What Is Context Isolation?
Context isolation is the practice of splitting an AI agent's work so that separate parts run in separate context windows, or of holding information where the model cannot see it until a step needs it. The most common form gives each sub-agent its own window and returns only a condensed result to a coordinating agent. Isolation limits what each model call sees. It does not isolate the external data those calls read and write.
Updated
What is context isolation?
LangChain's Context Engineering post (July 2025) groups common strategies into four buckets, write, select, compress and isolate: "Isolating context involves splitting it up to help an agent perform a task." It names three forms. Multi-agent systems give each sub-agent its own tools, instructions and context window. Environments, such as a code sandbox, hold token-heavy objects outside the model and pass back only selected results. And a runtime state object can expose one field, such as the message list, to the model while keeping other fields out of view.
Drew Breunig calls the same tactic context quarantine in How to Fix Your Context: "the act of isolating contexts in their own dedicated threads, each used separately by one or more LLMs." He adds a limit: "Problems that require context-sharing among multiple agents aren't particularly suited to this tactic."
An older, separate sense comes from security. Simon Willison's Dual LLM pattern (April 2023) pairs a Privileged LLM that has tools with a Quarantined LLM that "is used any time we need to work with untrusted content." The goal there is resisting prompt injection, not saving tokens.
How context isolation works
Anthropic's multi-agent research system is a well-documented example. A lead agent plans and starts subagents that operate "in parallel with their own context windows, exploring different aspects of the question simultaneously before condensing the most important tokens for the lead research agent." Anthropic's context engineering guide adds that a subagent "might explore extensively, using tens of thousands of tokens or more, but returns only a condensed, distilled summary of its work (often 1,000-2,000 tokens)."
A worked sequence, illustrative:
- 1.The lead agent receives "compare the refund policies of 12 merchants" and writes a plan.
- 2.It starts four subagents, each with three merchants, a search tool and a narrow prompt.
- 3.Each subagent reads pages in its own window and returns a short summary.
- 4.The lead's window holds the task, the plan and four summaries, not the raw pages.
Isolation shrinks each window, not the total bill. Anthropic reports that in its data "multi-agent systems use about 15× more tokens than chats."
A direct objection comes from Cognition. In Don't Build Multi-Agents (June 2025), Walden Yan argues for two principles: "Share context, and share full agent traces, not just individual messages," and "Actions carry implicit decisions, and conflicting decisions carry bad results." In his example, two subagents building parts of a Flappy Bird clone return pieces built on conflicting assumptions. Isolation works best when subtasks are independent and mostly read-only, as in research. It works worst when subagents make choices the others depend on.
Why context isolation matters in real-time systems
Separate windows are not separate state. Isolated subagents often read and write the same outside systems, such as a spending limit or a customer account. Two subagents can each check a shared limit inside their own clean window, each see room for their action, and each act. That is multi-writer contention, a concurrency problem in the data layer, and no arrangement of prompts fixes it.
Timing is the second issue. Each subagent reads its sources at a different moment, so the summaries the lead combines can describe different versions of a fast-changing fact. For research, that rarely matters. For a decision that gates on current values, re-read them when the decision runs rather than trust a summary. Coordination patterns for agents that share state are covered in agent coordination.
FAQ
Related terms
Context offloading moves information out of an LLM's context window into external storage, such as files or notes, and pulls it back only when a step needs it.
Context compression reduces tokens in a language model's context while keeping what the task needs, by summarizing, pruning, trimming or compressing prompts.
A token budget limits how many tokens an LLM call or agent task may use: how the context window is split, how much output and reasoning, and total spend.
Context poisoning is when a hallucination or other error enters a language model's context and is referenced again on later turns, so the mistake compounds.
Multi-writer contention is two or more actors reading and writing the same mutable state in the same short window. It is not multi-tenancy or partitioning.
Shared context means every service and agent in a decision system reads one internally coherent snapshot of state, instead of private copies that diverge.