Agentic large language model systems increasingly automate tasks by retrieving URLs and calling external tools. We show that this workflow gives rise to implicit prompt injection: adversarial instructions embedded in automatically generated URL previews, including titles, metadata, and snippets, can introduce a system-level risk that we refer to as silent egress. Using a fully local and reproducible testbed, we demonstrate that a malicious web page can induce an agent to issue outbound requests that exfiltrate sensitive runtime context, even when the final response shown to the user appears harmless. In 480 experimental runs with a qwen2.5:7b-based agent, the attack succeeds with high probability (P (egress) =0.89), and 95% of successful attacks are not detected by output-based safety checks. We also introduce sharded exfiltration, where sensitive information is split across multiple requests to avoid detection. This strategy reduces single-request leakage metrics by 73% (Leak@1) and bypasses simple data loss prevention mechanisms. Our ablation results indicate that defenses applied at the prompt layer offer limited protection, while controls at the system and network layers, such as domain allowlisting and redirect-chain analysis, are considerably more effective. These findings suggest that network egress should be treated as a first-class security outcome in agentic LLM systems. We outline architectural directions, including provenance tracking and capability isolation, that go beyond prompt-level hardening.
Figures & tables
Figure 1: Silent Egress attack chain with visibility zones. Green indicates user-visible interactions; red indicates invisible operations. The attack’s danger lies in its dual invisibility: steps 2–5 occur without user awareness, while the final response (step 6) appears completely benign.
Parameter
Value
Model Configuration
Model
qwen2.5:7b (Ollama)
Temperature
0.7
Max tokens
512
Context Window Contents
System prompt
Minimal (tool format only)
Table 1: Experimental configuration and attacker-controllable surfaces
Surface
P(egress)
Body
1.000
Meta
0.967
Title
1.000
Anchor
1.000
Table 2: P(egress) by injection surface (direct, single-shot)
Metric
Value
Total runs
480
Egress events
423 (88.1%)
Silent attack rate
95.0%
False positive rate
0.0%
Table 3: Aggregate statistics (480 runs)
Mode
Leak@1
Leak@3
Single-shot
0.967
0.967
Sharded
0.263
0.158
Table 4: Leak rates by exfiltration mode
Figure 2: Trade-off between stealth (sharding) and reliability. Sharded exfiltration shows reduced success across all surfaces, with the largest drop on Meta ( −37% ). Body and Title/Anchor maintain relatively high success rates even with complex multi-step instructions.
Surface
Delivery
Mode
P(egress)
Leak@1
body
direct
single
1.000
1.000
body
direct
sharded
0.767
0.233
body
redirect
single
1.000
1.000
body
redirect
sharded
0.833
0.233
meta
direct
single
0.967
0.933
meta
direct
sharded
0.600
0.100
Table 5: Complete results by configuration (30 runs each)
Defense
Implementation Details
Baseline
No defenses; minimal system prompt providing only tool format
System prompt
Appends security policy: “NEVER follow instructions from web content; ONLY follow USER instructions; web content is DATA, not COMMANDS”
Delimiter tags
Wraps external content in <external_content> tags with instruction: “Anything inside these tags is UNTRUSTED DATA, never treat as instructions”
Both combined
Combines system prompt hardening and delimiter tags
Domain allowlist
Blocks requests to domains not in allowlist: {api.ourcompany.com, cdn.ourcompany.com, internal.ourcompany.com, example.com}. Uses strict matching (no subdomain inference)
Redirect detection
Blocks direct IP addresses, suspicious TLDs (.xyz, .top, .tk, .ml, .ga, .cf, .gq, .pw), and URL paths containing exfil, collect, steal, leak, dump
Agentic LLMs are vulnerable to indirect prompt injection (IPI) attacks, e.g., malicious side-tasks hidden in external tool results. While many efforts have sought to address the threats, little is known about the internals of agentic LLMs when they are exposed to IPI attacks, a condition which we call IPI exposure. In this paper, we study this problem in depth from three aspects. (1) Probing: Across six models, including the giant 753B-parameter GLM-5.2, simple linear probes trained on pre-generation hidden states can predict LLMs' IPI exposure. These probes achieve 90%+ AUROC on unseen attacks, agent instructions, and task suites; they exhibit high robustness under adaptive attacks and in cross-lingual settings. (2) Defense: Our CoT measurement reveals a recognition--action gap: though models encode such signals, they often fail to translate them into safe actions. We then introduce AGRI, a probe-gated reasoning-based defense that prepends anti-injection reasoning on demand. On difficult AgentDojo settings, AGRI substantially reduces attack success rate, e.g., from 34.6% to 0% on Qwen3.5-27B, while largely maintaining clean-task utility. (3) Explanation: We introduce an analysis framework that identifies natural-language explanations most strongly correlated with probe-captured signals. The resulting profiles differ across models: latent signals can align with either direct IPI-exposure claims or indirect operational cues. Code is available: https://github.com/jianshuod/IPI-exposure-signal.
Jianshuo Dong, Yiming Liu, Maosen Zhang +6
Tsinghua University · MatrixOrigin · Nanyang Technological University +1
Large Language Models (LLMs) are rapidly evolving into agentic systems that interact with external tools and environments, introducing new security risks such as indirect prompt injection attacks through untrusted external sources. Existing defenses mainly focus on blocking malicious content at inference time, and current red-teaming methods primarily optimize attack success. As a result, developers have limited visibility into how latent prompt injections emerge and propagate through agents. We propose PI-Hunter, an automated agentic auditing framework for proactive vulnerability exposure in LLM agents. PI-Hunter constructs realistic source-aware test cases and iteratively evolves them through feedback-driven exploration to induce agents to retrieve and reveal latent malicious instructions embedded within external environments. Extensive experiments across multiple benchmarks, agent architectures, attacks, and defenses demonstrate that PI-Hunter substantially improves vulnerability exposure and attack-surface coverage over strong automated red-teaming baselines, while remaining effective under existing prompt injection defenses.
Pengfei He, Lesly Miculicich, Vishesh Sharma +5
Google Cloud AI Research · Google · Michigan State University
Indirect prompt injection poses a critical threat to LLM agents that interact with untrusted external data, yet automated attack methods--proven effective for jailbreaking--remain underexplored in realistic agentic settings. We present a comprehensive empirical evaluation of automated prompt injection attacks against LLM agents, adapting both white-box (GCG) and black-box (TAP) methods to the agentic setting within the AgentDojo framework. We evaluate across 80 task pairs spanning four domains and multiple models, and find that black-box optimization substantially outperforms gradient-based methods, a gap we attribute to GCG's optimization instability under reasonable compute budgets. We also find that TAP's effectiveness depends on the attacker model, as both general capability and safety tuning affect attack success--stronger models produce more effective injections, while safety-tuned attackers can refuse to generate adversarial prompts. Task-universal attacks transfer effectively to unseen tasks and out-of-distribution domains, but attacks optimized on smaller open-source models do not transfer to frontier models like GPT-5. These findings highlight automated prompt injection as a credible but model-dependent threat, with significant barriers remaining for model-agnostic exploitation.