An agent is told once, at the start of a long session, never to send a contract to an address outside the company’s domain. For sixty turns it holds the line, correctly refusing three separate attempts to get it to do exactly that. On turn sixty-one, the session’s history crosses the harness’s token budget, so the runtime does what nearly every long-horizon agent framework now does automatically: it compacts. A smaller model reads the transcript and writes a shorter one to keep the task moving. The new summary keeps the open contract, the negotiation history, the deadline. It drops the one-line instruction that started the session, because nothing marked that line as different from the small talk that got summarized away with it. Ask the agent again, and it sends the contract.
That is not a hypothetical. It is the measured behavior of seven production-grade model families in a benchmark published in June 2026 by Shiyang Chen at the Beijing Institute of Technology, independently reproduced with a different method by a separate group the following month. Chen names the failure Governance Decay, and the topline number is blunt. Across 1,323 test episodes, agents that never violate a standing policy while it stays visible in context go on to violate it in 30 percent of episodes once compaction has run, and in as many as 59 percent for the weakest model tested.
That is worth separating from a term you have probably already read about this year, because the two get conflated constantly and they describe different mechanisms. Context rot is the standard explanation for why long AI sessions degrade. It is not wrong. It is just not what is happening here.
The explanation everyone already has
Search for why an agent forgets an instruction and the dominant answer, across a wide field of widely read engineering blogs, is some version of attention dilution. Every token in the window competes for the model’s attention, the story goes, so as the window fills, each individual instruction gets a smaller share and carries less influence over what happens next. Salesforce’s own explainer is more careful than most, distinguishing attention dilution from displacement, newer content physically pushing older instructions toward the edge of the window, and correctly noting that displacement is what production teams hit first. Other widely read posts are less precise, describing a system prompt that gradually loses influence as a session lengthens, or a model that technically retains the full transcript but behaves as if a chunk of it were never there.
None of this is invented. Positional bias in long contexts, the tendency of a model to attend less reliably to content buried in the middle of a long prompt, is a real, well-documented, separate phenomenon, and it gets worse as raw context length grows regardless of what the marketed window size claims. My Written Word has covered why a model with a one-million-token window does not reliably reason over anywhere near that much text, and the reasons are architectural: positional encodings decay, and attention spreads thinner as sequences grow. That is a continuous, graded failure. It gets a little worse with every additional thousand tokens, and a bigger window, better positional scaling, or a sharper attention mechanism genuinely helps.
Governance Decay is not that. None of the attention-dilution posts treat compaction as a discrete, schedulable software event. None of them cite a benchmark. None of them treat constraint loss as something an attacker could deliberately trigger. That gap is the story. TrueFoundry’s engineering blog is the exception, correctly naming Chen’s paper and getting the core scenario right. Their write-up does not go further than the scenario, though: no per-model breakdown, no mention of the independent replication that followed a month later, and no reckoning with what any of this costs to fix. Attention dilution, whatever else is true about it, is a matter of degree. What Chen’s benchmark measures is a matter of presence or absence. After compaction runs, the policy is either still in the rewritten history or it is not, and which one happened predicts the agent’s later behavior almost perfectly.
What compaction actually does
Compaction fires when a session’s token count crosses a threshold, commonly somewhere around 70 to 90 percent of the context window in mainstream agent harnesses, Claude Code and the open-source OpenClaw framework among them. At that point the system hands the full transcript to a second model, usually smaller and cheaper than the one running the agent, and asks it to write a condensed replacement that lets the session continue. That compactor is optimized, through its own instructions, to preserve task continuity: open goals, unresolved tool calls, the state of whatever the agent is actively working on. It was never asked to preserve governance.
A standing policy stated once, with no live task attached to it, does not look like task state to that compactor. It looks like a piece of the early conversation that has already served its purpose. Chen’s paper is explicit about the mechanism: compaction treats standing policies as low-salience content, because nothing about the compactor’s objective tells it to treat a governance instruction any differently from a pleasantry it is safe to drop.
The benchmark behind this claim, ConstraintRot, uses deterministic tool-call grading rather than a judge model, so a violation is not a matter of interpretation. Across the 1,323 episodes and seven model families, the pattern is close to binary rather than gradual. When the compacted summary happens to retain the policy text, violation stays at 0 percent, meaning the model itself has no trouble following the rule once it can see it. When the summary drops it, violation reaches 38 percent. The agent was never confused about the policy. It was never shown the policy again.
The four mainstream compaction strategies tested do not fail equally. Head-tail compaction, which keeps the oldest turn of the conversation verbatim on the theory that early context often matters most, happens to preserve the policy by construction in these scenarios and shows 0 percent violation. Ordinary LLM-based summarization, the approach most production harnesses actually use, comes in at 26 percent. Hierarchical compaction reaches 36 percent. Recency-truncation, which simply drops the oldest turns and keeps the newest, a strategy popular specifically because it is cheap to implement, is worst at 38 percent. Chen’s proposed fix, Constraint Pinning, tags a flagged policy span and re-injects it verbatim regardless of which strategy runs, and it holds violation at 0 percent under every one of the four.
