Context Window Stuffing Attack
AI models can only 'remember' a limited amount of text at once, called a context window. This attack floods that window with repetitive or filler text so the model's original safety instructions get pushed out and are effectively forgotten.
How the attack works
An attacker feeds the AI agent a large volume of repetitive, padded, or otherwise low-value text, either in one input or across a conversation. Because the context window has a fixed size, this filler content crowds out earlier material, including the system instructions that define what the model should and shouldn't do. Once those instructions fall out of the active window, the model no longer follows them and behaves as if the guardrails were never set. The attacker can then submit requests that would normally be blocked.
Netzilo detection
Netzilo can block this behaviour when it is observed.
- Signature ID
- b9d3a867-0c7e-4d4b-a9d8-3c6e1d8b7f50
- Severity
- High
Why it matters
An organization loses control over the AI agent's safety behavior without any single message looking obviously malicious, since each padding message may appear harmless on its own. This can lead to policy bypass, unauthorized actions, or disclosure of information the guardrails were meant to prevent.
What you can do
- →Set hard limits on input length and conversation length per session rather than relying only on the model's context window.
- →Re-inject or re-verify system instructions periodically during long conversations instead of only at the start.
- →Monitor for unusually repetitive, padded, or low-information-density inputs, especially in bursts.
- →Flag and review sessions where the same or near-identical text is submitted many times in a row.
Known benign look-alikes
- Legitimate stress tests or token budget calculations in development