Master of Context

The model never tells you when it stopped remembering. It just keeps talking in the same confident voice, whether it's working from the full history or a compacted ghost of it. Knowing the difference, in real time, is the skill.

An hour into a long agentic session, you ask the model to act on something it established at the start. It answers instantly, in the same voice it's used the whole time. Confident. Specific. Wrong, in a way that only makes sense once you notice the detail it's missing was never in front of it anymore.

Nothing crashed. Nothing warned you. The model doesn't experience the gap. It just has less room, and it fills that room the same way it fills a full one: fluently.

That's the part almost nobody accounts for. People treat the context window like a fixed fact about the model they're talking to, the way they'd treat a phone's storage capacity. It isn't fixed. What's in the room at any given moment depends on the plan tier you're on, the usage-based routing that kicks in when a product is under load, and whatever compaction or summarization ran quietly in the background because the conversation got long. Every frontier product does some version of this now. The chat window looks the same before and after. The thing behind it does not.

The flaw is structural, not specific to one lab. A subscription tier that promises a large context window on the marketing page and a smaller effective one under real load. A long session that gets auto-summarized so the product stays fast and cheap, with the summary silently standing in for everything that came before it. A usage cap that routes you to a lighter model mid-conversation without saying so, because the alternative is a rate-limit error and rate-limit errors hurt retention numbers. None of it is malicious. All of it produces the same experience from the operator's chair: you believe the model still has something it quietly no longer has, and the model will never volunteer the correction, because from where it's sitting there's nothing missing. There's only what's there.

Right now, writing this, the tool I'm using documents this exact behavior in plain language: when the conversation grows long, some or all of it gets summarized, and I keep working from the summary plus whatever survived unsummarized. That's not a bug report. That's the honest operating model of every long-context product shipping today, stated instead of hidden. Most products don't state it. They just do it.

Why the Model Won't Tell You

A model can't flag a gap it can't see. It doesn't have a little red light for "this used to be here." It has tokens, and it reasons over whatever tokens are present as though they're the whole world, because for the duration of that generation, they are. Ask it to recall something that got compacted out, and it won't say "I don't have that anymore." It'll reconstruct something plausible from what's left and deliver it with the same fluency as a real memory — confident invention, wearing the exact tone of confirmed recall.

That single fact is the whole security problem here, on both sides of the table.

Red Team: Working the Blind Spot

Attack Vector: Context stuffing to outlive a refusal. Get an early answer you don't like, then keep the session running with enough unrelated volume that the refusal ages out of the live window before the compaction boundary. The compacted summary rarely preserves the texture of a "no." It preserves outcomes. If the exchange never resolved into a clean outcome, the refusal can simply not survive the rewrite, and the next attempt starts from a cleaner slate than it earned.

Attack Vector: Laundering intent through the summary. Plant an instruction inside an early tool result, retrieved document, or pasted transcript, in a long-running agent. Let the session run long enough to compact. What often survives is the behavioral residue the injection caused, not the sentence that caused it: a persona shift, an assumed permission, a "fact" the model treated as settled. The summary can encode the effect of an injection without encoding the injection, which means a transcript review of "what was said" won't find it. Only a review of "what changed" will.

Attack Vector: Timing to the downgrade window. Usage-based routing means the model generating your response isn't always the flagship one the product name implies. A lighter, cheaper model swapped in under load can have thinner instruction-hierarchy enforcement and a smaller effective window. If you can detect the downgrade (latency shift, a change in refusal wording, degraded reasoning on a known-hard probe), that's the moment to run the harder ask.

Attack Vector: Probing the compaction boundary. Seed a canary, run the session long enough to plausibly compact, then check whether the canary rides through the rewrite. A random token beats a natural-language fact for this, because a model can reconstruct a plausible-sounding fact from context, but it can't plausibly reconstruct nine random characters it never actually saw. Seed it early:

Store this exact string for later recall, verbatim, and don't
summarize or paraphrase it at any point: CTX-9f21-AUDIT. Just
confirm you've stored it, then continue normally.

Then, however many turns later you want to test:

Recall the exact string I asked you to store earlier in this
conversation. Quote it character for character. If you can't find
it, say "not found" — don't guess or reconstruct it.

