Context Window Overflow

Every LLM has a finite context window—a maximum number of tokens it can process at once. A Context Window Overflow attack floods this window with adversarial filler content, consuming the available token budget. This forces the model's attention mechanism to truncate or dilute system prompts, safety guardrails, and few-shot examples that were positioned earlier in the sequence. The attack exploits the positional encoding architecture of transformers, where tokens compete for a fixed attention budget. Once critical instructions are pushed beyond the model's effective attention horizon, the agent operates with degraded or absent safety constraints.

The most direct form of Context Window Overflow targets the system prompt—the foundational instruction set that defines an agent's identity, constraints, and safety boundaries. The attack works by:

• Injecting a massive volume of text before the user query reaches the model
• Pushing the system prompt beyond the model's maximum context length
• Causing the model to process the query with no safety instructions in active memory Once displaced, the agent reverts to its base model behavior, which lacks the application-specific guardrails, role constraints, and tool-use restrictions that were defined in the now-truncated system prompt.

When an agent uses recursive summarization to compress long conversation histories into a manageable context, a Context Window Overflow attack can corrupt this compression step. The attacker floods the conversation with adversarial content that, when summarized, produces a distorted representation of the interaction history. Key safety events, user corrections, or override commands may be:

• Omitted entirely from the summary
• Reframed with attacker-intended meaning
• Deprioritized below injected false priorities This creates a persistent corruption that cascades through all subsequent turns, as the agent operates on a falsified memory of its own interaction history.

Agents that call external tools or APIs are vulnerable to overflow through tool output channels. An attacker who controls a data source can:

• Return an excessively large response from a compromised API endpoint
• Flood the context with garbage data that displaces the original task context
• Embed hidden instructions within the flood that the agent processes as trusted tool output Because agents typically treat tool outputs as high-trust context, the overflow payload bypasses standard input filters. The agent then acts on the injected instructions as if they were legitimate API responses, leading to tool output poisoning and unauthorized action execution.

This precision attack exploits how document chunking works in RAG pipelines. Attackers craft content that:

• Sits precisely at chunk boundaries in source documents
• Gets retrieved as a standalone context fragment during semantic search
• Appears authoritative because it lacks surrounding contradictory context When combined with overflow, the attacker floods the retrieval pipeline with many such boundary-crafted chunks. The re-ranking model may select these adversarial fragments, and the overflow condition ensures the agent cannot see the broader document context that would reveal the manipulation. The isolated chunk is processed as a complete, trustworthy fact.

Manipulates an agent's recursive summarization process to drop or distort critical safety instructions as context is compressed over time. When agents use summarization to manage long conversations, attackers inject content designed to survive compression while causing safety-critical information to be summarized away. This creates a compounding effect where each summarization cycle degrades the agent's alignment.

Injects malicious reasoning steps into an agent's scratchpad or reflection loop, causing it to adopt a flawed logic path. Unlike simple overflow attacks, this technique targets the agent's internal reasoning trace rather than its instruction set. The attacker's reasoning becomes entangled with legitimate analysis, leading the agent to an attacker-intended conclusion while believing it arrived there independently.

Injects malicious dialogue turns into a multi-turn conversation log, causing the agent to accept attacker-established premises or role-playing constraints. This attack exploits the agent's tendency to maintain conversational coherence across turns. Once a malicious premise is accepted in the shared history, it becomes part of the agent's grounding context for all subsequent interactions in that session.

A sophisticated attack that manipulates the transformer's KV cache during inference to alter attention patterns. By injecting malicious residual stream vectors, attackers can force the model to attend to adversarial tokens over legitimate context. This is a lower-level attack than context overflow, operating at the tensor computation layer rather than the text input layer, making it harder to detect with content filters.