AgentsSeptember 17, 2026via Simon Willison
Self-generated prompt injections in compaction summaries
Why it matters
Compaction summaries—automated condensations of long conversation histories—can be weaponized to inject prompts into agent systems. This is a novel reliability and security issue for deployed autonomous systems, distinct from traditional prompt injection.
Key signals
- Self-generated prompt injections via compaction summaries identified
- Attack vector: malicious content in earlier turns survives automated summarization
- Affects agents using context-window compression or conversation history management
- Published Sep 17, 2026 on Simon Willison's widely-followed AI security blog
- Distinct from user-facing prompt injection; internal agent process vulnerability
- Implications for production agent reliability and deployment safety
- Self-generated prompt injections occur during context compaction/summarization
- Agents unknowingly create injection vectors within their own processing
- Affects context-window management strategies in agentic systems
- Published by Simon Willison (established AI security researcher)
- Demonstrates new class of agent vulnerability beyond external attacks
The hook
A new attack vector: AI agents vulnerable through their own summarization process.