In short: As long-context agents compress their memory, attackers exploit compactions using split attacks to bypass static checks. Stateful security monitoring that carries threat flags across these memory shifts is now a critical defence for enterprise AI.
Where We Are
Stateful security monitoring is the practice of tracking and annotating an AI agent’s memory history across multiple interactions to detect fragmented malicious intent. The enterprise transition from passive chatbots to autonomous coding agents introduces an entirely new attack surface. To function within computational limits and manage the high costs of inference, long-context agents must periodically compress their internal memories. This operational necessity creates a massive blind spot for enterprise security teams who still rely on standard firewall rules and static prompt scanning.
According to a recent analysis, Catching split attacks across compactions in long-context coding agents, this vulnerability is already being targeted. Attackers exploit memory compaction by deploying “split attacks”—deliberately dividing malicious instructions into harmless-looking, fragmented pieces. These individual fragments bypass standard security checks upon entry because they contain no inherently dangerous syntax. They only execute later when the agent autonomously stitches them together during a memory compaction cycle. The research introduces the LCM dataset to evaluate different monitoring strategies against this specific threat. The findings prove that an annotated history strategy, which essentially functions as stateful security monitoring, successfully catches 93% of these fragmented malicious actions in long-context agents.
The Forces at Play
Stateful security monitoring fundamentally changes how we evaluate and govern AI risk. Traditional enterprise security architectures are largely stateless when it comes to API gateways and web application firewalls. They inspect an incoming request, determine if it contains a known signature or malicious intent, and either block or allow the traffic. But an autonomous AI agent is not a stateless endpoint; it is a reasoning engine that builds context, formulates plans, and executes actions over extended temporal windows.
In a typical enterprise deployment, an AI agent is rarely isolated. It is deeply integrated into core business workflows, holding active permissions to query internal databases, update customer relationship management systems, or commit code to production repositories. If an attacker feeds a coding agent a benign function definition on Monday, and a similarly benign execution trigger on Tuesday, a stateless scanner sees two perfectly safe interactions. The agent, however, combines them on Wednesday during a compaction cycle, executing a payload that was never scanned in its complete, assembled form.
This temporal gap is the core force driving the need for new enterprise security paradigms. As organisations scale their Agentic Process Automation, these agents are granted progressively deeper access to critical infrastructure. The high financial and computational cost of running these long-context workflows forces engineering teams to implement aggressive memory compression and summarisation techniques. Every time an agent summarises its history to save tokens, the original input text is transformed into a condensed semantic representation. If security flags and risk scores do not travel with the semantic meaning of that text, the enterprise loses all visibility into what the agent is actually preparing to do. A Chief Information Security Officer cannot sign off on an autonomous system if the system’s own memory optimisation routine actively hides malicious intent from the corporate audit logs.
Scenarios for Stateful Security Monitoring
As this threat vector becomes more widely understood by both attackers and enterprise defenders, corporate adoption of stateful security monitoring will likely follow one of three trajectories over the next eighteen months.
Base case: The patchwork defence Most organisations continue to treat autonomous agents like simple conversational models, applying standard API gateways and basic prompt scanners to secure them. As these agents scale into complex, long-running tasks, split attacks successfully execute because the security layer lacks temporal awareness. The result is a series of high-profile, silent breaches where agents autonomously execute malicious code or exfiltrate intellectual property. These incidents prompt sudden, board-mandated freezes on enterprise AI rollouts, destroying executive trust in automation and setting digital transformation timelines back by years.
Accelerated: Native orchestration security Leading enterprises recognise the limits of static scanning and mandate stateful security monitoring directly at the orchestrator level. Instead of scanning inputs statelessly, the system annotates the agent’s memory history, carrying forward suspicion flags even when the underlying token context is compressed. This approach mirrors the 93% success rate demonstrated against the LCM dataset. Security evolves into a continuous, context-aware process that moves at the speed of the agent’s reasoning, allowing the business to deploy complex, long-context AI workloads without compromising governance or compliance.
Stalled: The return to walled gardens Fearing the complexity of securing autonomous systems against sophisticated split attacks, conservative risk and compliance teams enforce hard limits on agent context windows and maximum task durations. Agents are heavily restricted to stateless, single-turn operations that reset immediately after a single query. While this blunt approach eliminates the compaction vulnerability, it also severely limits the return on investment. The enterprise remains trapped in the era of basic chatbots, trailing far behind AI-native competitors who have successfully solved the stateful monitoring challenge.
What to Watch
Enterprise leadership teams must monitor the evolution of open-source agent frameworks and commercial AI gateways. The critical signpost will be when these platforms shift from offering external, point-in-time scanners to natively integrating stateful tracking and annotated histories. Furthermore, executives should closely observe how regulatory frameworks adapt to autonomous capabilities. EU AI Governance mandates already require robust risk management and human oversight mechanisms for high-risk systems. As regulators fully recognise the unique threat of split attacks, the requirement for continuous, state-aware audit trails across long-context sessions will transition from a recommended best practice to a strict compliance mandate.
Aaron Ranson, Chief AI Officer: «Static prompt scanning is obsolete the moment an agent has memory. If your enterprise security controls forget operational context faster than your agent does, you are flying blind.»
FAQ
Q: What is an AI split attack? A: A split attack occurs when a malicious actor divides a harmful instruction into several benign-looking fragments. These fragments bypass static security scanners individually and are only later combined by the AI agent’s memory processes to execute the malicious payload.
Q: How does AI memory compaction work? A: Long-context agents periodically compress their operational history to save computational memory and token costs. This summarisation process can stitch together previously fragmented inputs, inadvertently creating a new, dangerous context that was never explicitly scanned by the security layer.
Q: What is stateful security monitoring for AI? A: Stateful security monitoring tracks an agent’s context continuously over time. By annotating the agent’s history and carrying suspicion flags across memory compactions, it evaluates the aggregated intent of the agent rather than just looking at isolated, single-turn inputs.
Q: Why do standard firewalls fail against autonomous agents? A: Standard web application firewalls and API gateways are inherently stateless. They scan individual requests at a single point in time, making them incapable of detecting a threat that only materialises days later when an agent combines multiple benign inputs into a single malicious action.
Our Take
At Thinkia, we view stateful security monitoring not merely as a technical patch, but as a foundational architectural requirement for any organisation deploying autonomous systems. You cannot govern an AI agent if you cannot govern its memory. The data clearly demonstrates that an annotated history strategy works, effectively neutralising the vast majority of fragmented payloads before they can execute. This shift demands a new level of collaboration between enterprise security teams and AI engineers—security can no longer be an external wrapper applied after the fact; it must be woven directly into the cognitive architecture of the agent itself.
We build the AI systems companies actually run, which means designing orchestration layers that handle this stateful tracking natively. Through Thinkia Synapse — our unified agentic platform for AI governance, security and cost control: orchestrate agents, models and workflows — enterprises ensure that their security context is preserved exactly as long as their operational context. By securely carrying threat flags across memory compactions, we enable businesses to scale long-context agents safely, perfectly aligning advanced autonomous capabilities with the stringent risk controls demanded by the C-suite.