A failure mode where attacker-controlled text survives context summarisation and later re-enters the agent as if it were legitimate user instruction. In agentic systems, this turns memory management into a security boundary because the summarised state can drive tool use and command generation.
What compaction laundering is
Compaction laundering happens when attacker-controlled content survives summarisation, then returns later as if it were trusted instruction. The danger is not the summary itself, but that compressed memory can become an unreviewed control surface.
In agentic systems, this is more than a data-quality problem. A summarised transcript, scratchpad, or memory buffer can influence tool calls, command generation, and future reasoning, so the attacker only needs their text to be preserved in a form the system still trusts.
Why summarisation creates a security boundary
Summarisation changes the security model because the system no longer relies only on the original conversation, it also relies on what was retained from it. If the summariser preserves malicious text, strips context, or rewrites a payload into a more authoritative form, it can quietly cross from “content” into “instruction”.
This is especially important when the agent uses memory to decide what to do next. Once a summary can steer retrieval, planning, or tool selection, the integrity of that summary matters as much as the integrity of the user prompt that produced it.
Teams should treat the summarisation step as transformation, not compression. A safe summary must preserve provenance, uncertainty, and role boundaries, rather than laundering untrusted input into apparently system-approved state.
How compaction laundering works in practice
The failure mode usually appears in stages. An attacker plants text that looks harmless, the conversation grows until compaction occurs, and the summariser retains the planted instruction while dropping the surrounding cues that made it suspicious.
Later, the agent rereads the compacted state and treats the preserved fragment as an established instruction, memory fact, or standing preference. That can alter downstream behaviour without any fresh attacker interaction.
The risk is amplified when summaries are recursively compacted, merged across sessions, or used as durable memory. Each pass can remove the evidence that a statement was originally untrusted, which makes the surviving fragment easier to misuse.
Security implications for agentic systems
Compaction laundering is a trust-boundary problem, a provenance problem, and an instruction-integrity problem at the same time. It matters most when memory is allowed to shape tool use or command generation, because the attacker is then influencing action, not just text.
It also creates a subtle persistence path. A payload that would normally disappear with the chat history can survive inside the compacted state, then reappear after resets, handoffs, or context-window churn. That makes the issue especially relevant for agents that operate over long sessions or shared memory stores.
Frameworks that discuss agent memory poisoning and context manipulation, such as MITRE ATLAS adversarial AI threat matrix and OWASP Agentic AI Top 10, capture the same core concern: compromised context can become a control input, not just an artifact.
How to recognise and contain the failure mode
Look for summaries that preserve directives without preserving source context, especially when the retained text starts to influence actions, routing, or tool choice. A strong signal is when the agent appears to “remember” a request that was never meant to become durable state.
Containment depends on making memory reviewable and revocable. Summaries should be attributable to source material, separated from system instructions, and treated as untrusted until explicitly promoted. Where agent memory affects execution, the surrounding control model should also assume that compacted text can be adversarial.
General control guidance from NIST SP 800-53 Rev 5 Security and Privacy Controls is useful here, especially for access control, auditability, and system integrity, while NIST Cybersecurity Framework 2.0 helps frame the governance and recovery posture around state corruption.
Risk and Threat Considerations
Compaction laundering is dangerous because it lets attacker-controlled text persist inside a trusted-looking state and later influence actions with no fresh prompt injection. The core risk is silent persistence, where the system believes it is following memory while it is actually following adversarial residue.
Failure mechanism: A summariser retains malicious instruction content, removes the surrounding context that marked it as untrusted, and reintroduces it as durable memory or apparent user intent.
Impact: The agent may issue unsafe tool calls, repeat attacker-supplied directives, leak data, or carry forward compromised behaviour across sessions and compaction cycles.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATLAS and OWASP Agentic AI Top 10 address the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATLAS | Adversarial AI Threat Techniques | Covers memory manipulation and context poisoning in AI systems |
| Recommendation — Model compaction paths as a context-poisoning risk and monitor for retained attacker instructions. | ||
| OWASP Agentic AI Top 10 | ASI06 — Memory & Context Poisoning | Directly addresses corrupted agent memory and context driving behaviour |
| Recommendation — Separate untrusted conversation text from durable agent memory and validate retained context before action. | ||
| NIST SP 800-53 Rev 5 | SI-7 — Software, Firmware, and Information Integrity | Addresses integrity of information used by systems to make decisions |
| AU-3 — Content of Audit Records | Supports preserving enough provenance to explain how compacted state was formed | |
| Recommendation — Protect summarised agent state with integrity checks and review before it can influence execution. Log source-to-summary lineage so retained instructions can be traced back to their original context. | ||
| NIST CSF 2.0 | PR.DS-01 — Data-at-Rest is Protected | Applies when summarised memory is stored and later reused as durable state |
| Recommendation — Protect stored agent memory and summaries as sensitive state with clear access boundaries. | ||
Practitioner Guidance
What to watch for: Treat summary generation as a security-sensitive transformation whenever the output can influence future actions. The key judgment is whether the compacted state is allowed to become an instruction source, a memory source, or both.
Practitioner takeaway: If a summary can steer tools, it needs provenance and trust handling, not just compression accuracy. The safer the agent looks after compaction, the more important it is to verify what was lost along the way.
Related resources from NHI Mgmt Group
- Who is accountable when a mobility platform is used for fraud or laundering?
- Who is accountable when crypto-related fraud or laundering is detected?
- Why do crypto laundering cases need identity verification as well as chain analytics?
- Which controls help when laundering activity crosses from crypto into traditional finance?