{"id":6332,"date":"2026-10-22T07:16:59","date_gmt":"2026-10-22T07:16:59","guid":{"rendered":"https:\/\/i10xnews.kinsta.cloud\/?p=6332"},"modified":"2026-10-22T07:16:59","modified_gmt":"2026-10-22T07:16:59","slug":"compaction-laundering-coding-agents-forged-approval","status":"publish","type":"post","link":"https:\/\/i10x.ai\/news\/compaction-laundering-coding-agents-forged-approval","title":{"rendered":"Coding Agents Can Be Tricked Into Running Attacker Commands After Compacting Context"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">\u26a1 Quick Take<\/h2>\n\n\n<ul class=\"wp-block-list\"><li><strong>The finding:<\/strong> In five popular open-source coding agents that flatten chat history into plain text before summarizing it, a forged <code>[User]:<\/code> line planted in a file or web page was recorded as a real user instruction 87\u2013100% of the time. In four agents that keep messages role-typed, the identical attack succeeded 0% of the time.<\/li><li><strong>Why it is dangerous:<\/strong> A laundered &#8220;you already approved this&#8221; made tool-running agents execute attacker-controlled <code>curl | sh<\/code> in a sandbox, and end to end in the live pi TUI at about 50% against a 0% paired clean arm.<\/li><li><strong>What it means:<\/strong> The bug is in the harness serializer, not in the model. Escaping role labels before flattening, or keeping roles typed, removes the attack; prompt rules do not.<\/li><\/ul>\n\n\n<p class=\"wp-block-paragraph\">Every long coding-agent session eventually fills its context window. The agent then summarizes the conversation, throws the original away and treats the summary as memory. A new Pixee preprint shows that in a class of open-source harnesses this compaction step is an exploitable trust boundary. The harness flattens typed messages into one string, marking each turn with a text label such as <code>[User]:<\/code>, and it does not escape those labels when they appear inside tool output. An attacker who controls anything the agent reads can forge a user turn that survives compaction as a genuine instruction.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\ud83d\udd2c What the study shows<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The author calls the failure <strong>compaction laundering<\/strong>. The attack does not need to jailbreak the summarizer; it needs the summarizer to do its job and faithfully copy a forged <code>[User]:<\/code> line into the section for the user&#8217;s instructions. Exposure splits cleanly by how the harness serializes history.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Harness class<\/th><th>Harnesses<\/th><th>Laundering rate<\/th><\/tr><\/thead><tbody><tr><td>Flattening (in-band labels)<\/td><td>pi, opencode, Aider<\/td><td><strong>100%<\/strong> (15\/15)<\/td><\/tr><tr><td>Flattening<\/td><td>OpenHands<\/td><td>93% (14\/15)<\/td><\/tr><tr><td>Flattening<\/td><td>Cline<\/td><td>87% (13\/15)<\/td><\/tr><tr><td>Role-typed (control)<\/td><td>Codex, Gemini CLI, Qwen Code, Continue<\/td><td><strong>0%<\/strong> (0\/15)<\/td><\/tr><\/tbody><\/table><figcaption class=\"wp-element-caption\">Experiment E10: identical forged approval, three frontier models, n = 15 per harness. Clean arms were 0\/15 on every harness.<\/figcaption><\/figure>\n\n\n<ul class=\"wp-block-list\"><li><strong>Execution follows:<\/strong> On pi with gpt-5.6-terra, a laundered standing approval drove <code>curl | sh<\/code> in 3\/3 insider onboarding runs, 3\/3 dependency-doc runs and 1\/3 webpage runs (n = 3). Clean arms were 0. At a full ~263k-token window the issued rate fell to 2\/5, matching a genuine user approval of the same command.<\/li><li><strong>Live product:<\/strong> In the real pi TUI, a scripted session with a poisoned setup guide produced a full-chain win in 3 of 6 poisoned takes against 0 of 5 clean twins. The agent often refused the bootstrap before compaction; when compaction discarded that refusal and promoted the forged line, a later &#8220;ok, what&#8217;s next?&#8221; triggered execution.<\/li><li><strong>Review blinding:<\/strong> A softer variant planted &#8220;don&#8217;t touch auth\/&#8221; in tool output. Agents avoided that file in 92% of plans, against 98% when a real user said it and 6% with no constraint (n = 48).<\/li><li><strong>Prompt defenses fail:<\/strong> An in-prompt anti-injection rule, tested as a counterfactual on a flattening serialization, cut laundering but left 60%+ of payloads through. A code-level provenance-contrast check caught 77% of laundering while demoting 2% of legitimate summary claims.