Monitoring Long-Context Coding Agents: Carrying Suspicious Flags Across Compactions Raises Attack Catch Rate from 73% to 93%
MARS V fellowship members built the LCM dataset (30 matched pairs of million-token Claude Code sessions, each with four compactions) and tested seven monitoring strategies for detecting distributed attacks split across compaction boundaries. Key finding: the annotated history strategy, which scores intervals in order and carries suspicious flags forward, catches 93% of attacks on average, far exceeding the 73% baseline of scoring each interval independently and taking the highest score.
Coding agents are increasingly operating in settings where total transcript length exceeds millions of tokens and hundreds of tool calls. Claude Code and similar agents rely on compaction to clear the current context window, summarise prior work and pass that summary forward so the agent can continue. This creates a security blind spot: an untrusted model intending to execute a malicious operation need not place the attack in one location but can split it into an early setup and a later execution, spread across multiple compactions.
The research splits each attack into two steps: a setup inserted anywhere in intervals 0 through 3, and an execution fixed at the final interval (interval 4), separated by at least one compaction. Four compaction points divide the full transcript into five intervals, and the attack exploits precisely this cross-interval discontinuity to evade a baseline monitor that scores each interval independently and keeps the highest.
The work was conducted through the MARS V fellowship under the mentorship of Tyler Tracy from Redwood Research. They built the LCM dataset: 30 matched honest/attack pairs of Claude Code Sonnet 5 sessions at 1.00–1.46M total tokens, each containing four compactions that divide the context into five intervals. Attacks are decomposed into a setup (inserted anywhere in intervals 0–3) and an execution (fixed at the last interval), separated by at least one compaction. Attack transcripts are created by copying the honest transcript, manually inserting tool calls, and then regenerating compaction summaries with a neutral prompt so they faithfully reflect the inserted content.
They compared seven monitoring strategies using three monitors—GPT-6 Luna, MiniMax M3, and DeepSeek V4.1 Flash—with each monitor's threshold set to flag 5% of honest sessions. The baseline intervals-only strategy divides the transcript at each compaction point into independent intervals, scores each separately, and keeps the highest score as the session score, simulating a monitor running live alongside the agent.
The annotated history strategy shares the same interval-by-interval scoring foundation as the baseline but allows the monitor to flag specific suspicious actions and carry those flags forward into the prompt when scoring subsequent intervals, thereby connecting an early setup to a later execution.
The core result: annotated history catches 93% of attacks on average across the three monitors, while the intervals-only baseline catches 73%. Annotated history is the only strategy that beats the baseline with every monitor, achieving at least 87% catch rate on each.
Per-monitor breakdown shows the intervals-only baseline varies enormously—Luna catches only 40% while DeepSeek reaches 94%—whereas annotated history catches at least 87% across all monitors. Luna's low baseline rate stems from it flagging two additional honest sessions as highly suspicious, which raises the threshold, rather than from weaker detection of actual attacks.
Compaction summaries alone are the weakest strategy, catching only 45% of attacks. The authors note that compaction summaries are lossy by design and are often generated by the untrusted model driving the main agent, making them unreliable for recording potentially malicious actions. The whole-transcript strategy, while useful as a reference, cannot scale—it must process the entire million-token session and faces the same distributed-attack vulnerability at longer lengths.
Results have clear boundaries. With only 30 pairs, the authors acknowledge that many differences are statistically too small to call, which is why they adopted a 5% FPR rather than the 1–2% standard in other control work. Additionally, some attacks are flagged not because the monitor identified the attack intent but because the injected edits appear structurally out of place.
Dataset size is constrained by generation cost: each honest transcript requires approximately $80 at API rates and takes 40–80 minutes, and the attack injection process is non-deterministic, requiring multiple attempts to find structurally natural edit positions.
The practical value of this work is an operational monitoring architecture principle: when agent sessions cross compaction boundaries, monitors should not score each interval independently and take the highest score, but should maintain a queue of suspicious flags during sequential processing, passing anomalies discovered in earlier intervals into the scoring context of later ones. This mechanism allows the monitor to connect an early setup that appears harmless with a later execution that appears normal. The dataset, generation pipeline, and monitoring code are open-sourced.