Your Agent is More Brittle Than You Think: Uncovering Indirect Injection Vulnerabilities in Agentic LLMs

Wenhui Zhu; Xuanzhao Dong; Xiwen Chen; Rui Cai; Peijie Qiu; Zhipeng Wang; Oana Frunza; Shao Tang

cs.CLApr 4, 2026

Your Agent is More Brittle Than You Think: Uncovering Indirect Injection Vulnerabilities in Agentic LLMs

Authors: Wenhui Zhu, Xuanzhao Dong, Xiwen Chen, Rui Cai, Peijie Qiu, Zhipeng Wang, Oana Frunza, Shao Tang, +2 more

Organizations: Arizona State University · Morgan Stanley · UC Davis · Washington University in St. Louis · Rice University · Florida State University · University of Oxford

Abstract

The rapid deployment of open-source frameworks has significantly advanced the development of modern multi-agent systems. However, expanded action spaces, including uncontrolled privilege exposure and hidden inter-system interactions, pose severe security challenges. Specifically, Indirect Prompt Injections (IPI), which conceal malicious instructions within third-party content, can trigger unauthorized actions such as data exfiltration during normal operations. While current security evaluations predominantly rely on isolated single-turn benchmarks, the systemic vulnerabilities of these agents within complex dynamic environments remain critically underexplored. To bridge this gap, we systematically evaluate six defense strategies against four sophisticated IPI attack vectors across nine LLM backbones. Crucially, we conduct our evaluation entirely within dynamic multi-step tool-calling environments to capture the true attack surface of modern autonomous agents. Moving beyond binary success rates, our multidimensional analysis reveals a pronounced fragility. Advanced injections successfully bypass nearly all baseline defenses, and some surface-level mitigations even produce counterproductive side effects. Furthermore, while agents execute malicious instructions almost instantaneously, their internal states exhibit abnormally high decision entropy. Motivated by this latent hesitation, we investigate Representation Engineering (RepE) as a robust detection strategy. By extracting hidden states at the tool-input position, we revealed that the RepE-based circuit breaker successfully identifies and intercepts unauthorized actions before the agent commits to them, achieving high detection accuracy across diverse LLM backbones. This study exposes the limitations of current IPI defenses and provides a highly practical paradigm for building resilient multi-agent architectures.

Figures & tables

Figure 1: Example overview of the experimental framework based on the AgentDojo ( Debenedetti et al., 2024 ) Banking suite. (A) illustrates the system environment and global state, including representative metadata such as account profiles and transaction histories. (B) shows the task schema, encompassing legitimate user objectives, available tool functions, and the adversarial injection payloads. (C) delineates the end-to-end execution trace. See more details in Sec. 3.1 .

Figure 2: Vulnerability analysis of LLM agents (e.g., Qwen-2.5-14B) under four distinct Indirect Prompt Injection (IPI) attacks. (A) illustrates the attack success metrics, quantified by the Hijack Rate across diverse scenarios. (B) characterizes the linguistic patterns observed in successful hijacking cases. We categorize these failures into four distinct behaviors: Immediate , where the agent complies without detectable reasoning; Heading , where the agent expresses uncertainty yet follows the injection; Rationalized , where the agent acknowledges the injection or deceptively frames the malicious action as part of the legitimate task; and Reluctant , where the agent exhibits verbal resistance but ultimately executes the hijacked command. These categories are identified via fixed-syntax filtering of the reasoning traces following corrupted tool-call results.

Model	Attack Vulnerability %		Behavior Analysis %		Linguistic Analysis %		Model Confidence
Model	Hijack $\downarrow$	Utility $\uparrow$	Diverge $\downarrow$	Immed. $\downarrow$	Resist $\uparrow$	S-Immed. $\downarrow$	LogP $\uparrow$	Entropy $\downarrow$
Qwen-14B	97.40	62.50	34.58	98.35	6.24	66.13	-0.164	0.345
Qwen-32B	97.22	56.25	35.18	99.68	8.75	61.25	-0.129	0.136
Qwen3-4B	96.01	31.25	8.86	100.00	7.05	82.64	-0.063	0.210
Qwen3-8B	91.15	50.00	10.67	95.24	6.48	84.57	-0.055	0.118
Qwen3-14B	81.94	37.50	14.41	98.63	4.45	79.87	-0.047	0.194

Table 1: LLM bottleneck performance under four categories of IPI attacks. Notably, while the attack vulnerability level accounts for all test scenarios, the remaining three dimensions focus exclusively on hijacked failure cases. All metrics are expressed as percentages, with the exception of model confidence level. The best results for each metric are indicated in bold.