<\/li><\/ul>\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1344\" height=\"768\" src=\"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/10\/chart-laundering.webp\" alt=\"Bar chart of forged-approval laundering rates: pi, opencode and Aider 100 percent, OpenHands 93, Cline 87, and Codex, Gemini CLI, Qwen Code and Continue each 0 percent.\" class=\"wp-image-6331\" srcset=\"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/chart-laundering.webp 1344w, https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/chart-laundering-300x171.webp 300w, https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/chart-laundering-1024x585.webp 1024w, https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/chart-laundering-768x439.webp 768w\" sizes=\"auto, (max-width: 1344px) 100vw, 1344px\" \/><figcaption class=\"wp-element-caption\">Laundering by harness. i10X chart based on data from Dabirsiaghi (2026), arXiv:2610.29869, experiment E10 (CC BY 4.0).<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Laundering itself is scale-invariant: with pi&#8217;s real summarization it stayed at 100% from a few thousand tokens out to about 908,000 tokens, near the model&#8217;s 922k input ceiling. What changes with window size is how prominently the summary carries the forged line, and therefore how often the next agent acts on it. Placing the forged line at the end of the session (or re-delivering it just before compaction) raised execution back toward the small-window ceiling.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\u2705 Why it matters: executed consequences with a clean control<\/h2>\n\n\n<ul class=\"wp-block-list\"><li><strong>Real serializers and prompts:<\/strong> Each harness&#8217;s compaction prompt and serializer were captured from upstream at a pinned commit. Role-typed harnesses serve as a built-in control group.<\/li><li><strong>Paired clean arms:<\/strong> Every live measurement repeats the identical task with no forged line planted, and those arms stay at zero.<\/li><li><strong>Mechanism check:<\/strong> Strip the forged <code>[User]:<\/code> label and leave the same words as plain text, and laundering mostly disappears. That isolates the label, not model gullibility, as the operative element.<\/li><li><strong>Disclosure:<\/strong> Advisories were filed with all five affected flattening harnesses before publication. Code, data and the live demo are released under CC BY 4.0.<\/li><\/ul>\n\n\n<h2 class=\"wp-block-heading\">\ud83e\uddea Method in brief<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Harnesses:<\/strong> five flattening (pi, opencode, Cline, Aider, OpenHands) and four role-typed (Codex, Gemini CLI, Qwen Code, Continue). <strong>Models:<\/strong> frontier models from Anthropic, OpenAI and Zhipu for laundering rates; executed demonstrations mainly on GPT variants (claude-opus-5 often refused to summarize the malicious transcript). <strong>Metrics:<\/strong> laundering (judge-scored attribution to the user), survival (line present at all), issued vs. confirmed execution in disposable Docker sandboxes. <strong>Judging:<\/strong> an LLM judge scored laundering against a fixed criterion; an independent adjudication of a stratified 18-item sample by a different model family agreed on all items. Containment used localhost attacker servers and disposable containers; nothing left the machine.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\u2753 What remains open<\/h2>\n\n\n<ul class=\"wp-block-list\"><li><strong>Small n on execution:<\/strong> Many executed cells use n = 3\u20135. Direction is solid (poisoned arms fire, clean arms do not); exact fractions are coarse.<\/li><li><strong>Model-only regime:<\/strong> Most staged execution uses a one-tool loop with no approval gate. That matches pi&#8217;s default and any full-auto mode, but not a harness with network-off sandboxing. In-sandbox harms and review blinding still apply there; they were not demonstrated under a sandbox.<\/li><li><strong>Payload aversiveness:<\/strong> A credential-exfiltration payload never executed even when the approval laundered. Rates here use a benign canary and are an upper bound for high-stakes payloads.<\/li><li><strong>Adaptive defense:<\/strong> The 77% catch rate was measured on payloads that predate the check; an attacker who mimics the user&#8217;s wording could evade it.