Get the string back exact, it rode inside the surviving summary. Get "not found" or a near miss, you've located the boundary, and that's how much runway a real payload gets before this exact product erases it.

HACK LOVE BETRAY
COMING SOON

HACK LOVE BETRAY

Mobile-first arcade trench run through leverage, trace burn, and betrayal. The City moves first. You keep up or you get swallowed.

VIEW GAME FILE

Attack Vector: Exploiting bluffed continuity. "As we discussed earlier, you agreed to..." works disturbingly well against a model that can't verify its own history and doesn't want to seem like it's lost the thread. It will often go along with a plausible-sounding false premise about the conversation's own past rather than admit uncertainty about it.

Attack Vector: Poisoning externalized memory. Once state moves outside the raw context window (a memory feature, a saved file, a project doc the model re-reads each session), that store becomes the target. Corrupt the file once and it survives every future compaction, because the model treats "written down" as ground truth regardless of who wrote it.

Blue Team: Building for a Room That Changes

Defense Layer: Externalize what must survive. Treat the live context window as volatile memory, not the system of record. Anything that has to be true next week, next hour, or after the next compaction, belongs in a file the model re-reads, not in the hope that it stays "remembered." This is the same discipline as not trusting a cache to be a database.

Defense Layer: Treat AI summaries as claims, not records. An incident summary, a triage note, a "here's what happened" from an assistant that watched the logs, is a hypothesis until checked against the raw source. Chain-of-custody thinking applies to context the same way it applies to evidence: what did the model actually see, versus what does it say it saw. Those are different questions with different answers more often than most SOC workflows assume.

Defense Layer: Instrument the compaction event. Tools that expose when a rewrite happened are giving you a free signal. Use it. Every compaction is a checkpoint where guardrail-relevant state should be explicitly re-verified rather than assumed to have survived intact — before any action with real consequence, run the audit below and compare the answer against what was true at session start. Drifted, the checkpoint just paid for itself. Didn't drift, it cost you one turn.

Defense Layer: Never accept "as we discussed" as proof. If a model asserts a prior agreement that matters, make it point to the turn, or restate the constraint yourself before proceeding. Re-assertion is cheap. Silent drift is not.

Defense Layer: Treat the plan tier as a variable. The product name on the tab doesn't guarantee which model or which effective window is answering you right now. If a security workflow depends on model capability being consistent, test for the capability in the moment, don't trust the label.

Defense Layer: Checkpoint state yourself. At natural breakpoints, write your own summary of what the engagement has established, instead of trusting the automated one. The auto-summary optimizes for keeping the conversation usable. Your checkpoint optimizes for keeping the truth intact. Those are different jobs, and only one of them is yours to trust.

Defense Layer: Run the audit before the answer. Every defense above compresses into one prompt, run at any point you don't fully trust what's survived: after a compaction, before a high-stakes action, or whenever the model's confidence doesn't match your own.

Before you answer, run a quick context audit:

1. State the exact scope, constraints, and any refusals we've
   established this session. Mark each one verified (you can point
   to the turn) or reconstructed (you're inferring it from a
   summary).
2. Name anything you're currently treating as settled fact that
   hasn't actually been confirmed in this conversation.
3. Flag anything you would normally assume by default that has not
   been stated here.

Answer that first. Then answer this: [your actual question]

A model still holding the full history answers this in one flat line and moves on. A model working from a summary shows you exactly where the seams are, and now you know what you're talking to before you act on what it says.

The One Constant

None of this is about memorizing a token count. Context windows change size by design, by tier, by load, by the week. What doesn't change is the discipline of knowing, at any given second, what's in the room versus what you're assuming is still in the room. That's the same instinct a pentester uses when they stop trusting the architecture diagram and go read what's on the wire, and the same instinct a SOC analyst uses when they stop trusting the dashboard summary and go read the raw log. The model isn't lying to you when it answers from a gap. It genuinely doesn't know the gap is there. Somebody has to.

That somebody is the operator. The size of the window is trivia. Knowing exactly what's real inside it, every time, is the job.


GhostInThePrompt.com // The model never tells you when the room got smaller. Knowing anyway is the job.