What is context poisoning, and how do you stop it?
Context poisoning is what happens when an agent's context window fills with wrong, stale, or badly shaped data and the agent reasons off it. The fix sits upstream of the model: control what reaches the window, because a single badly shaped API call can burn tens of thousands of tokens before the agent starts the work you asked for.
Context ManagementAgent MemoryAI Agents
1. The failure is upstream of the model
Airbyte co-founder Michel Tricot’s thesis is that agents do not fail because the models are bad. They fail because the data feeding them is wrong. Swapping in a stronger model does nothing about that, which is why teams keep upgrading and keep getting the same class of failure. Context poisoning is the name for the input problem, and it is a data-engineering problem wearing an AI costume.
2. Raw API access is usually the cause
Tricot demonstrated it live. Gong’s API does not let you filter calls by user, so an agent asked for one person’s recent calls has no choice but to page through lists. A query as ordinary as “retrieve all calls since February 1” burned about 30,000 extra tokens and took three minutes, most of it spent pulling pages the agent did not need. Nothing was malicious and nothing was broken. The API was simply not shaped for an agent, and the agent paid for that in context window.
3. The precision cost is worse than the token cost
The token cost is the visible half. The expensive half is that a window stuffed with near-duplicate, low-signal records leaves the model uncertain about what to prioritize. You get an agent that had the right answer available and did not weight it. That failure looks like a reasoning failure in a trace, which is what sends teams off to evaluate models instead of inputs.
4. Put something between the agent and the systems
Tricot’s answer is a context store: a layer that centralizes and pre-shapes data from source systems so the agent queries a store built for retrieval instead of paging an API built for a web app. The pattern he runs internally is hybrid: discovery and understanding through search over the store, and a direct API call when the task needs the freshest record. The decision to make deliberately is which reads have to be live, because that is the one that costs context.
Why it matters
Most agent debugging starts at the model and works backward. Start at the input instead: log what actually entered the window on a failed run. If the answer is 30,000 tokens of paginated list, no model upgrade will fix it.
From the conversation
This explainer is drawn from these episodes — each carries its full transcript.