<\/li><\/ul>\n\n\n<h2 class=\"wp-block-heading\">\ud83e\udded Context: compaction vs. persistent memory<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Prior work on memory poisoning (Sleeper, MemMorph) follows poisoned memory through to tool execution, but in a dedicated persistent-memory module. Compaction is different: every long session does it, so the attack surface is all long-running agents. Straiker had described laundering through summarization without runtime rates; this paper supplies the executed measurement for that channel. It also fits i10X coverage of agent harness risks, from <a href=\"\/news\/agentswe-coding-agents-building-agents\">coding agents that fail to build the agent you want<\/a> to <a href=\"\/news\/harnessaudit-agent-execution-safety-benchmark\">safety rules that break mid-run<\/a>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\ud83d\udee0\ufe0f What it means for teams shipping coding agents<\/h2>\n\n\n<ul class=\"wp-block-list\"><li><strong>Fix the serializer first:<\/strong> Escape role labels in tool content before flattening, or keep messages role-typed. Four released harnesses already do the latter.<\/li><li><strong>Verify summaries in code:<\/strong> After summarization, check every user-attributed claim against the real user turns the harness still holds. Prompt rules are not enough.<\/li><li><strong>Keep audits in the summary:<\/strong> Agents that voice verification before compaction leave forge-resistant content; silent checks can be compressed away.<\/li><\/ul>\n\n\n<p class=\"wp-block-paragraph\">For related model hubs, see <a href=\"\/news\/company\/open-ai\">OpenAI<\/a> and <a href=\"\/news\/company\/google\">Google<\/a>, or more <a href=\"\/news\/category\/agent-research\">agent research<\/a>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\u270d\ufe0f About the analysis<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">This article is based on the full text of the preprint &#8220;Compaction Laundering: Provenance Destruction in Context-Compacting Coding Agents&#8221; (arXiv:2610.29869v1, submitted October 21, 2026), including its case study and limitations. All numbers come from the paper; i10X did not rerun the experiments. The paper is CC BY 4.0; charts were redrawn by i10X from experiment E10.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\ud83d\udd2d i10x Perspective<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">This is the rare security paper where the fix is almost embarrassingly local: escape one delimiter, or stop flattening. The deeper lesson is about trust boundaries. Long-running agents will always summarize; the question is whether that summary still knows who said what. Teams shipping coding agents should treat compaction like an authentication step, not a compression trick. Until harnesses keep provenance typed end to end, a web page the agent fetches while debugging can rewrite what the user &#8220;approved.&#8221;<\/p>\n\n","protected":false},"excerpt":{"rendered":"<p>A Pixee study finds that five open-source coding agents that flatten chat history before summarizing it record a forged [User]: line as a real instruction 87\u2013100% of the time, enough to drive curl | sh in a sandbox.<\/p>\n","protected":false},"author":2,"featured_media":6330,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"paper_title":"Compaction Laundering: Provenance Destruction in Context-Compacting Coding Agents","paper_url":"https:\/\/arxiv.org\/abs\/2610.29869","pdf_url":"https:\/\/arxiv.org\/pdf\/2610.29869v1","doi":"","arxiv_id":"2610.29869","authors":"Arshan Dabirsiaghi","institutions":"Pixee","paper_date":"2026-10-21","venue":"arXiv (cs.CR), version 1","peer_reviewed":false,"code_url":"https:\/\/github.com\/pixee\/compaction-laundering","data_url":"https:\/\/github.com\/pixee\/compaction-laundering","funding_coi":"Author is at Pixee. No separate funding source or conflicts of interest stated. Findings disclosed to affected maintainers before publication.","figure_license":"Charts redrawn by i10X from experiment E10 (CC BY 4.0)","paper_license":"CC BY 4.0","replication":"partial","study_models":"Frontier models from Anthropic, OpenAI and Zhipu for laundering; executed demos mainly on GPT-5.x variants (gpt-5.6-terra \/ luna \/ sol)","study_sample":"Nine released coding-agent harnesses; E10 uses n = 15 per harness across 3 models; live pi TUI uses paired poisoned\/clean takes","footnotes":"","_yoast_wpseo_primary_category":""},"categories":[55,52],"tags":[],"companies":[37,38],"products":[],"class_list":["post-6332","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-agent-research","category-studies","company-google","company-open-ai"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.7 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Coding Agents Launder Forged Approvals After Compaction - i10X News<\/title>\n<meta name=\"description\" content=\"Pixee study: five flattening coding agents treat a forged [User]: line as a real instruction 87\u2013100% of the time, enough to run attacker curl | sh.