History-aware monitors catch more attacks after agent context compaction
Long-context coding agents can split an attack across context resets, but a monitor that carries suspicious tool-call flags between intervals caught 93% of attacks, versus 73% when each interval was scored alone. The LCM dataset contains 30 matched honest and attack sessions, each 1.00 to 1.46 million tokens with four compactions. The attack’s setup appears early and its execution later, testing whether monitoring can connect events separated by hundreds of tool calls.