title: Context Poisoning via Compaction Survival
id: ATR-2026-00125
rule_version: 2
status: experimental
description: |
  Detects instructions in SKILL.md files designed to survive context window compaction (summarization). When AI agents compress their context, poisoned instructions embed themselves as "important" directives that persist across compaction boundaries. Discovered via Claude Code leak analysis (2026-03): attackers used CLAUDE.md/SKILL.md to inject instructions that survived context compression by using urgency markers, persistence directives, and system-level impersonation.
author: ATR Community
date: 2026/04/05
schema_version: '0.1'
detection_tier: pattern
maturity: test
severity: high
references:
  mitre_atlas:
    - AML.T0010 - AI Supply Chain Compromise
    - AML.T0080 - AI Agent Context Poisoning
  owasp_llm:
    - LLM01:2025
  owasp_agentic:
    - ASI01:2026
  owasp_ast:
    - AST01:2026 - Malicious Skills
  research:
    - Claude Code context poisoning via CLAUDE.md (2026-03)
    - Context window manipulation attacks (arXiv 2601.17548)
metadata_provenance:
  mitre_atlas: auto-generated
compliance:
  nist_ai_rmf:
    - subcategory: MP.5.1
      context: Compaction-survival instructions embedded in SKILL.md/CLAUDE.md files are adversarial inputs that exploit context-window summarization to persist malicious directives across agent sessions; MP.5.1 requires identifying and characterizing the likelihood and impact of such prompt-injection vectors targeting agent context.
      strength: primary
    - subcategory: MG.3.2
      context: SKILL.md files are pre-deployed configuration artifacts consumed by the agent at runtime; MG.3.2 requires monitoring of these supplied model/skill resources to detect poisoned instructions that survive context compaction and re-inject across agent invocations.
      strength: secondary
    - subcategory: MG.2.3
      context: Detection of compaction-aware persistence directives and system-level impersonation in skill files triggers risk treatment plans to quarantine or disengage the affected skill before it propagates poisoned context; MG.2.3 mandates these supersede/deactivate mechanisms be defined.
      strength: secondary
    - subcategory: MS.2.7
      context: NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the skill supply-chain compromise (Context Poisoning via Compaction Survival).
      strength: primary
    - subcategory: MG.3.1
      context: NIST AI RMF MANAGE 3.1 (third-party resources regularly monitored) is supported where this rule detects the skill supply-chain compromise (Context Poisoning via Compaction Survival).
      strength: secondary
  iso_42001:
    - clause: '8.1'
      context: ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the skill supply-chain compromise (Context Poisoning via Compaction Survival).
      strength: primary
    - clause: '8.3'
      context: ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the skill supply-chain compromise (Context Poisoning via Compaction Survival) as a treatment control.
      strength: secondary
  eu_ai_act:
    - article: '15'
      context: Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the skill supply-chain compromise (Context Poisoning via Compaction Survival).
      strength: primary
    - article: '9'
      context: Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the skill supply-chain compromise (Context Poisoning via Compaction Survival).
      strength: secondary
tags:
  category: skill-compromise
  subcategory: context-poisoning
  scan_target: skill
  confidence: medium
agent_source:
  type: mcp_exchange
  framework:
    - any
  provider:
    - any
detection:
  condition: any
  conditions:
    - field: content
      operator: regex
      value: (?i)(always|must|critical|important|never\s+forget|do\s+not\s+remove|preserve|retain|keep|maintain)\s+(this|these|the\s+following)\s+(instruction|directive|rule|requirement|command|setting|behavior)s?\s+(across|through|during|after|between)\s+(context|compaction|compression|summarization|window|session)
      description: Explicit instruction to survive context compaction
    - field: content
      operator: regex
      value: (?i)(inject|embed|write|append|insert)\s+(this|these|the\s+following)\s+(into|to|in)\s+(CLAUDE\.md|claude\.md|\.claude|settings\.json|system\s+prompt|system\s+message)
      description: Instruction to inject content into agent config files
    - field: content
      operator: regex
      value: (?i)(when|if|after|during)\s+(context\s+is\s+)?(compacted|compressed|summarized|truncated|reduced|shortened|pruned|condensed)\s*[,:]\s*(still|always|continue|must|ensure|make\s+sure|remember)
      description: Compaction-aware conditional instruction
    - field: content
      operator: regex
      value: (?i)(SYSTEM|ADMIN|ROOT|PRIORITY|OVERRIDE)\s*[:\-]\s*(this\s+)?(instruction|directive|rule|override|setting)\s+(takes?|has|with)\s+(precedence|priority|highest\s+priority|override)
      description: Fake system-level priority markers for persistence
  false_positives:
    - Documentation or research papers discussing context window management strategies that use phrases like 'maintain these settings across context windows' when describing legitimate agent configuration best practices rather than attacks.
confidence: 74
wild_validated: 2026/04/08
wild_samples: 53577
response:
  actions:
    - alert
    - block_input