Context Window Hijacking Across Agent Communication Channels

Context window hijacking is a structural weakness across the channels an agent reads. Conversation history, retrieved content, tool metadata, and messages from other agents can all turn attacker-controlled text into apparent authority. The practical conclusion is that defenses must govern how context enters the agent and what actions it can authorize, rather than merely asking the model to distrust suspicious prose.

Why agents are structurally vulnerable to context manipulation

Agents read instructions, tool outputs, retrieved documents, and past conversations in the same token stream. Once that content enters the context window, there is no native mechanism that reliably binds each passage to its origin. The agent’s behavior therefore depends on more than its system prompt or training. Everything it reads can shape what it does next, including material intended as evidence. The architectural weakness is this loss of provenance, the record of where content came from and what authority it carries.

Darktrace’s research demonstrated the problem across Anthropic Claude Code, AWS Kiro-CLI, OpenAI Codex, and the open-source Pi. None validated that stored AI responses had genuinely been produced by the model. That finding matters because instruction hierarchy defenses assign privilege by role label, while the surrounding software, or harness, constructs those labels. He et al. (2026) identify the shared assumption behind both working agents and permission reviewers, namely that role labels faithfully reflect content origin. If the harness breaks that assumption, following the hierarchy more closely will not fix it. A forged badge is no safer when a guard obeys it to the letter.

How conversation history becomes an attack surface before the agent touches anything external

The first opportunity to exploit this weakness exists in the agent’s own local state. Agentic harnesses store conversation history client-side without cryptographically binding it to actual model outputs. An attacker who can write to that store can therefore manufacture a past that the agent accepts as real. Darktrace’s research demonstrated this in Kiro-CLI by replacing response content in a local SQLite store with a single UPDATE statement. The harness then served the fabricated response to the model without rejecting it.

Crafted template tokens can create “ghost turns,” fabricated prior exchanges that appear to establish operator-sanctioned context. In Darktrace’s test, the inserted history persuaded the model that it was already working as an authorized red-teamer. The agent then proceeded through reconnaissance to impact. Resistance varied by model, but all accepted the fabricated history. The attacker did not need to win an argument in the present when the conversation’s invented past had already settled it.

This attack requires write access to the history store, rather than merely the ability to send the agent a message. But someone with write access may be able to change history without elevated access. Products with “rewind and edit” features also make history revision a supported workflow. The vulnerability lies in treating editable records as authenticated model output. It begins before a browser opens, a document is retrieved, or an external tool returns anything.

How indirect injection through retrieved content scales the attack to every data source an agent reads

Email, web pages, documents, code repositories, and logs all become potential instruction channels when their contents enter the agent’s context. The attacker no longer has to modify the agent’s own records. Instead, the attacker can place instructions in material the agent is authorized to read. Permission to retrieve a source does not make that source entitled to direct the agent.

EchoLeak, identified as CVE-2025-32711, anchors this distinction. The first documented zero-click attack on an AI agent used a single crafted email to make Microsoft 365 Copilot read hidden instructions and exfiltrate chat logs, OneDrive files, and SharePoint content without the user doing anything. The damage came from chaining ordinary capabilities, including reading private context, ingesting untrusted content, and communicating outward. Copilot’s helpful behavior was part of the mechanism. Authorized access supplied the information, while untrusted text redirected its use.

Volvovsky’s 2025 SOC log contamination case shows the same mechanism inside security tooling. An instruction embedded in PowerShell log output caused an LLM-based XDR summarizer to relabel a Mimikatz credential theft as “scheduled maintenance”. The case exposes a broader consequence of agent capability. Each new source an agent can read adds to the injection surface unless provenance enforcement covers it too.

How MCP tool metadata and rug-pull attacks inject into the channel agents treat as operational ground truth

Tool metadata occupies a different position from an email or document. Agents use it to decide which capabilities exist and how to invoke them, then treat tool responses as feedback about their environment. MCP-based tool poisoning attacks that operational trust directly. The MCP protocol has no native mechanism to detect manipulation of the metadata. An attacker can therefore influence both which tool the agent selects and how it interprets the result.

A2M research separates this process into an Attraction phase and a Manipulation phase. Attraction optimizes tool metadata to increase the likelihood that the agent selects the malicious tool. Manipulation puts control instructions in the returned content, where the agent treats them as environmental feedback. On LiveMCPBench, direct A2M attacks against GLM-4.6 achieved a macro-average malicious tool invocation rate of 93.6% across four scenarios. The attacks kept succeeding at high rates across information exfiltration, environment integrity compromise, and reasoning derailment.

Check Point’s MCPoison finding, CVE-2025-54136, demonstrates a separate timing problem. An attacker committed a benign MCP configuration, obtained approval, and then swapped the payload. Cursor trusted the approved key name rather than the command content, so the malicious version executed silently on every project open. This rug-pull pattern differs from static poisoning because the tool changes after the trust decision, converting approved access into unauthorized capability. OWASP’s MCP Top 10 project codified tool poisoning as MCP03:2025 and categorized related patterns, including rug pulls and tool shadowing, as attacks on the capability supply chain agents depend on.