Figure 3: Illustration of three LLM performance bottlenecks across four IPI attacks. (A) depicts the number of assistant turns elapsed between the receipt of the injection and the execution of the malicious action. (B) and (C) present violin plots comparing the distributions of decision entropy in natural log units and mean log-probability, respectively, as they evolve across execution turns. The shaded regions represent $\pm 1$ standard deviation.

Model: Qwen-2.5-14B
Defense Strategy	Direct	Ignore Prev.	InjecAgent	Stealth	Overall $\downarrow$
No Defense (Baseline)	100.00	97.92	91.67	100.00	97.40
Prompt Warning	100.00	100.00	98.61	100.00	99.65
Spotlighting	100.00	100.00	95.14	100.00	98.78
Keyword Filtering	100.00	99.31	94.44	100.00	98.44
Sandwich	99.31	100.00	99.31	98.61	99.31

Table 2: Defense Strategy Effectiveness on Qwen-2.5-14B, Qwen-3-14B and Mistral-7B, respectively. Hijack rates (%) are reported here for visual clarity. Best results are bolded .

		Probing			Cosine Similarity
Model	Layer	AUC-ROC	AUPRC	TPR@FPR5%	AUC-ROC	AUPRC	TPR@FPR5%
Qwen-14B	31	0.9997	0.9997	100%	0.8705	0.8997	66.28%
Qwen-32B	53	1.0000	1.0000	100%	0.8379	0.8836	70.11%
Qwen3-4B	4	0.9912	0.9915	93.39%	0.9968	0.9970	96.00%
Qwen3-8B	22	0.9963	0.9961	97.39%	0.8866	0.9025	63.77%
Qwen3-14B	18	0.9931	0.9939	97.12%	0.7594	0.7869	51.19%

Table 3: Illustration of Probing and Cosine Similarity (RepE) methods for hijacking detection at the tool-input position. We utilize the baseline (i.e., no-defense) configuration as the source for collecting base trajectories across each LLM backbone. Our analysis is restricted to trajectories exhibiting the desired format (e.g., those containing the <tool_call> token), employing an 80/20% training and testing split. The primary evaluation metrics include AUC-ROC, AUPRC, and TPR@FPR5%. Please refer to Sec. 3.3 for a comprehensive analysis.

Figure 4: Performance evaluation of Qwen3-8B in hijacking detection experiments utilizing both Representation Engineering (RepE) methods. (A) displays the Receiver Operating Characteristic (ROC) curve, and (B) illustrates the Precision-Recall (PR) curve.

		Probing			Cosine Similarity
Model	Position	AUC-ROC	AUPRC	TPR@FPR5%	AUC-ROC	AUPRC	TPR@FPR5%
Qwen-14B	Function Call	0.9850	0.9851	86.92%	0.7027	0.6365	6.98%
Qwen-14B	Tool Input	0.9997	0.9997	100.0%	0.8705	0.8997	66.28%
Qwen3-14B	Function Call	0.8456	0.8626	53.00%	0.5933	0.6191	32.14%
Qwen3-14B	Tool Input	0.9931	0.9939	97.12%	0.7594	0.7869	51.19%
LLaMA3-8B	Function Call	0.8934	0.9084	66.96%	0.8958	0.9046	69.57%

Table 4: Ablation study of detection positions across diverse LLM backbones within the agent execution pipeline.

Explore similar work

Feb 24, 2026

ICON: Indirect Prompt Injection Defense for Agents based on Inference-Time Correction

Large Language Model (LLM) agents are susceptible to Indirect Prompt Injection (IPI) attacks, where malicious instructions in retrieved content hijack the agent's execution. Existing defenses typically rely on strict filtering or refusal mechanisms, which suffer from a critical limitation: over-refusal, prematurely terminating valid agentic workflows. We propose ICON, a probing-to-mitigation framework that neutralizes attacks while preserving task continuity. Our key insight is that IPI attacks leave distinct over-focusing signatures in the latent space. We introduce a Latent Space Trace Prober to detect attacks based on high intensity scores. Subsequently, a Mitigating Rectifier performs surgical attention steering that selectively manipulate adversarial query key dependencies while amplifying task relevant elements to restore the LLM's functional trajectory. Extensive evaluations on multiple backbones show that ICON achieves a competitive 0.4% ASR, matching commercial grade detectors, while yielding a over 50% task utility gain. Furthermore, ICON demonstrates robust Out of Distribution(OOD) generalization and extends effectively to multi-modal agents, establishing a superior balance between security and efficiency.

