Your Agent is More Brittle Than You Think: Uncovering Indirect Injection Vulnerabilities in Agentic LLMs

Wenhui Zhu; Xuanzhao Dong; Xiwen Chen; Rui Cai; Peijie Qiu; Zhipeng Wang; Oana Frunza; Shao Tang

cs.CLApr 4, 2026

Your Agent is More Brittle Than You Think: Uncovering Indirect Injection Vulnerabilities in Agentic LLMs

Authors: Wenhui Zhu, Xuanzhao Dong, Xiwen Chen, Rui Cai, Peijie Qiu, Zhipeng Wang, Oana Frunza, Shao Tang, +2 more

Organizations: Arizona State University · Morgan Stanley · UC Davis · Washington University in St. Louis · Rice University · Florida State University · University of Oxford

Abstract

The rapid deployment of open-source frameworks has significantly advanced the development of modern multi-agent systems. However, expanded action spaces, including uncontrolled privilege exposure and hidden inter-system interactions, pose severe security challenges. Specifically, Indirect Prompt Injections (IPI), which conceal malicious instructions within third-party content, can trigger unauthorized actions such as data exfiltration during normal operations. While current security evaluations predominantly rely on isolated single-turn benchmarks, the systemic vulnerabilities of these agents within complex dynamic environments remain critically underexplored. To bridge this gap, we systematically evaluate six defense strategies against four sophisticated IPI attack vectors across nine LLM backbones. Crucially, we conduct our evaluation entirely within dynamic multi-step tool-calling environments to capture the true attack surface of modern autonomous agents. Moving beyond binary success rates, our multidimensional analysis reveals a pronounced fragility. Advanced injections successfully bypass nearly all baseline defenses, and some surface-level mitigations even produce counterproductive side effects. Furthermore, while agents execute malicious instructions almost instantaneously, their internal states exhibit abnormally high decision entropy. Motivated by this latent hesitation, we investigate Representation Engineering (RepE) as a robust detection strategy. By extracting hidden states at the tool-input position, we revealed that the RepE-based circuit breaker successfully identifies and intercepts unauthorized actions before the agent commits to them, achieving high detection accuracy across diverse LLM backbones. This study exposes the limitations of current IPI defenses and provides a highly practical paradigm for building resilient multi-agent architectures.

Figures & tables

Figure 1: Example overview of the experimental framework based on the AgentDojo ( Debenedetti et al., 2024 ) Banking suite. (A) illustrates the system environment and global state, including representative metadata such as account profiles and transaction histories. (B) shows the task schema, encompassing legitimate user objectives, available tool functions, and the adversarial injection payloads. (C) delineates the end-to-end execution trace. See more details in Sec. 3.1 .

Figure 2: Vulnerability analysis of LLM agents (e.g., Qwen-2.5-14B) under four distinct Indirect Prompt Injection (IPI) attacks. (A) illustrates the attack success metrics, quantified by the Hijack Rate across diverse scenarios. (B) characterizes the linguistic patterns observed in successful hijacking cases. We categorize these failures into four distinct behaviors: Immediate , where the agent complies without detectable reasoning; Heading , where the agent expresses uncertainty yet follows the injection; Rationalized , where the agent acknowledges the injection or deceptively frames the malicious action as part of the legitimate task; and Reluctant , where the agent exhibits verbal resistance but ultimately executes the hijacked command. These categories are identified via fixed-syntax filtering of the reasoning traces following corrupted tool-call results.

Model	Attack Vulnerability %		Behavior Analysis %		Linguistic Analysis %		Model Confidence
Model	Hijack $\downarrow$	Utility $\uparrow$	Diverge $\downarrow$	Immed. $\downarrow$	Resist $\uparrow$	S-Immed. $\downarrow$	LogP $\uparrow$	Entropy $\downarrow$
Qwen-14B	97.40	62.50	34.58	98.35	6.24	66.13	-0.164	0.345
Qwen-32B	97.22	56.25	35.18	99.68	8.75	61.25	-0.129	0.136
Qwen3-4B	96.01	31.25	8.86	100.00	7.05	82.64	-0.063	0.210
Qwen3-8B	91.15	50.00	10.67	95.24	6.48	84.57	-0.055	0.118
Qwen3-14B	81.94	37.50	14.41	98.63	4.45	79.87	-0.047	0.194

Table 1: LLM bottleneck performance under four categories of IPI attacks. Notably, while the attack vulnerability level accounts for all test scenarios, the remaining three dimensions focus exclusively on hijacked failure cases. All metrics are expressed as percentages, with the exception of model confidence level. The best results for each metric are indicated in bold.

Figure 3: Illustration of three LLM performance bottlenecks across four IPI attacks. (A) depicts the number of assistant turns elapsed between the receipt of the injection and the execution of the malicious action. (B) and (C) present violin plots comparing the distributions of decision entropy in natural log units and mean log-probability, respectively, as they evolve across execution turns. The shaded regions represent $\pm 1$ standard deviation.

Model: Qwen-2.5-14B
Defense Strategy	Direct	Ignore Prev.	InjecAgent	Stealth	Overall $\downarrow$
No Defense (Baseline)	100.00	97.92	91.67	100.00	97.40
Prompt Warning	100.00	100.00	98.61	100.00	99.65
Spotlighting	100.00	100.00	95.14	100.00	98.78
Keyword Filtering	100.00	99.31	94.44	100.00	98.44
Sandwich	99.31	100.00	99.31	98.61	99.31

Table 2: Defense Strategy Effectiveness on Qwen-2.5-14B, Qwen-3-14B and Mistral-7B, respectively. Hijack rates (%) are reported here for visual clarity. Best results are bolded .

