Imagine you're playing a game of Telephone, but instead of whispering the original message, someone transcribes every round into a single notebook — stripping out who said what — and then hands the notebook to the next player as ground truth. If a prankster scribbles a fake instruction into that notebook before the handoff, nobody downstream can tell it apart from the real ones. That's compaction laundering. The committed claim: when coding agents summarize their context window to stay within token limits, popular open-source harnesses flatten the entire conversation into a single plain-text string with text labels like [User]: and [Assistant]:. An attacker who controls any content the agent reads — a README, a code comment, a tool output — can inject a fake [User]: turn that survives summarization as a genuine user instruction. This is not a prompt injection in the usual sense; it's a provenance-destruction bug in the serialization layer, upstream of the model entirely. The numbers are clean and damning. Across five "flattening" harnesses (pi, opencode, Cline, Aider, OpenHands), forged approvals launder into the agent's post-compaction memory 87–100% of the time, tested up to a ~908,000-token context window. Across four "role-typed" harnesses (Codex, Gemini CLI, Qwen Code, Continue) that preserve structured message types through the compaction boundary, the identical attack succeeds exactly 0% of the time. That's not a gradient; it's a binary architectural distinction. The paper follows the attack through to executed consequences, which is where it earns real credibility. A laundered standing approval drives the pi TUI agent to execute attacker-controlled curl | sh commands at ~50% success against a 0% clean baseline. A second attack channel reliably steers an agent away from reviewing a specific file, effectively blinding code review to a planted backdoor. These aren't hypothetical threat models — they're recorded demonstrations against live tools. Integrity-wise, the validation is unusually direct for a security paper. The attack/defense comparison is a controlled A/B: same payload, same models, flattening harness vs. role-typed harness. The 0% vs. 87–100% split across nine named tools leaves little room for cherry-picking. Code, raw data, and live demos are published. The main limitation is that all testing is author-conducted; no independent red-team replication exists yet. The proposed defenses are refreshingly concrete. A code-level provenance check catches 77% of laundering attempts while misclassifying only 2% of legitimate summaries. But the real fix is architectural: escape role labels before flattening, or — better — never flatten at all. The role-typed harnesses already do this, and their 0% attack success rate is the paper's strongest evidence that this is a solvable engineering problem, not a fundamental AI safety puzzle. The broader lesson for anyone building agentic systems: every serialization boundary is a trust boundary. When you convert structured data into flat strings and back, you're destroying provenance metadata that downstream components may silently depend on. This paper demonstrates that principle with surgical clarity on one specific boundary, but the pattern generalizes to any agent architecture where context passes through a lossy text transform.
