What is context poisoning, and how do you stop it?

1. The failure is upstream of the model

Airbyte co-founder Michel Tricot’s thesis is that agents do not fail because the models are bad. They fail because the data feeding them is wrong. Swapping in a stronger model does nothing about that, which is why teams keep upgrading and keep getting the same class of failure. Context poisoning is the name for the input problem, and it is a data-engineering problem wearing an AI costume.

2. Raw API access is usually the cause

Tricot demonstrated it live. Gong’s API, as used in the demo, does not let you filter calls by user, so an agent asked for one person’s recent calls has no choice but to page through lists. A query as ordinary as “retrieve all calls since February 1” burned about 30,000 extra tokens, and run that way it normally takes about three minutes, most of it spent pulling pages the agent did not need. Nothing was malicious and nothing was broken. The API was simply not shaped for an agent, and the agent paid for that in context window.

3. The precision cost is worse than the token cost

The token cost is the visible half. The expensive half is that a window stuffed with near-duplicate, low-signal records leaves the model uncertain about what to prioritize. You get an agent that had the right answer available and did not weight it. That failure can look like a reasoning failure in a trace, which can send teams off to evaluate models instead of inputs.

4. Put something between the agent and the systems

Tricot’s answer is a context store: a layer that centralizes and pre-shapes data from source systems so the agent queries a store built for retrieval instead of paging an API built for a web app. The pattern he runs internally is hybrid: discovery and understanding through search over the store, and a direct API call when the task needs the freshest record. The decision to make deliberately is which reads have to be live; for those, fetch the one record by ID rather than paging through a list.

Why it matters

Most agent debugging starts at the model and works backward. Start at the input instead: log what actually entered the window on a failed run. If the answer is 30,000 tokens of paginated list, no model upgrade will fix it.