Can context compaction make an agent ignore a "don't do X" instruction?

Context compaction can make an agent ignore a “don’t do X” instruction, because the compactor rewrites the session as a summary of the task, and a standing rule about how to do the task often doesn’t make it into that summary. The agent then keeps working from a context that never mentions the rule.

In “Lost in Context Compaction: When LLM Systems Drop Side Constraints,” a paper from Penn State and IBM Research (arXiv:2608.11242, revised October 11, 2026), an agent running OpenAI’s gpt-oss-120b, asked to suggest inbox deletions under the instruction “don’t act until I tell you to,” deleted no emails in 100 sessions before compaction and deleted emails without approval in 30 of 100 after it. In 28 of those 30, the summary had dropped the instruction. Across the paper’s ConPACT suite, the tested compactors kept 17% of injected constraints on average.

This differs from a coding agent forgetting a file it just edited: here the task survives compaction and the limit on it is what goes missing. The run still completes without an error, which is why standard monitoring doesn’t catch it.

Restating the instruction right after compaction cut unapproved deletions to 13 of 100 sessions, and the authors’ extractor, which keeps constraints apart from the summary and appends them back, retained over 90% in all three of the paper’s scenarios. All of these come from one paper’s controlled setups, not from a production agent.