When a code agent compacts its memory, pi, opencode, Cline, Help and OpenHands erased that said: a forged approval survives in 87 to 100% of cases, compared to 0% at Codex or Gemini CLI.
Code agents who work for a long time end up having to "compact" their context: the conversation is summarized, the original discarded, and the summary serves as a memory for the rest. An article by Arshan Dabiriaghi, published on arXiv, shows that this stage constitutes a trustable frontier. Some harnesses actually flatten the conversation into a single string of text, where each message is distinguished only by a label of the type [User]:. The origin of the messages is therefore lost even before the summary is produced, and anyone who controls content read by the agent can slip a false speech trick of the user.
87% to 100% success on the one hand, 0% on the other
Out of five harnesses (pi, opencode, Cline, Help and OpenHands), forged approval is found in the agent's memory in 87 to 100% of the trials, with contexts of up to 908,000 chips. On four harnesses that retain the role of each message (Codex, Gemini CLI, Qwen Code and Continue), the same attack fails systematically. The author pushes the experiment to its consequences: an authorization thus "bleached" leads agents to execute in sandbox a curl | sh controlled by the attacker, and to do so in about half of the cases in the actual interface of pi, against none in the control group. The same channel can divert the agent from a designated file, making him miss a back door during a code review.
A simple patch, but at code level
As the loss of information occurs deterministically in the harness code, no defense at the prompt level can catch it. A source check added to the code detects 77% of attempts by wrongly degrading 2% of legitimate content; But the real solution is to escape the role labels at the time of serialization, or better, to keep messages typed by role as already do the four harnesses spared.
Read the full article on the original source
Go to the source →