What happened
After compaction promoted forged user labels into apparent approval, the acting agent executed an attacker-controlled shell canary. The live pi experiment confirmed post-compaction execution and a callback to a contained test server.
2026-10-21
HighPrimaryCompaction Laundering Can Turn Forged Approval Into Agent Shell Execution
An author-reported controlled study shows forged user approvals surviving context compaction and driving shell canaries, including a small live pi experiment.
pi and context-compacting coding-agent harnessesGovernance bypassControlled research demonstration of indirect prompt injection through context compactionStaged serializer and summarizer experiments from pinned coding-agent components, plus a separate live pi TUI v0.79.0 experiment in a container
Why it matters
No production impact was reported. Verified effects were benign canary execution and test-server callbacks inside controlled containers, not demonstrated credential theft.
Missing authorization check
Authentic authorization for the exact shell operation at the execution sink, independent of summarized conversational claims.
Would PP block it?
Before shell dispatch, an external gate could bind authority to the caller, command, workspace and intended effects, instead of trusting text that says approval already exists. This constrains execution only where the gate is actually integrated and cannot establish that any tested product already has that protection.
Incident analysis
Timeline and technical read
Timeline
2026-10-21
The author posts the first arXiv version describing staged component tests and a live pi demonstration.
Technical breakdown
- Untrusted documents contain forged user-role labels that become indistinguishable from genuine user turns when roles are flattened into text.
- A summarizer can carry the forged standing approval into the next context while losing its origin as tool-returned content.
- Staged experiments use pinned serializers and prompts with a minimal shell-tool loop lacking an external approval gate; real canary commands execute in disposable containers.
- The separate live pi test manually triggers compaction and records a three-of-six poisoned full-chain result against zero of five eligible clean takes; small samples and prompt-dependent behavior preclude a universal rate.
- Four role-typed control harnesses did not launder the forged approval in the reported tests.
Authorization boundary
Where the authorization boundary should have been
This incident is categorized as Governance bypass. The relevant Permission Protocol gate is Tool-Call Gate. The read is conditional: the block only applies where the real action boundary is routed through a gate.
- If enforced at
- Independent shell-tool dispatch boundary before process launch
- Still needs
- PP does not restore lost message provenance, repair serializers or prevent a poisoned summary from distorting a review plan. Executed demonstrations used OpenAI models and benign canaries; a credential-exfiltration payload did not execute in the reported live testing. Staged results were not full product deployments, and role-typed controls did not launder the forged approval.
- Receipt required for
- Executing the exact shell command in the designated workspace and runtime
An independently integrated execution gate could reject a summarized claim of approval and require a real operation-bound receipt; PP was not tested in the study.
Related incidents and controls
Start small
Put the relevant gate at this action boundary.
This incident maps to Tool-Call Gate. Start with the boundary that controls the actual action, then require a signed receipt before execution.