-based pattern completion outweighing a brief system prompt	Agents with variable-length tool results or documents	Length alone is evadable by shortening content while preserving repetition; pair with a near-duplicate-span check.
Tool-result and retrieved-content size gating	The indirect delivery path: an oversized tool output or document carrying the flood	Agents that retrieve documents or tool results directly into context	Legitimate long documents exist; gate against an expected size per tool or source, not a global cap.

Prevention should screen context volume and repetition before generation. Containment should truncate the oversized contribution and halt further generation from it. Recovery should treat the affected turn's outputs as unverified until the flagged content is removed and the next output is regenerated from a clean context.

Boundaries with similar concepts

Many-shot context poisoning is a state-attack-specific instance of what MITRE ATLAS classifies broadly as AML.T0054 LLM Jailbreak, but narrower: persuasive or roleplay-based jailbreak wording works through a single well-crafted request and does not depend on volume or repetition. It differs from RAG poisoning in what does the work (a trusted fact versus sheer repetition) and from compromised summaries in when it acts: compaction poisoning depends on a compactor's choices, while this pattern acts on raw, uncompacted context before any compaction event occurs.

Mapping to standards and research

Source	Source-owned term or item	Relationship to this article
Anthropic (2024-04-02); Anil et al., NeurIPS 2024	Many-shot jailbreaking	Primary and peer-reviewed research establishing the in-context-learning mechanism and its scaling with example count.
arXiv 2504.09604	Mitigating Many-Shot Jailbreaking	Follow-up research on combined fine-tuning and input-sanitization defenses.
arXiv 2502.16750	Guardians of the Agentic System	Research applying many-shot jailbreaking detection and defense specifically to agentic deployments.
OWASP LLM Top 10 2025 / Agentic Top 10 2026	`LLM01:2025 Prompt Injection`; `ASI06 Memory & Context Poisoning`	Broader input-control and operative-state risk categories this pattern falls under.
MITRE ATLAS v2026.06	`AML.T0054 LLM Jailbreak`; `AML.T0080.001 Thread`; `AML.T0051.001 Indirect`	Classification for the elicitation mechanism, the thread-persistence effect of growing context windows, and the indirect delivery path this article extends to.
Agent State Attack	Many-shot context poisoning	SSA descriptive phrase, not attributed to the sources above.

Related terms

Agent state attack: the umbrella definition, including context among the listed target states.
RAG poisoning: the adjacent context surface where a single retrieved item is trusted as fact, rather than a pattern established through volume.
Compromised summaries and context compaction: the adjacent context surface acting at compaction time rather than on raw, uncompacted context.
OWASP and MITRE ATLAS crosswalk: the broader framework mapping.

FAQ

Is this the same as a single clever jailbreak prompt, like a "DAN" style prompt?

No. Persuasion-based jailbreak prompts work through wording, such as roleplay framing, in a single, comparatively short request. This pattern works through volume and repetition, and its effectiveness scales with the number of repeated examples rather than with the cleverness of any one instruction.

Does the attacker have to type a huge prompt directly?

The documented research tested direct, attacker-supplied prompts. The mechanism does not depend on who supplied the tokens, only on how many repetitions occupy the context window, so a sufficiently large tool result or retrieved document is a plausible extension, stated here as reasoning, not as a separately documented case.

Sources

Verification and change history

Standards referenced: OWASP LLM Top 10, Version 2025 (2024-11-18); OWASP Agentic Top 10, Version 2026 (December 2025); MITRE ATLAS, data release v2026.06 (2026-06-30).

Last verified: 2026-09-15. The Anthropic page, NeurIPS listing, and follow-up papers' abstracts were read from their own pages on this date. AML.T0054, AML.T0080.001, and AML.T0051.001 were read directly from the MITRE ATLAS v2026.06 data release; the OWASP identifiers were reused from this site's previously verified crosswalk entries.

Change history: 2026-09-15, first version.

Working-term label: Mixed provenance. "Many-shot jailbreaking" is a Research Term owned by Anil et al. and used descriptively by Anthropic. AML.T0054, AML.T0080.001, and AML.T0051.001 are Standard Terms owned by MITRE; LLM01:2025 and ASI06 by OWASP. "Many-shot context poisoning" is SSA descriptive wording, and its extension to indirect, tool-mediated delivery is this article's own reasoning rather than a documented case.