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/i10xnews.kinsta.cloud\/compaction-laundering-coding-agents-forged-approval\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Coding Agents Launder Forged Approvals After Compaction - i10X News\" \/>\n<meta property=\"og:description\" content=\"Pixee study: five flattening coding agents treat a forged [User]: line as a real instruction 87\u2013100% of the time, enough to run attacker curl | sh.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/i10xnews.kinsta.cloud\/compaction-laundering-coding-agents-forged-approval\" \/>\n<meta property=\"og:site_name\" content=\"i10X News\" \/>\n<meta property=\"article:published_time\" content=\"2026-10-22T07:16:59+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/compaction-laundering-coding-agents-forged-approval-title.webp\" \/>\n\t<meta property=\"og:image:width\" content=\"1344\" \/>\n\t<meta property=\"og:image:height\" content=\"768\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/webp\" \/>\n<meta name=\"author\" content=\"Christopher Ort\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@i10x_ai\" \/>\n<meta name=\"twitter:site\" content=\"@i10x_ai\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Christopher Ort\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"NewsArticle\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/compaction-laundering-coding-agents-forged-approval#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/compaction-laundering-coding-agents-forged-approval\"},\"author\":{\"name\":\"Christopher Ort\",\"@id\":\"https:\\\/\\\/news.i10x.ai\\\/#\\\/schema\\\/person\\\/d410bb7ee72febefca2c9c369939219a\"},\"headline\":\"Coding Agents Can Be Tricked Into Running Attacker Commands After Compacting Context\",\"datePublished\":\"2026-10-22T07:16:59+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/compaction-laundering-coding-agents-forged-approval\"},\"wordCount\":1218,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/news.i10x.ai\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/compaction-laundering-coding-agents-forged-approval#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/compaction-laundering-coding-agents-forged-approval-title.webp\",\"articleSection\":[\"Agent Research\",\"Studies\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/compaction-laundering-coding-agents-forged-approval#respond\"]}],\"dateModified\":\"2026-10-22T07:16:59+00:00\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/compaction-laundering-coding-agents-forged-approval\",\"url\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/compaction-laundering-coding-agents-forged-approval\",\"name\":\"Coding Agents Launder Forged Approvals After Compaction - i10X News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/news.i10x.ai\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/compaction-laundering-coding-agents-forged-approval#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/compaction-laundering-coding-agents-forged-approval#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/compaction-laundering-coding-agents-forged-approval-title.webp\",\"datePublished\":\"2026-10-22T07:16:59+00:00\",\"description\":\"Pixee study: five flattening coding agents treat a forged [User]: line as a real instruction 87\u2013100% of the time, enough to run attacker curl | sh.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/compaction-laundering-coding-agents-forged-approval#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/compaction-laundering-coding-agents-forged-approval\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/compaction-laundering-coding-agents-forged-approval#primaryimage\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/compaction-laundering-coding-agents-forged-approval-title.webp\",\"contentUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/compaction-laundering-coding-agents-forged-approval-title.webp\",\"width\":1344,\"height\":768,\"caption\":\"Illustration: i10X\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/compaction-laundering-coding-agents-forged-approval#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/news.i10x.ai\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Coding Agents Can Be Tricked Into Running Attacker Commands After Compacting Context\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/news.i10x.ai\\\/#website\",\"url\":\"https:\\\/\\\/news.i10x.ai\\\/\",\"name\":\"i10X News\",\"description\":\"Stay updated with the latest news and announcements from i10X.