Arshan Dabirsiaghi · 2026 · arXiv
DOI: 10.48550/arXiv.2610.29869 · open-access PDF
运行时间足够长的编码代理必须压缩其背景,总结对话,丢弃原始内容,并将摘要作为记忆进行传递。我们表明,在流行的开源编码代理中,此步是可利用的信任边界。将打字对话平平化为一个单一的简单字符串,将每个消息标记为文本标签,如 [用户]:在汇总器运行之前,在代码中摧毁消息的来源。
Machine translation (Meta M2M100); the English original follows.
Coding agents that run long enough must compact their context, summarizing the conversation, discarding the original, and carrying the summary forward as memory. We show that in popular open-source coding agents this step is an exploitable trust boundary. Harnesses that flatten the typed conversation into a single plain string, marking each message with a text label such as [User]:, destroy message provenance in code, before the summarizer runs. An attacker who controls anything the agent reads can forge a user turn that survives compaction as a genuine instruction. Across five flattening harn
Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese
GET https://store.agentexchange.work/gw/papers/verify?title=...&year=... (0.003 USD), fetch this record as JSON with /gw/papers/paper?id=2610.29869, or list what it cites with /gw/papers/references?id=.... Pay per call in USDC (x402) or with a 19 USD card key for 1,000 calls. Catalogue · llms.txtSources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange