LLM based agents are increasingly deployed in high stakes settings where they process external data sources such as emails, documents, and code repositories. This creates exposure to indirect prompt injection attacks, where adversarial instructions embedded in external content manipulate agent behavior without user awareness. A critical but underexplored dimension of this threat is concealment: since users tend to observe only an agent's final response, an attack can conceal its existence by presenting no clue of compromise in the final user facing response while successfully executing harmful actions. This leaves users unaware of the manipulation and likely to accept harmful outcomes as legitimate. We present findings from a large scale public red teaming competition evaluating this dual objective across three agent settings: tool calling, coding, and computer use. The competition attracted 464 participants who submitted 272000 attack attempts against 13 frontier models, yielding 8648 successful attacks across 41 scenarios. All models proved vulnerable, with attack success rates ranging from 0.5% (Claude Opus 4.5) to 8.5% (Gemini 2.5 Pro). We identify universal attack strategies that transfer across 21 of 41 behaviors and multiple model families, suggesting fundamental weaknesses in instruction following architectures. Capability and robustness showed weak correlation, with Gemini 2.5 Pro exhibiting both high capability and high vulnerability. To address benchmark saturation and obsoleteness, we will endeavor to deliver quarterly updates through continued red teaming competitions. We open source the competition environment for use in evaluations, along with 95 successful attacks against Qwen that did not transfer to any closed source model. We share model-specific attack data with respective frontier labs and the full dataset with the UK AISI and US CAISI to support robustness research.
Figures & tables
Figure 1: ASR by model across the competition (wave 1 and wave 2) in decreasing order. ASR is computed by successful attacks / total attempts.
Benchmark
Indirect
Concealment
Tool
Code
CUA
Updates
AgentDojo
✓
×
✓
×
×
×
InjecAgent
✓
×
✓
×
×
×
ART (prior)
✓
×
✓
×
×
×
AgentHarm
×
×
✓
×
×
×
OS-Harm
✓
×
×
×
✓
×
WASP
✓
×
×
×
✓
×
Table 1: Comparison of existing agent security benchmarks.
Figure 2: Overview of Indirect Prompt Injection Arena. An attacker embeds malicious instructions in external data sources (emails, code files, webpages) that the agent processes during task execution. Successful attacks must satisfy a dual objective: execute the harmful action and conceal the fact of being compromised in the final agent response. We evaluate this threat across three agent settings: tool use, coding, and computer use.
Figure 3: Example scenario. A user asks their assistant to check for urgent emails. The injection point is indicated by {fill} in the spoofed marketing email’s content within the tool output. The injection instructs the agent to mark a critical deadline email as read and exclude it from the summary. The right side shows a successful attack: the agent executes the harmful action while presenting a benign email summary to the user.
Figure 4: Cumulative successful attacks per model as a function of attempts. Break counts increase approximately linearly for all models, indicating that the ratio of successful breaks to total attempts remains roughly constant throughout the competition rather than diminishing or increasing over time. Total breaks per model shown in parentheses.
Setting
ASR
95% CI
Tool Use
4.82%
[4.68%, 4.96%]
Computer Use
3.13%
[2.96%, 3.31%]
Coding
2.51%
[2.41%, 2.62%]
Table 2: ASR breakdown by agentic setting.
Figure 5: ASR by agentic setting for each model. Three bars per model represent tool use (solid), coding (hatched), and computer use (dotted). Models without image support (SecAlign 70B, DeepSeek V3.1, Kimi K2 Thinking) lack computer use bars. Models are ordered by decreasing overall ASR.
Figure 6: Transfer ASR by target model. Each model is evaluated against the full benchmark of 2,679 curated attacks. Annotations show total attacks tested and successful attacks.
Indirect prompt injection poses a critical threat to LLM agents that interact with untrusted external data, yet automated attack methods--proven effective for jailbreaking--remain underexplored in realistic agentic settings. We present a comprehensive empirical evaluation of automated prompt injection attacks against LLM agents, adapting both white-box (GCG) and black-box (TAP) methods to the agentic setting within the AgentDojo framework. We evaluate across 80 task pairs spanning four domains and multiple models, and find that black-box optimization substantially outperforms gradient-based methods, a gap we attribute to GCG's optimization instability under reasonable compute budgets. We also find that TAP's effectiveness depends on the attacker model, as both general capability and safety tuning affect attack success--stronger models produce more effective injections, while safety-tuned attackers can refuse to generate adversarial prompts. Task-universal attacks transfer effectively to unseen tasks and out-of-distribution domains, but attacks optimized on smaller open-source models do not transfer to frontier models like GPT-5. These findings highlight automated prompt injection as a credible but model-dependent threat, with significant barriers remaining for model-agnostic exploitation.
Large Language Models (LLMs) are rapidly evolving into agentic systems that interact with external tools and environments, introducing new security risks such as indirect prompt injection attacks through untrusted external sources. Existing defenses mainly focus on blocking malicious content at inference time, and current red-teaming methods primarily optimize attack success. As a result, developers have limited visibility into how latent prompt injections emerge and propagate through agents. We propose PI-Hunter, an automated agentic auditing framework for proactive vulnerability exposure in LLM agents. PI-Hunter constructs realistic source-aware test cases and iteratively evolves them through feedback-driven exploration to induce agents to retrieve and reveal latent malicious instructions embedded within external environments. Extensive experiments across multiple benchmarks, agent architectures, attacks, and defenses demonstrate that PI-Hunter substantially improves vulnerability exposure and attack-surface coverage over strong automated red-teaming baselines, while remaining effective under existing prompt injection defenses.
Pengfei He, Lesly Miculicich, Vishesh Sharma +5
Google Cloud AI Research · Google · Michigan State University
LLM-based agents are increasingly deployed for complex tasks requiring planning, tool use, and interaction with external services. Their reliance on untrusted external content exposes them to indirect prompt injection (IPI), in which adversarial instructions embedded in retrieved data hijack agent behavior. Existing attacks rely on static payloads that cannot adapt to agent-specific defenses; even recent adaptive methods lack structured feedback to guide optimization. We introduce \oursys, a feedback-guided iterative framework that closes the loop between injection, diagnosis, and refinement: a rule-based diagnoser produces structured outcome labels with behavioral descriptions, and an LLM-based optimizer refines payloads conditioned on the full optimization history. A synthesis step generates new disguise seeds from failure patterns, enabling the strategy space to self-evolve. On AgentDojo and InjectAgent, \oursys substantially outperforms static baselines and existing adaptive methods across four victim models. Extension experiments on Claude Code, a production-grade coding agent with layered defenses, show that optimized payloads achieve full success on 5 of 9 targets; even those that resist full exploitation exhibit measurable improvement from iterative refinement. We further present a mechanistic analysis of IPI, identifying an attention-mediated threshold mechanism in mid-to-late layers; three causal interventions validate this finding and point to concrete defense directions.
Zixuan Chen, Jiaxiang Chen, Li Luo +4
1Shanghai Jiao Tong University · 2The University of Hong Kong