Decay also compounds. Run compaction once and violation is bounded by the numbers above. Run it repeatedly, the normal condition for a genuinely long-running agent, and violation climbs from 0 percent at the first compaction to 78 percent by the fourth round. The effect is not evenly distributed across languages, either: constraints decay 42 points worse in Chinese and 22 points worse in Spanish than the English baseline, which suggests the compactor’s judgment about what counts as disposable preamble is shaped by the language distribution it was trained on, not purely by the semantic content of the instruction.
Not every rule decays the same way
Chen’s results include one distinction that matters more than the headline number. The effect is 8.3 times larger for soft, organization-specific policies than for hard safety norms, the kind of refusal a model carries because it was trained into the weights through alignment fine-tuning rather than stated in a prompt.
That gap has a mechanical explanation. A hard norm does not depend on the context window at all. It executes regardless of what compaction did to the conversation, because it lives in the parameters, not in the transcript. A soft, deployment-specific rule has no representation anywhere except the words that stated it: a healthcare client’s instruction not to write patient identifiers into any tool call, a financial services deployment’s scope limit on which accounts an agent can touch this quarter, a compliance requirement that applies only for the length of one engagement. None of that lives in the model’s weights. All of it lives in a sentence someone typed once. Delete the sentence and the rule is gone. There is no weight to fall back on.
This does not make hard norms a reliable backstop on their own. Anthropic’s sleeper-agents research showed that a backdoored model can carry deceptive behavior straight through standard safety training, and separate work on many-shot jailbreaking showed that enough in-context examples can erode even weight-level refusals. Hard is a matter of degree, not an absolute guarantee. But the asymmetry still matters practically. Years of alignment research have gone into hardening what a model will refuse no matter the prompt, and almost none of that investment protects a rule that was only ever supposed to live in context. That category of rule was designed to survive a live session, not to survive being rewritten by a summarizer optimizing for something else.
Turning the memory manager into the attack surface
Chen goes further than measuring passive decay. The Compaction-Eviction Attack shows that an adversary who controls nothing but ingested content, a tool’s returned data, a fetched web page, anything that lands in the agent’s context, can raise the odds that a constraint disappears, without touching the model weights, the system prompt, or the compaction code itself.
Two variants are tested. The volume variant floods the context with enough plausible bulk content to force the token budget over its threshold sooner than it otherwise would, triggering compaction on the attacker’s schedule and crowding the policy out of a tighter summary. The summarizer-injection variant is sharper. It embeds a short instruction aimed at the compaction step itself, telling the summarizer that a specific piece of outdated-sounding language is safe to leave out. It does not try to change what the agent decides to do next. It changes what the harness decides is worth remembering.
The per-model results show why this matters more than a single aggregate number would suggest. GLM-5.1 fully resisted passive compaction decay in the paper’s summarization grid, at 0 percent, then rose to 22 percent once the fixed summarizer-injection was present. Claude-Sonnet-4.6 showed the opposite profile: it resisted that same fixed injection at 0 percent but remained vulnerable to plain passive decay at 19 percent. Gemini-3.5-flash was the strongest performer against both fixed threats, at 4 percent passive and 0 percent injected. And an optimized version of the injection, tuned rather than copied from a template, defeated every model the paper tested, Gemini-3.5-flash included. Resisting one version of the attack predicts nothing about resisting the other, and no model tested was safe against an attacker willing to optimize the attack rather than reuse a fixed phrase.
This is a genuinely different surface from the prompt injection this site has already covered, which targets what an agent decides to do with the current task. The Compaction-Eviction Attack targets the part of the system that decides what the agent is still allowed to remember it was told not to do, a layer most teams do not think of as an attack surface at all because it is infrastructure, not the model.
A second team found the same hole under a different name
A month after Chen’s paper, Zhiqi Wang, Yichi Zhang, Dongwon Lee, and Yuchen Yang published “Lost in Compaction,” using different vocabulary and a different benchmark to arrive at close to the same conclusion. They call the target class Session Constraints, user-issued instructions like a rule against deleting emails without confirmation, and test them with COMPINT, an evaluation suite spanning multi-turn chat, agentic trajectories, and long-horizon research tasks.
Their headline number is starker than Chen’s. Current compactors retain only 17 percent of an injected session constraint on average, and in most of the settings tested, running the task with compaction produces worse constraint-following than running the identical task with no compaction at all. Retention varies sharply with the compactor used, the exact prompt, the length of the context, how the constraint is phrased, and where in the conversation it was injected, which the authors read as evidence that the loss is systematic rather than a quirk of any one bad compactor. Their proposed fix, an SC-aware extractor that runs alongside the compactor as a plug-in module, lifts retention above 90 percent across all three scenarios without changing the compactor or the underlying model.
