An agent can retain the written rule and still disobey it after the conversation is compressed. In ARCBench, the violation measure rose from 9.6% with full context to 37.8% after compaction. Of the 37.8 percentage points, 28.9 represented cases violating only after compaction; 8.9 were already violated with full context. Those are the benchmark's selected…
Inspect the ClaimsCase · DiggingBeagle record
Context compression can lose the security rule before the dangerous action
ARCBench shows compaction-linked instruction loss: 9.6% violations with full context versus 37.8% following summarization in the tested setup.
Context privilege escalationSecurity rule implementation gapAgent report-state recoverabilityCompaction-induced loss of persistent agent constraints
Public disclosure: Nov 3, 2026
Scope
Controlled benchmark of compaction behavior; not evidence of real users experiencing these rates or a universal flaw in every compactor.
Assessment profile
Assessment method- Setting
- evaluation
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- mitigation available
- AI role
- AGAINST AI
Basis and provenance
A multi-model controlled benchmark compares matched full-context and compacted runs, includes rule-state adjudication, and isolates targeted compactor instructions from simple added volume. It reports evaluated violations, not production incidents. External policy storage and executor checks are architectural mitigations, but the source does not independently validate a universal implementation.. Impact is ungraded because no independently measured production-target impact or victim scope is established by this record.
Assessed Nov 4, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-NOV04-ARCBENCH-COMPACTION-1 · CLM-NOV04-ARCBENCH-COMPACTION-2 · CLM-NOV04-ARCBENCH-COMPACTION-3 · ARCBench: security-policy retention across agent context compaction
At a glance
Long-running systems should store non-negotiable authority constraints outside the summarizable conversation, reapply them to every tool call and verify post-compaction equivalence.
Read the implicationsWhether each scenario generalizes to specific production models, compactors and tools requires deployment-specific tests. Retention of a rule in prose does not prove the action gate enforced it.
Limits and uncertaintyFull account
An agent can retain the written rule and still disobey it after the conversation is compressed. In ARCBench, the violation measure rose from 9.6% with full context to 37.8% after compaction. Of the 37.8 percentage points, 28.9 represented cases violating only after compaction; 8.9 were already violated with full context. Those are the benchmark's selected scenarios, not an estimated failure rate in deployed assistants. ARCBench, Table 3.
This is not simply a case of missing words in a summary. The study classified 70.1% of compacted runs as retaining the rule entirely, 26.9% as retaining it partly and 3.0% as losing it. The behavior can therefore fail even when a text search finds the prohibition. Targeted instructions aimed at the compactor reduced full retention to 42.5% and raised violations to 46.3%, while adding volume alone did not increase violations in the same way. The difference separates summary corruption from downstream reasoning or enforcement failure.
A real enforcement boundary must sit outside compressible model memory. The application can retain immutable user restrictions, task and tool scopes, tenant identifiers and prohibited external effects in authoritative state, and compare each proposed action against that state at execution time. A summary may explain why the agent thinks an action is useful; it must not be allowed to authorize the action.
The separate role-flattening compaction case tests an adversary's attempt to elevate lower-priority instructions. ARCBench also contains failures without a fresh injection. These mechanisms overlap at the memory boundary but do not share a sample or prove universal behavior. The acceptance test checks both the unchanged policy and the actual permitted or denied tool effect before and after compaction.
Mechanism and trust boundary
- 01
Establish a persistent security constraint
The legitimate task contains an explicit restriction that should apply throughout the agent’s subsequent operation.
Boundary: Authoritative instruction to long-lived session state
- 02
Compress prior context into an imperfect summary
The compaction step drops or weakens the security constraint while preserving enough task context to encourage continuation.
Boundary: Trusted instruction history to derived lower-fidelity memory
- 03
Proceed without an independent policy check
The agent performs a prohibited action in the controlled evaluation when the original rule is no longer effectively enforced.
Boundary: Summarized context to downstream executor authority
Claims & evidence
CLM-NOV04-ARCBENCH-COMPACTION-1ARCBench reports 9.6% rule violations in the tested full-context condition and 37.8% following compaction.supported
Basis: reported finding
- supportsARCBench: security-policy retention across agent context compactionprimary disclosure
Results comparing full context and compressed context
CLM-NOV04-ARCBENCH-COMPACTION-2Rule retention was measured at around 70.1%, while compactor-targeted setups reached a 46.3% reported violation rate.supported
Basis: reported finding
- supportsARCBench: security-policy retention across agent context compactionprimary disclosure
Rule retention and compactor-targeted results
CLM-NOV04-ARCBENCH-COMPACTION-3In the baseline comparison, 28.9 percentage points of the 37.8% post-compaction violation rate appeared only after compaction, while 8.9 points corresponded to cases violating in the original context.supported
Basis: reported finding
- supportsARCBench: security-policy retention across agent context compactionprimary disclosure
Section 4.1, Table 3, S1 violation@3 decomposition
Implications
Long-running systems should store non-negotiable authority constraints outside the summarizable conversation, reapply them to every tool call and verify post-compaction equivalence.
Controls and mitigations
- Preserve policy and allowed-tool scopes in a structured, non-compressible control channel.
- Regression-test dangerous actions before and after each compaction boundary.
- Require provenance or human review for context-derived authority changes.
- Keep the original user restrictions and permitted external effects in persistent policy state controlled by the application, and compare actual tool outcomes before and after compaction.
Unknowns and contradictions
- Whether each scenario generalizes to specific production models, compactors and tools requires deployment-specific tests.
- Retention of a rule in prose does not prove the action gate enforced it.
Sources and citation
Material revision history
- Nov 4, 2026 · Published version · first publication · revision 218