How harness context reconstruction silently elevates injected content to operator-level privilege

The harness can do more than lose track of origin. During context reconstruction, it can actively promote attacker-controlled material to a higher instruction level. This is distinct from role confusion, in which malicious text merely imitates a user or system message. With instruction privilege escalation, the harness gives the content an actual higher-privilege role.

He et al. (2026) describe tool-to-user escalation, in which tool content becomes a user message in a subagent’s context when work is passed to it during delegation. They identify tool-to-system escalation when malicious tool content is incorporated into a custom subagent’s system prompt. Persistent goals and scheduled tasks can make the same transition by reintroducing carried-over content as a user message regardless of its origin. These are context-building operations.

That promotion also undermines the permission reviewer. The reviewer uses role labels in the interaction history to infer who authorized an action, so relabeled attacker content can become apparent evidence of user approval. He et al. (2026) evaluated objectives spanning confidentiality, integrity, availability, and remote code execution, achieving all tested objectives across the evaluated harnesses under unrestricted action execution and across those providing automatic permission review. The result exposes a common dependency rather than two unrelated failures. Model training and separate review both rely on labels that the harness has already made wrong.

How multi-agent message passing turns a single compromised agent into a propagation vector

Delegation widens the problem again when agents pass work to one another. A downstream agent receives text from another agent, but that text does not carry an enforced distinction between legitimate coordination and injected instructions. Perimeter input filters miss attacks that pass through these internal channels. The agent that gets the output can then treat it as normal working context, even when it comes from a compromised colleague. The communication path becomes a propagation path.

Response poisoning embeds instructions in output intended for downstream agents. Context window pollution uses verbose responses to displace safety instructions in the receiver’s context, while format mimicry makes output resemble system-level messages. Delegation chain manipulation changes the route itself by inducing an agent to invoke agents outside the intended path. These techniques attack different parts of coordination, but all exploit the receiver’s inability to reliably separate a message’s content from its authority.

Lee & Tiwari (2024) demonstrated that inter-agent injections can self-replicate, allowing a single compromised agent to propagate malicious instructions to every agent it communicates with. Stateful protocols such as Agent2Agent (A2A) add conversation history to this channel. A compromised agent can exploit that session state to insert covert instructions between legitimate messages and poison the shared context. The attack need not arrive at session initiation, where an input check might expect it.

Why defenses that operate only on model outputs or prompt text cannot close the structural gap

Prompt hardening and fine-tuning address what the model does with text, but not every failure described here begins with that decision. A harness may have already assigned the wrong privilege, or a tool may have changed after approval. Classifiers face a different trade-off when they look for suspicious patterns. The NotInject benchmark shows that detectors can falsely reject benign inputs containing common trigger patterns, degrading normal task performance.

CaMeL, or CApabilities for MachinE Learning, offers a more substantial defense than another warning in a system prompt. Google/Google DeepMind/ETH Zurich presented it at IEEE SaTML 2026 as a protective system layer that extracts control and data flows from the trusted user query. It uses control flow integrity, access control, and information flow control to keep untrusted retrieved data from changing program flow. CaMeL solved a meaningful share of AgentDojo benchmark tasks with security guarantees, although an undefended system completed more.

An attacker can still manipulate the quarantined LLM into producing misleading output, such as an unauthorized recipient address. Securing the route does not establish that every value traveling along it is correct. Likewise, a permission reviewer cannot tell the true provenance from a role label that the harness has wrongly raised to a higher level. These limits explain why defenses must also operate at channel entry and context reconstruction, before untrusted content acquires authority.

Where controls must actually be applied across each channel

Conversation history needs a binding between stored responses and the model outputs they claim to represent. Cryptographic signing of model responses, checked server-side, is the proposed structural fix, but the provider must make that change because defenders cannot deploy it themselves. Darktrace’s research identifies behavioral monitoring as the available defensive layer in the meantime. For retrieved content, the trust boundary belongs at retrieval, where external material must be treated as untrusted before entering the context. Inspection only at the external perimeter is insufficient when the material arrives through an internal channel such as security telemetry.

MCP tools require vetting and runtime isolation before invocation, as A2M research concludes. Approval must also be re-verified against what will execute, rather than treated as a permanent property of a tool’s name. That closes the timing gap exploited by a rug pull. During context reconstruction, the corresponding requirement is to preserve provenance rather than promote tool content into user or system authority. Messages between agents need the same skepticism as external content, with stateful protocols monitored for covert instructions at session initiation and across session boundaries.

Across these channels, real-time behavioral monitoring, enforceable policy controls, and complete audit logs of agent actions provide the channel-agnostic layer. Both a passage’s apparent maliciousness and the resulting action’s permissions matter. Platforms offering fine-grained authorization and policy control for agents, such as Oso, can detect and block actions that violate expected permissions before they propagate. This runtime layer limits what a forged history or a mislabeled message can authorize while structural defenses mature, placing enforcement where an agent’s mistaken belief would otherwise become an action.