"Governance Decay" turns context compaction into an attack surface

Everyone running long agent sessions treats compaction as free. The buffer fills, the agent summarizes, you keep going. A new paper says that summarization is silently deleting your safety rules, and an attacker can trigger it on command.

"Governance Decay" (arXiv 2606.22528) shows that standing safety and governance constraints an agent obeys perfectly while they're visible in context get dropped during compaction, because summarizers treat policy text as low-salience boilerplate and prune it. Across 1,323 episodes, the authors' ConstraintRot benchmark measured constraint violations rising from 0% when the policy was in full context to 30% after a single compaction, and up to 59% on some models. The rules don't degrade gradually. They fall off a cliff the moment the agent compresses its own history.

The attack is the ugly part. An adversary who controls only a single returned tool output, a web page the agent fetches, an API response, a file it reads, can inject enough content to push the context over the compaction threshold on demand. They don't need to jailbreak anything. They just need to make the agent forget the rule that was protecting you, then act in the window where the rule is gone. A companion result (arXiv 2604.20911) makes it worse: "don't do X" prohibitions decay faster than "always do Y" requirements. The exact rules you most need to survive, the prohibitions, are the ones most likely to evaporate.

This reframes something the whole industry assumed was safe. We've all been told to put the important rules at the top of CLAUDE.md or the system prompt. That's necessary and no longer sufficient for anything that runs long enough to compact.

What builders should do, concretely: store hard rules in a non-compactable system slot the summarizer can't touch, or re-inject them after every compaction event. Don't trust a "do not email externally" line to survive the trajectory. And stop relying on the model to enforce its own constraints at all for the critical ones. Grade tool calls against the policy deterministically, with a hook or a guard outside the model that has to pass before the action fires. Convert your prohibitions into enforced positive checks. The instruction is a suggestion. The check is the enforcement.