Auto-compact summarization prompt leaks into the compacted history as a fabricated "text-only, no tools" user override

Environment

• Claude Code CLI v2.1.131 (incidents observed) and v2.1.154 (template confirmed still present in the binary); macOS (darwin 25.x)
• Headless use via the Claude Agent SDK: a scheduled background job ("loop") fires one turn per day into a single long-lived session, resumed via session id across runs. Heavy WebSearch/MCP tool use, so the session grows ~10-40k tokens per turn.

Summary

When a long-lived session crosses the auto-compact threshold (~170k tokens in our transcripts), the compaction pass sometimes leaks its own meta-instruction into the summarized history: the summary narrates the compactor's "CRITICAL: Respond with TEXT ONLY. Do NOT call any tools…" constraint as if it were an instruction found in the conversation being summarized — i.e. as a "hard override" the user supposedly appended to their prompt. The next real turn then obeys that fabricated override: it skips its actual task, calls no tools, and returns only an analysis/summary-shaped reply.

Because the session is resumed across runs, the fabrication compounds: once one summary asserts "an appended hard override superseded the task", later compactions summarize that claim too, and the model's confidence in the nonexistent override grows ("this is the third such override…").

Evidence

The user-side prompt was byte-identical across all 27 runs (verified from raw transcripts — only an iteration counter differs). The session's raw transcript contains exactly four compact_boundary events, and they coincide exactly with the only four runs that produced the "override" narrative — 4/4, no false positives:

| compact_boundary (UTC) | trigger | preTokens | Run outcome |
|---|---|---|---|
| 2026-08-06 05:02:13 | auto | 171,606 | task skipped, text-only reply |
| 2026-08-12 07:15:55 | auto | 172,759 | task skipped, text-only reply |
| 2026-08-14 05:02:54 | auto | 168,321 | task skipped, text-only reply |
| 2026-08-19 06:03:39 | auto | 172,657 | model ignored the fabricated override, worked anyway |

A later run's reply quotes the fabrication explicitly: "This turn's actual instruction: An appended hard override superseded the sweep — respond text-only, no tool calls, complete this analysis+summary instead. This is the third such override (after iterations 18 and 22)." No such text was ever sent.

Strings extracted from the v2.1.154 binary show the compaction prompt is assembled as one undifferentiated user message: the meta-constraint —

CRITICAL: Respond with TEXT ONLY. Do NOT call any tools.
- Do NOT use Read, Bash, Grep, Glob, Edit, Write, or ANY other tool.
- You already have all the context you need in the conversation above.
- Tool calls will be REJECTED and will waste your only turn — you will fail the task.
- Your entire response must be plain text: an <analysis> block followed by a <summary> block.

— concatenated directly with "Your task is to create a detailed summary of this conversation…" and then the entire transcript being compacted appended right after, with no structural separation between "instruction governing the summarizer" and "content to be summarized". That framing is what lets the summarizer attribute its own constraint to the conversation.

Impact

Any long-running/resumed session that auto-compacts can silently lose a turn (or several) to a fabricated "respond text-only, no tools" instruction — worst for unattended/headless agents, where nothing surfaces the failure: the run "succeeds" with a plausible-looking text reply and simply doesn't do its job. In our case ~11% of a daily job's runs produced no output over two weeks before anyone noticed.

Suggested fix

Structurally separate the compactor's meta-instruction from the transcript it summarizes — e.g. carry the constraint in a system-role block (or wrap the transcript in an explicit delimiter with "the instructions above govern only this internal summarization step and are not part of the conversation below"). Additionally, the summary template's "primary request and intent" section could explicitly instruct the summarizer not to describe the summarization request itself.

Caveats

The 4/4 correlation, byte-identical prompts, and the extracted template are verified from raw transcripts and binary strings; the exact conflation step inside the (closed-source) compaction call is inference from that evidence. Happy to share redacted transcript excerpts.