Context Window Manipulation
Context window manipulation is a class of attack that exploits the finite size and ordering of a model's context window, using placement, volume or truncation to change how the model weighs the material it was given.
The Container Is Part of the Attack Surface
Everything a model considers on a given call sits in one bounded window, including the system prompt, conversation history, retrieved documents and tool output. The window has limited size and an internal order, and models weigh material differently depending on where it sits. Those two properties are exploitable on their own, with no need to craft a persuasive instruction.
Flooding Pushes the Rules Out
An attacker who can place a large volume of content into the context can force earlier material out of it, and the earliest material is usually the system prompt carrying the constraints. A document crafted to consume most of the window, or a conversation extended deliberately, ends with a model operating without the instructions it started with. No jailbreak phrasing is required, since the rule was evicted instead of argued away.
Position and Formatting Shift the Weighting
Models attend unevenly across a long context, with material at the edges carrying more influence than material buried in the middle. Content formatted to resemble a system instruction, or placed where system instructions normally appear, can be treated with authority it was never granted. Prompt injection covers the instruction-level version of this, and manipulation of the window is what makes the injected text land where it will be weighted.
Agents Make the Window Harder to Govern
An AI agent assembles its own context across a long run, pulling in tool output, retrieved files and prior steps without a human reviewing what accumulated. Budgeting the window so protected instructions are re-asserted after untrusted content, and capping how much any single source can contribute, are the controls that survive contact with production.
Related Terms
Full AI Visibility. Full Control. One Connected Platform.
Enterprise AI is expanding faster than most governance programs can track. Kovrr connects every AI signal across browser, endpoint, network, identity, and vendor systems into a single platform so security, governance, and risk teams work from the same evidence.