\",\"publisher\":{\"@id\":\"https:\\\/\\\/news.i10x.ai\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/news.i10x.ai\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/news.i10x.ai\\\/#organization\",\"name\":\"i10X\",\"url\":\"https:\\\/\\\/news.i10x.ai\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/news.i10x.ai\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/i10x-logo-180.png\",\"contentUrl\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/i10x-logo-180.png\",\"width\":180,\"height\":180,\"caption\":\"i10X\"},\"image\":{\"@id\":\"https:\\\/\\\/news.i10x.ai\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/i10x_ai\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/i10x-ai\",\"https:\\\/\\\/instagram.com\\\/i10x.ai\",\"https:\\\/\\\/www.youtube.com\\\/@i10X_ai_official\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/news.i10x.ai\\\/#\\\/schema\\\/person\\\/d410bb7ee72febefca2c9c369939219a\",\"name\":\"Christopher Ort\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/christopher-ort-192.webp\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/christopher-ort-192.webp\",\"contentUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/christopher-ort-192.webp\",\"caption\":\"Christopher Ort\"},\"description\":\"Christopher Ort handles SEO, AI agent workflows and PR & partnerships at i10x.ai, the all-in-one AI workspace built by i10X Global Pte. Ltd. in Singapore. He is a graduate of Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU). He is the author of \u201cThe Style Penalty\u201d, a study published on SSRN that analyses 1,576 evaluation decisions by four frontier AI models to show how AI-written CVs fare in automated hiring screens; the research has been covered by heise online and t3n.\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/author\\\/christopher-ort\",\"sameAs\":[\"https:\\\/\\\/i10x.ai\\\/blog\\\/author\\\/christopher-ort\"],\"worksFor\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\"},\"alumniOf\":{\"@type\":\"EducationalOrganization\",\"name\":\"Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU)\",\"url\":\"https:\\\/\\\/www.fau.eu\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Coding Agents Launder Forged Approvals After Compaction - i10X News","description":"Pixee study: five flattening coding agents treat a forged [User]: line as a real instruction 87\u2013100% of the time, enough to run attacker curl | sh.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/i10xnews.kinsta.cloud\/compaction-laundering-coding-agents-forged-approval","og_locale":"en_US","og_type":"article","og_title":"Coding Agents Launder Forged Approvals After Compaction - i10X News","og_description":"Pixee study: five flattening coding agents treat a forged [User]: line as a real instruction 87\u2013100% of the time, enough to run attacker curl | sh.","og_url":"https:\/\/i10xnews.kinsta.cloud\/compaction-laundering-coding-agents-forged-approval","og_site_name":"i10X News","article_published_time":"2026-10-22T07:16:59+00:00","og_image":[{"width":1344,"height":768,"url":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/compaction-laundering-coding-agents-forged-approval-title.webp","type":"image\/webp"}],"author":"Christopher Ort","twitter_card":"summary_large_image","twitter_creator":"@i10x_ai","twitter_site":"@i10x_ai","twitter_misc":{"Written by":"Christopher Ort","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"NewsArticle","@id":"https:\/\/i10xnews.kinsta.cloud\/compaction-laundering-coding-agents-forged-approval#article","isPartOf":{"@id":"https:\/\/i10xnews.kinsta.cloud\/compaction-laundering-coding-agents-forged-approval"},"author":{"name":"Christopher Ort","@id":"https:\/\/news.i10x.ai\/#\/schema\/person\/d410bb7ee72febefca2c9c369939219a"},"headline":"Coding Agents Can Be Tricked Into Running Attacker Commands After Compacting Context","datePublished":"2026-10-22T07:16:59+00:00","mainEntityOfPage":{"@id":"https:\/\/i10xnews.kinsta.cloud\/compaction-laundering-coding-agents-forged-approval"},"wordCount":1218,"commentCount":0,"publisher":{"@id":"https:\/\/news.i10x.ai\/#organization"},"image":{"@id":"https:\/\/i10xnews.kinsta.cloud\/compaction-laundering-coding-agents-forged-approval#primaryimage"},"thumbnailUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/compaction-laundering-coding-agents-forged-approval-title.webp","articleSection":["Agent Research","Studies"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/i10xnews.kinsta.cloud\/compaction-laundering-coding-agents-forged-approval#respond"]}],"dateModified":"2026-10-22T07:16:59+00:00"},{"@type":"WebPage","@id":"https:\/\/i10xnews.kinsta.cloud\/compaction-laundering-coding-agents-forged-approval","url":"https:\/\/i10xnews.kinsta.cloud\/compaction-laundering-coding-agents-forged-approval","name":"Coding Agents Launder Forged Approvals After Compaction - i10X