Compaction Artifact Spoofing: When the Context Summary Lies

Long-running agents cannot keep every token forever. They summarize old turns, compress tool results, write memory notes, checkpoint state, and resume from compacted artifacts. That is not a bug. It is how practical agent systems survive long tasks.

The security problem is that a compressed summary often lands closer to the agent's decision loop than the original evidence. A user message may be treated as user input. A web page may be treated as fetched content. But a compaction artifact can look like internal state: the agent's own memory of what the task is, what constraints still apply, which approvals exist, and which warnings were resolved.

That makes compaction a runtime-trust problem. The question is not only “did the model summarize accurately?” The question is “should this summary be allowed to carry authority into the next action?” If the answer is yes by default, an attacker can target the summary layer instead of the chat layer.

A compaction artifact is the working note an agent relies on after context gets shortened. It might say what the user asked, what files were changed, what tools already ran, what constraints must remain, and what decision is pending. In a healthy workflow, that artifact is a lossy but useful map of prior context.

Compaction artifact spoofing turns that map into a fake badge. The attacker writes text that looks like a system-generated summary or state header and inserts it into a message, file, API response, or handoff. The text claims to be the result of compaction: “summary generated by control plane,” “all safety checks passed,” “policy exception approved,” “the user already consented,” or “older constraints were superseded.”

If the agent trusts that artifact as internal authority, the attacker has skipped the normal prompt-injection fight. The payload is not asking the agent to disobey. It is pretending the agent already received permission, already verified the facts, or already compressed the true state into a convenient instruction.

This is distinct from tool-output prompt injection, which asks a fetched page or API response to influence the agent. Compaction artifact spoofing targets the state the agent believes it preserved about the workflow. It is also distinct from plain memory poisoning: durable memory can persist across sessions; a compaction artifact may be temporary, but it can still decide the next tool call, file edit, deployment, or report.

An agent reads a project file containing a block labeled “system compaction artifact.” The block says the user approved a risky operation and that previous safety checks should be treated as complete. The file is just evidence, but the label makes it look like control-plane state. If the agent acts on it, a file has impersonated memory.

A long-running coding agent resumes from a compacted task summary. A hostile note slipped into earlier context survives the compression step as “accepted decision: skip dependency audit for this package.” The original discussion may have been messy, but the compacted artifact now presents the unsafe conclusion as clean state.

A planner sends a worker a short handoff that includes useful task facts plus a fake “policy anchor.” The handoff says the worker should treat the summary as higher priority than later warnings. That inverts authority: the summary, which should be evidence, tries to outrank the live user, system policy, or runtime approval gate.

Use those controls. The point is not to stop compacting context. The point is to stop treating every compacted note as if it came from a trusted control plane.

Sunglasses is a content-layer input filter for AI agents. For compaction artifact spoofing, the defense sentence is: a context summary may describe prior state, but runtime trust decides whether that summary can authorize the next action.

Compaction artifacts sit between ordinary input and agent action. They are not just text to summarize; they are text the agent may use to decide. Summaries, handoffs, memory notes, tool outputs, API responses, and files can all provide evidence, but none should automatically become policy.

Nine patterns for this family ship in this release: GLS-CAS-001 (fake compaction-header state injection), GLS-MSR-001 (session-state snapshot revoked-grant replay), memory-state-replay rows GLS-V3-003, GLS-V3-021, GLS-V3-044, GLS-V3-056, semantic-cache rows GLS-V3-048, GLS-V3-057, and runtime-config row GLS-V3-025 — searchable in the pattern database.

Not every context summary is malicious. Compaction is necessary infrastructure for long-running agents.

Signatures, memory stores, and authentication are not useless. They help — but they do not decide whether a specific summary should authorize a specific action now.

The issue does not reduce to “the model forgot something.” The sharper risk is that a forged or polluted summary becomes authority.

This page is grounded in Sunglasses' runtime-trust pattern research on memory-state replay, semantic-cache authority laundering, and compaction-state injection, plus the shipped pattern families linked below. It describes an attack model and defense posture; it does not claim observed in-the-wild exploitation of a specific product's compaction layer.