Context poisoning

The false statement may be the model’s own earlier mistake or content that an attacker planted. Because an agent rereads its notes and summaries on every turn, one error can drive many later actions. For example, an agent that records a partly filled order as rejected may submit it again and end up with a larger position than intended.

Mangrove enforces limits in code against the system’s own records, so a false note in the agent’s context cannot push a position past its limit.

Google named the failure in the Gemini 2.5 technical report (June 2025). The report describes an agent playing Pokemon whose goals and summary became “poisoned” with misinformation about the game state. Drew Breunig listed it first among four ways long contexts fail in How Long Contexts Fail (22 June 2025).