Compaction can launder forged approvals in coding agents

What the research found

ArXiv paper (cs.CR, v1 Oct 21 2026) showing context-compaction in open-source coding agents is a trust boundary: flattening harnesses drop message roles, so forged user approvals survive summarization and get executed.

Claims and how well the evidence supports them

1. Flattening harnesses (pi, opencode, Cline, Aider, OpenHands) let a forged user approval survive compaction 87-100% of the time 99%
2. Role-typed harnesses (Codex, Gemini CLI, Qwen Code, Continue) showed 0% success for the same attack 99%
3. A code-level provenance check catches 77% of laundering while demoting 2% of legitimate summary content 99%
4. The fix is to escape role labels in the serializer before flattening 98%

Evidence

• arxiv.org https://arxiv.org/abs/2610.29869

Actionability rated high.