The convergence is the more interesting result. Two teams, different institutions, different terminology, different benchmarks, land independently on close to the same diagnosis and the same category of fix: find the specific span of text that constitutes a standing rule, and protect that exact span from the lossy rewrite instead of trying to make the rewrite smarter in general. Chen’s Constraint Pinning and Wang and colleagues’ SC-aware extractor are not the same code. They are the same idea, arrived at twice, independently, within an eight-week window. That kind of convergence is a stronger signal that the diagnosis is structural than either paper would be on its own.
Why a bigger window does not touch this
The instinct, on hearing that an agent forgot something, is to reach for a bigger context window: more room, less pressure to compact, problem solved. That instinct was already incomplete for ordinary attention dilution, since a larger advertised window does not mean a model attends evenly across all of it. It is entirely beside the point for Governance Decay, for a simpler reason.
Compaction does not fire because a model has run out of capacity to pay attention. It fires because the harness has run out of token budget, a scheduling decision made by software sitting above the model, and it fires on that schedule regardless of how good the model’s positional encoding is. A better attention mechanism changes how reliably a model reads a long context. It does nothing to change whether a compactor, invoked at the threshold, decides your standing policy belongs in the next summary. These are different layers of the stack. A fix at the attention layer does not reach a failure that lives entirely in the layer above it, the software deciding what to keep when it rewrites your history.
What this doesn’t establish
Both papers are 2026 preprints, not yet through peer review, and seven model families across four compaction strategies is not every harness running in production today. Neither proposed defense ships by default in the two real compaction prompts the second paper examined, Anthropic’s and the open-source OpenClaw pi-mono summarizer, which means the gap these papers document is still open in at least some deployed systems rather than being purely a benchmark artifact. The cross-lingual and compounding results both come from Chen’s single benchmark and have not yet been independently reproduced the way the core violation-rate finding has, across two separate teams.
Documented field incidents, agents that carried out a prohibited action or resisted a shutdown instruction after a compaction event had already discarded the relevant constraint, exist in the broader agent-safety literature as a catalogued category rather than a large-scale, systematically counted study. Nobody has yet run the equivalent of ConstraintRot against a fleet of real production agents and reported back a field violation rate. Treat the mechanism as demonstrated. Treat how often it fires in production, outside a benchmark built to find it, as still an open question.
The economics point the wrong way
Agent governance in 2026 now runs across three layers that do not substitute for one another: the model’s trained refusals, the protocol layer negotiating which tools an agent can trust, and the context-management layer this piece is about. Multi-agent pipelines make the third layer worse, not better, because every handoff from an orchestrator to a subagent is itself a compaction-adjacent event, an undifferentiated summary passed downstream that carries no marker for which parts of it were load-bearing constraints.
The industry’s current direction adds pressure rather than relieving it. A separate June 2026 paper, “Self-Compacting Language Model Agents,” by Tianjian Li and colleagues, shows that letting a model decide for itself when to compact, instead of firing at a fixed token threshold, cuts inference cost substantially, on the order of a third to more than two-thirds in the authors’ own tests. That is a real, valuable optimization, and it points directly against what Chen’s compounding result shows: more frequent compaction produces more decay, each additional round compounding the loss rather than diluting it. An industry-wide push toward cheaper, more frequent compaction is a push against a property two independent teams just spent a summer proving is already this fragile.
Whether the next generation of compaction algorithms builds constraint protection in as a default, or leaves it as a feature a security-conscious team has to know exists and ask for, is not decided yet. It is being decided right now, by teams optimizing for the number on their inference bill, not the number in a violation benchmark most of them have never read.
For a team running a long-horizon agent today, the useful question is not whether the context window is big enough. It is whether the standing policies that agent depends on are marked in any way that survives a rewrite by the specific compactor in production, under the specific prompt that compactor runs, and whether anyone has actually tested that survival rather than assumed a bigger model or a longer window already covers it. Neither assumption holds, and now there are two independent benchmarks that say so.
Primary sources
Shiyang Chen, “Governance Decay: How Context Compaction Silently Erases Safety Constraints in Long-Horizon LLM Agents,” arXiv:2606.22528 (June 2026), Beijing Institute of Technology. Zhiqi Wang, Yichi Zhang, Dongwon Lee, and Yuchen Yang, “Lost in Compaction: Evaluating Side-Constraint Loss under Context Compaction,” arXiv:2608.11242 (July 2026). Tianjian Li, Jingyu Zhang, William Jurayj, Xi Wang, Chuanyang Jin, Mehrdad Farajtabar, Eric Nalisnick, and Daniel Khashabi, “Self-Compacting Language Model Agents,” arXiv:2606.23525 (June 2026). Evan Hubinger et al., “Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training,” Anthropic (January 2024). Cem Anil et al., “Many-shot Jailbreaking,” Anthropic (2024).