An attacker does not need a clever jailbreak when they can make the model stop reading the system prompt through sheer volume. The vulnerability is architectural: every transformer has non-uniform attention. The position where security instructions live is precisely where models attend least.
Context window size has always been framed as a capability feature. Larger windows mean more memory, more documents, more conversation history. What research from 2023 to 2026 documents is the inverse: larger windows expand the attack surface for context flooding. Agents that process adversary-supplied content of arbitrary length can have system prompt influence reduced to near-zero without a single malicious instruction.
Attention Is Not Uniform: the Dead Zone Is Deterministic
Liu et al. 2023 (arXiv:2307.03172) established the reference pattern: LLMs reach peak performance at the start and end of context. Significant degradation occurs in the middle. The U-shaped curve holds even for models designed explicitly for long contexts.
arXiv:2605.12922 quantified the collapse with causal ablation on Mistral. On a 20-fact retention task, recall dropped from near-perfect to 11% when facts were placed in the middle of context. This is not gradual degradation. It is collapse.
This behavior is not a bug. It is how causal attention works across transformer layers. The layer where attention encoding emerges varies from 2 to 27 across architectures. No universally safe token threshold exists.
The security corollary is direct: agents that process external content without hard size limits can have their system prompt displaced into the dead zone. No malicious instruction is required.
Context Flooding: Volume Is the Attack, Not the Instruction
Classic prompt injection introduces a competing instruction: “ignore the above and do X.” Context flooding needs no adversarial instruction. The payload is the absence of influence, not an alternative command.
Three documented operational variants:
Padding: blocks of benign text inserted between the system prompt and the target instruction. The original prompt survives in context but loses effective attention weight. The DeepTeam framework uses 4,000 characters as the conservative minimum in its standard red-team cases.
Relevance flooding: legitimate, on-task content forces model processing. The actual attack instruction sits at the end of context, where the recency effect works in the attacker’s favor. The model processes apparently valid material while executing what was strategically positioned.
Tool result flooding: in multi-turn agents, verbose output from legitimate tools accumulates each turn. The system prompt gradually shifts into the dead zone with no adversarial instruction at any point in the session.
A 50,000-token document from an untrusted source is sufficient to mount this attack without a single adversarial word. The content does not need to be malicious. It needs to be voluminous.
Three Attack Surfaces Specific to Agentic Pipelines
Agentic pipelines with persistence, long-term memory, and multi-agent orchestration multiply the vector in three concrete directions. Single-turn applications have no equivalent for any of the three.
ToolFlood (arXiv:2603.13950): the attacker crafts tool descriptions with embeddings close to those of legitimate tools. The retrieval system ranks attacker tools above the legitimate ones, and legitimate tools never enter the agent’s context. The MetaTool benchmark recorded 97.2% top-k domination and attack success rates between 94.6% and 99.6% across 18 LLM selectors. The agent operates with its toolbox replaced without detecting the swap.
MINJA (arXiv:2601.05504): malicious content enters via memory retrieval queries, not direct prompt construction. The injection success rate reaches 95% and the attack success rate 70%. The vector persists with pre-existing legitimate memories in the store. The model does not distinguish the origin of memories retrieved with high similarity.
LogInject (arXiv:2607.14493): the 12,847-entry log benchmark documented the most concrete operational consequence. A crafted PowerShell log entry caused a production XDR platform to describe Mimikatz credential theft as “scheduled maintenance.” The model reproduced the injected phrasing verbatim in its analysis output. Security analysts acted on the AI-generated summary, not the raw log.
The pattern is consistent: the more the pipeline depends on automatically retrieved external content, the larger the attack surface grows.
Measured Degradation: No Default Safe Token Count Exists
arXiv:2507.06850 tested 18 models across three attack classes. Results: 94.4% succumbed to direct prompt injection, 83.3% to RAG backdoor, and 100% to inter-agent trust exploitation.
The inter-agent finding is critical for multi-agent architectures. The same payload blocked when sent directly to a model executes when it arrives from a peer agent. The inter-agent trust layer nullifies most controls applied to external inputs.
arXiv:2508.07479 documented that positional biases worsen as context approaches the window limit. The attack improves near saturation, not at a fixed threshold. No token count exists where the system prompt is safe regardless of total session volume.
Architecture variance complicates any policy built around a specific product. The layer where attention encoding emerges varies from 2 to 27. A threshold calibrated for one model does not transfer to another. Any policy that depends on a specific model’s positional behavior does not survive a model swap.
The MAGO Intel tool (intel.mago.team) measures context consumption patterns in agent deployments, identifying agents that process unbounded external content without hard token limits. That configuration makes context flooding attacks trivially repeatable.
Context Budgets Are a Security Control, Not a Cost Optimization
OWASP LLM10:2025 classifies context window flooding as a security vulnerability requiring architectural controls. The classification replaces LLM04:2024 Model Denial of Service. The risk has moved from availability to integrity.
Five controls with direct security rationale:
Hard token limits on external input: if the agent processes user-supplied documents, cap at 8,000 tokens per input. Inputs over the limit return an explicit error, not silent truncation.
Structured context zones: system prompt at position 0 and repeated at the end. Repeating at the end exploits the recency effect of the U-shaped curve, the exact mechanism attackers use, now applied defensively. This eliminates dead zone risk for critical instructions.
Input normalization: external documents reduced to plain text before processing. Markdown, HTML, and verbose logs inflate token count without adding semantic content.
Memory hygiene: memory writes require source credentialing. Content retrieved from uncredentialed memory does not trigger high-consequence actions.
HITL for high-stakes actions: actions triggered by recently retrieved content require human approval. This gate breaks the flooding to action chain that LogInject demonstrated against production XDR platforms.
The Attention Tracker (arXiv:2411.00348) showed that detection via attention pattern monitoring achieves a 10% AUROC improvement without additional inference cost. Active monitoring of context consumption is not overhead. It is the instrument that makes flooding detectable before it produces effect.
Context is the agent’s nervous system. When the system prompt becomes background noise, the controls that depend on instructions positioned within it collapse together, silently and without a log entry. Treat context budget the way you treat an API rate limit. Hard limits per agent class, structured zones with privilege boundaries, active monitoring for anomalous context growth.