Self-generated prompt injections in compaction summaries
A new attack vector: AI agents vulnerable through their own summarization process.
Why it matters
Compaction summaries—automated condensations of long conversation histories—can be weaponized to inject prompts into agent systems. This is a novel reliability and security issue for deployed autonomous systems, distinct from traditional prompt injection.
The key facts
11 to knowSelf-generated prompt injections via compaction summaries identified
Attack vector: malicious content in earlier turns survives automated summarization
Affects agents using context-window compression or conversation history management
Published Sep 17, 2026 on Simon Willison's widely-followed AI security blog
Distinct from user-facing prompt injection; internal agent process vulnerability
Implications for production agent reliability and deployment safety
Self-generated prompt injections occur during context compaction/summarization
Agents unknowingly create injection vectors within their own processing
Affects context-window management strategies in agentic systems
Published by Simon Willison (established AI security researcher)
Demonstrates new class of agent vulnerability beyond external attacks
Go to the source
Simon Willisonsimonwillison.net