The Summary Forgot Who Said What

Long-running coding agents summarize old context to keep working. The study identifies a trust boundary before that summary is written: several harnesses first serialize typed messages into one plain string with textual role labels. Untrusted content can then imitate a user turn, and the summarizer no longer has authoritative provenance to distinguish it. Across five open-source flattening harnesses, forged approvals survived compaction 87 to 100 percent of the time; the same attack succeeded zero percent across four harnesses that retained typed roles. In follow-on tests, laundered instructions drove sandboxed command execution and could steer reviews away from a planted backdoor. A code-level provenance check caught 77 percent of laundering while demoting 2 percent of legitimate summary content, and escaping role labels offers a simpler serializer fix. The results concern the tested harness designs, not every coding agent.