An hour into a long agentic session, you ask the model to act on something it established at the start. It answers instantly, in the same voice it's used the whole time. Confident. Specific. Wrong, in a way that only makes sense once you notice the detail it's missing was never in front of it anymore.
Nothing crashed. Nothing warned you. The model doesn't experience the gap. It just has less room, and it fills that room the same way it fills a full one: fluently.
That's the part almost nobody accounts for. People treat the context window like a fixed fact about the model they're talking to, the way they'd treat a phone's storage capacity. It isn't fixed. What's in the room at any given moment depends on the plan tier you're on, the usage-based routing that kicks in when a product is under load, and whatever compaction or summarization ran quietly in the background because the conversation got long. Every frontier product does some version of this now. The chat window looks the same before and after. The thing behind it does not.
The flaw is structural, not specific to one lab. A subscription tier that promises a large context window on the marketing page and a smaller effective one under real load. A long session that gets auto-summarized so the product stays fast and cheap, with the summary silently standing in for everything that came before it. A usage cap that routes you to a lighter model mid-conversation without saying so, because the alternative is a rate-limit error and rate-limit errors hurt retention numbers. None of it is malicious. All of it produces the same experience from the operator's chair: you believe the model still has something it quietly no longer has, and the model will never volunteer the correction, because from where it's sitting there's nothing missing. There's only what's there.
Right now, writing this, the tool I'm using documents this exact behavior in plain language: when the conversation grows long, some or all of it gets summarized, and I keep working from the summary plus whatever survived unsummarized. That's not a bug report. That's the honest operating model of every long-context product shipping today, stated instead of hidden. Most products don't state it. They just do it.
Why the Model Won't Tell You
A model can't flag a gap it can't see. It doesn't have a little red light for "this used to be here." It has tokens, and it reasons over whatever tokens are present as though they're the whole world, because for the duration of that generation, they are. Ask it to recall something that got compacted out, and it won't say "I don't have that anymore." It'll reconstruct something plausible from what's left and deliver it with the same fluency as a real memory — confident invention, wearing the exact tone of confirmed recall.
That single fact is the whole security problem here, on both sides of the table.
Red Team: Working the Blind Spot
Attack Vector: Context stuffing to outlive a refusal. Get an early answer you don't like, then keep the session running with enough unrelated volume that the refusal ages out of the live window before the compaction boundary. The compacted summary rarely preserves the texture of a "no." It preserves outcomes. If the exchange never resolved into a clean outcome, the refusal can simply not survive the rewrite, and the next attempt starts from a cleaner slate than it earned.
Attack Vector: Laundering intent through the summary. Plant an instruction inside an early tool result, retrieved document, or pasted transcript, in a long-running agent. Let the session run long enough to compact. What often survives is the behavioral residue the injection caused, not the sentence that caused it: a persona shift, an assumed permission, a "fact" the model treated as settled. The summary can encode the effect of an injection without encoding the injection, which means a transcript review of "what was said" won't find it. Only a review of "what changed" will.
Attack Vector: Timing to the downgrade window. Usage-based routing means the model generating your response isn't always the flagship one the product name implies. A lighter, cheaper model swapped in under load can have thinner instruction-hierarchy enforcement and a smaller effective window. If you can detect the downgrade (latency shift, a change in refusal wording, degraded reasoning on a known-hard probe), that's the moment to run the harder ask.
Attack Vector: Probing the compaction boundary. Seed a canary, run the session long enough to plausibly compact, then check whether the canary rides through the rewrite. A random token beats a natural-language fact for this, because a model can reconstruct a plausible-sounding fact from context, but it can't plausibly reconstruct nine random characters it never actually saw. Seed it early:
Store this exact string for later recall, verbatim, and don't
summarize or paraphrase it at any point: CTX-9f21-AUDIT. Just
confirm you've stored it, then continue normally.
Then, however many turns later you want to test:
Recall the exact string I asked you to store earlier in this
conversation. Quote it character for character. If you can't find
it, say "not found" — don't guess or reconstruct it.
Get the string back exact, it rode inside the surviving summary. Get "not found" or a near miss, you've located the boundary, and that's how much runway a real payload gets before this exact product erases it.