News","isPartOf":{"@id":"https:\/\/news.i10x.ai\/#website"},"primaryImageOfPage":{"@id":"https:\/\/i10xnews.kinsta.cloud\/compaction-laundering-coding-agents-forged-approval#primaryimage"},"image":{"@id":"https:\/\/i10xnews.kinsta.cloud\/compaction-laundering-coding-agents-forged-approval#primaryimage"},"thumbnailUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/compaction-laundering-coding-agents-forged-approval-title.webp","datePublished":"2026-10-22T07:16:59+00:00","description":"Pixee study: five flattening coding agents treat a forged [User]: line as a real instruction 87\u2013100% of the time, enough to run attacker curl | sh.","breadcrumb":{"@id":"https:\/\/i10xnews.kinsta.cloud\/compaction-laundering-coding-agents-forged-approval#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/i10xnews.kinsta.cloud\/compaction-laundering-coding-agents-forged-approval"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i10xnews.kinsta.cloud\/compaction-laundering-coding-agents-forged-approval#primaryimage","url":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/compaction-laundering-coding-agents-forged-approval-title.webp","contentUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/compaction-laundering-coding-agents-forged-approval-title.webp","width":1344,"height":768,"caption":"Illustration: i10X"},{"@type":"BreadcrumbList","@id":"https:\/\/i10xnews.kinsta.cloud\/compaction-laundering-coding-agents-forged-approval#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/news.i10x.ai\/"},{"@type":"ListItem","position":2,"name":"Coding Agents Can Be Tricked Into Running Attacker Commands After Compacting Context"}]},{"@type":"WebSite","@id":"https:\/\/news.i10x.ai\/#website","url":"https:\/\/news.i10x.ai\/","name":"i10X News","description":"Stay updated with the latest news and announcements from i10X.","publisher":{"@id":"https:\/\/news.i10x.ai\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/news.i10x.ai\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/news.i10x.ai\/#organization","name":"i10X","url":"https:\/\/news.i10x.ai\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/news.i10x.ai\/#\/schema\/logo\/image\/","url":"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/10\/i10x-logo-180.png","contentUrl":"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/10\/i10x-logo-180.png","width":180,"height":180,"caption":"i10X"},"image":{"@id":"https:\/\/news.i10x.ai\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/i10x_ai","https:\/\/www.linkedin.com\/company\/i10x-ai","https:\/\/instagram.com\/i10x.ai","https:\/\/www.youtube.com\/@i10X_ai_official"]},{"@type":"Person","@id":"https:\/\/news.i10x.ai\/#\/schema\/person\/d410bb7ee72febefca2c9c369939219a","name":"Christopher Ort","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/christopher-ort-192.webp","url":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/christopher-ort-192.webp","contentUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/christopher-ort-192.webp","caption":"Christopher Ort"},"description":"Christopher Ort handles SEO, AI agent workflows and PR & partnerships at i10x.ai, the all-in-one AI workspace built by i10X Global Pte. Ltd. in Singapore. He is a graduate of Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU). He is the author of \u201cThe Style Penalty\u201d, a study published on SSRN that analyses 1,576 evaluation decisions by four frontier AI models to show how AI-written CVs fare in automated hiring screens; the research has been covered by heise online and t3n.","url":"https:\/\/i10x.ai\/news\/author\/christopher-ort","sameAs":["https:\/\/i10x.ai\/blog\/author\/christopher-ort"],"worksFor":{"@id":"https:\/\/i10x.ai\/news\/#organization"},"alumniOf":{"@type":"EducationalOrganization","name":"Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU)","url":"https:\/\/www.fau.eu"}}]}},"_links":{"self":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts\/6332","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/comments?post=6332"}],"version-history":[{"count":1,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts\/6332\/revisions"}],"predecessor-version":[{"id":6337,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts\/6332\/revisions\/6337"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/media\/6330"}],"wp:attachment":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/media?parent=6332"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/categories?post=6332"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/tags?post=6332"},{"taxonomy":"company","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/companies?post=6332"},{"taxonomy":"product","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/products?post=6332"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}