Che Wang, Fuyao Zhang, Jiaming Zhang +6

School of Computer Science, Peking University, China · College of Computing and Data Science, Nanyang Technological University, Singapore · Ant Group +1

Prompt Injection Defense AI Agent Security Prompt Injection Detection Inference-Time Intervention

Ask PDF

Feb 24, 2026

AdapTools: Adaptive Tool-based Indirect Prompt Injection Attacks on Agentic LLMs

The integration of external data services (e.g., Model Context Protocol, MCP) has made large language model-based agents increasingly powerful for complex task execution. However, this advancement introduces critical security vulnerabilities, particularly indirect prompt injection (IPI) attacks. Existing attack methods are limited by their reliance on static patterns and evaluation on simple language models, failing to address the fast-evolving nature of modern AI agents. We introduce AdapTools, a novel adaptive IPI attack framework that selects stealthier attack tools and generates adaptive attack prompts to create a rigorous security evaluation environment. Our approach comprises two key components: (1) Adaptive Attack Strategy Construction, which develops transferable adversarial strategies for prompt optimization, and (2) Attack Enhancement, which identifies stealthy tools capable of circumventing task-relevance defenses. Comprehensive experimental evaluation shows that AdapTools achieves a 2.13 times improvement in attack success rate while degrading system utility by a factor of 1.78. Notably, the framework maintains its effectiveness even against state-of-the-art defense mechanisms. Our method advances the understanding of IPI attacks and provides a useful reference for future research.

Che Wang, Jiaming Zhang, Ziqi Zhang +6

School of Computer Science, Peking University, China · College of Computing and Data Science, Nanyang Technological University, Singapore · Ant Group

Indirect Prompt Injection Prompt Injection Attacks Prompt Injection Attacks on AI Agents AI Agent Security

Ask PDF

Feb 26, 2026

AgentSentry: Mitigating Indirect Prompt Injection in LLM Agents via Temporal Causal Diagnostics and Context Purification

Large language model (LLM) agents increasingly rely on external tools and retrieval systems to autonomously complete complex tasks. However, this design exposes agents to indirect prompt injection (IPI), where attacker-controlled context embedded in tool outputs or retrieved content silently steers agent actions away from user intent. Unlike prompt-based attacks, IPI unfolds over multi-turn trajectories, making malicious control difficult to disentangle from legitimate task execution. Existing inference-time defenses primarily rely on heuristic detection and conservative blocking of high-risk actions, which can prematurely terminate workflows or broadly suppress tool usage under ambiguous multi-turn scenarios. We propose AgentSentry, a novel inference-time detection and mitigation framework for tool-augmented LLM agents. To the best of our knowledge, AgentSentry is the first inference-time defense to model multi-turn IPI as a temporal causal takeover. It localizes takeover points via controlled counterfactual re-executions at tool-return boundaries and enables safe continuation through causally guided context purification that removes attack-induced deviations while preserving task-relevant evidence. We evaluate AgentSentry on the AgentDojo benchmark across four task suites, three IPI attack families, and multiple black-box LLMs. AgentSentry eliminates successful attacks and maintains strong utility under attack, achieving an average Utility Under Attack (UA) of 74.55 %, improving UA by 20.8 to 33.6 percentage points over the strongest baselines without degrading benign performance.

Tian Zhang, Yiwei Xu, Juan Wang +8

Key Laboratory of Aerospace Information Security and Trusted Computing, Ministry of Education, School of Cyber Science and Engineering, Wuhan University, Wuhan 430072, China · Department of Computer Science and Engineering, University at Buffalo, SUNY · Department of Computer Science, College of Information Science and Technology, Jinan University, Guangzhou 510632, China +1

Prompt Injection Defense Prompt Injection Attacks on AI Agents LLM Agent Safety

Ask PDF