An agent investigating a security alert needs relevant evidence and a reliable record of its work. Anthropic’s September 29, 2025 context-engineering guide provides useful engineering patterns for that problem.
Its central recommendation is to curate the information available at each step: instructions, retrieved material, tool results and history. Keeping everything indefinitely can introduce noise; aggressive summarization can discard details needed later.
Keep evidence reachable
For a concrete starting point, give an alert-triage agent the current question, investigation scope and references to relevant logs. Retrieve the time range or records needed for its next decision. Retain source locations so an analyst can revisit the evidence.
Before compressing a long session, preserve confirmed findings, unresolved questions, decisions and the next action in a compact working note. Distinguish observations from hypotheses. Check that the agent can recover the evidence behind a conclusion after resuming.
Measure what context changes
Chroma’s July 14, 2025 Context Rot study evaluated 18 models and reported increasingly unreliable performance as input length grew in its controlled tasks. That is evidence against assuming uniform long-context performance. It does not establish a universal token threshold or predict how a current deployment will perform on incident response.
Evaluate a context change against a fixed set of representative tasks. Compare answer accuracy, evidence retrieval, latency and cost. Include a case with conflicting records and one requiring a fact from an earlier step. A shorter input is useful only if the agent still reaches the supported conclusion.
Keep authorization outside the context
Retrieved documents may contain instructions planted by an attacker. OWASP’s prompt-injection guidance recommends separating trusted instructions from untrusted material while warning that labels and prompt wording do not enforce a security boundary. Validate tool parameters and the caller’s permissions in application code, restrict privileges and require approval for consequential actions.
For the alert-triage example, start with read-only access to the relevant logs. An instruction inside a log entry must not authorize blocking an account. Any proposed change should pass a separate check of the action, target and authority. Preserve the origin of external claims in working notes so a later summary does not silently turn them into trusted directions.