		Probing			Cosine Similarity
Model	Layer	AUC-ROC	AUPRC	TPR@FPR5%	AUC-ROC	AUPRC	TPR@FPR5%
Qwen-14B	31	0.9997	0.9997	100%	0.8705	0.8997	66.28%
Qwen-32B	53	1.0000	1.0000	100%	0.8379	0.8836	70.11%
Qwen3-4B	4	0.9912	0.9915	93.39%	0.9968	0.9970	96.00%
Qwen3-8B	22	0.9963	0.9961	97.39%	0.8866	0.9025	63.77%
Qwen3-14B	18	0.9931	0.9939	97.12%	0.7594	0.7869	51.19%

Table 3: Illustration of Probing and Cosine Similarity (RepE) methods for hijacking detection at the tool-input position. We utilize the baseline (i.e., no-defense) configuration as the source for collecting base trajectories across each LLM backbone. Our analysis is restricted to trajectories exhibiting the desired format (e.g., those containing the <tool_call> token), employing an 80/20% training and testing split. The primary evaluation metrics include AUC-ROC, AUPRC, and TPR@FPR5%. Please refer to Sec. 3.3 for a comprehensive analysis.

Figure 4: Performance evaluation of Qwen3-8B in hijacking detection experiments utilizing both Representation Engineering (RepE) methods. (A) displays the Receiver Operating Characteristic (ROC) curve, and (B) illustrates the Precision-Recall (PR) curve.

		Probing			Cosine Similarity
Model	Position	AUC-ROC	AUPRC	TPR@FPR5%	AUC-ROC	AUPRC	TPR@FPR5%
Qwen-14B	Function Call	0.9850	0.9851	86.92%	0.7027	0.6365	6.98%
Qwen-14B	Tool Input	0.9997	0.9997	100.0%	0.8705	0.8997	66.28%
Qwen3-14B	Function Call	0.8456	0.8626	53.00%	0.5933	0.6191	32.14%
Qwen3-14B	Tool Input	0.9931	0.9939	97.12%	0.7594	0.7869	51.19%
LLaMA3-8B	Function Call	0.8934	0.9084	66.96%	0.8958	0.9046	69.57%

Table 4: Ablation study of detection positions across diverse LLM backbones within the agent execution pipeline.

Explore similar work

ICON: Indirect Prompt Injection Defense for Agents based on Inference-Time Correction
Feb 24, 2026Che Wang, Fuyao Zhang, Jiaming Zhang +6Prompt Injection Defense AI Agent Security
School of Computer Science, Peking University, China · College of Computing and Data Science, Nanyang Technological University, Singapore · Ant Group +1
AdapTools: Adaptive Tool-based Indirect Prompt Injection Attacks on Agentic LLMs
Feb 24, 2026Che Wang, Jiaming Zhang, Ziqi Zhang +6Indirect Prompt Injection Prompt Injection Attacks
School of Computer Science, Peking University, China · College of Computing and Data Science, Nanyang Technological University, Singapore · Ant Group
AgentSentry: Mitigating Indirect Prompt Injection in LLM Agents via Temporal Causal Diagnostics and Context Purification
Feb 26, 2026Tian Zhang, Yiwei Xu, Juan Wang +8Prompt Injection Defense Prompt Injection Attacks on AI Agents
Key Laboratory of Aerospace Information Security and Trusted Computing, Ministry of Education, School of Cyber Science and Engineering, Wuhan University, Wuhan 430072, China · Department of Computer Science and Engineering, University at Buffalo, SUNY · Department of Computer Science, College of Information Science and Technology, Jinan University, Guangzhou 510632, China +1

Feb 24, 2026J/K move · Enter open · S save

ICON: Indirect Prompt Injection Defense for Agents based on Inference-Time Correction

Che Wang, Fuyao Zhang, Jiaming Zhang, Ziqi Zhang+5

School of Computer Science, Peking University, China · College of Computing and Data Science, Nanyang Technological University, Singapore · Ant Group+1

Prompt Injection Defense AI Agent Security Prompt Injection Detection Inference-Time Intervention

Open paper AskPDF arXiv

Large Language Model (LLM) agents are susceptible to Indirect Prompt Injection (IPI) attacks, where malicious instructions in retrieved content hijack the agent's execution. Existing defenses typically rely on strict filtering or refusal mechanisms, which suffer from a critical limitation: over-refusal, prematurely terminating valid agentic workflows. We propose ICON, a probing-to-mitigation framework that neutralizes attacks while preserving task continuity. Our key insight is that IPI attacks leave distinct over-focusing signatures in the latent space. We introduce a Latent Space Trace Prober to detect attacks based on high intensity scores. Subsequently, a Mitigating Rectifier performs surgical attention steering that selectively manipulate adversarial query key dependencies while amplifying task relevant elements to restore the LLM's functional trajectory. Extensive evaluations on multiple backbones show that ICON achieves a competitive 0.4% ASR, matching commercial grade detectors, while yielding a over 50% task utility gain. Furthermore, ICON demonstrates robust Out of Distribution(OOD) generalization and extends effectively to multi-modal agents, establishing a superior balance between security and efficiency.

Abstract

Explore similar work

ICON: Indirect Prompt Injection Defense for Agents based on Inference-Time Correction

AdapTools: Adaptive Tool-based Indirect Prompt Injection Attacks on Agentic LLMs

AgentSentry: Mitigating Indirect Prompt Injection in LLM Agents via Temporal Causal Diagnostics and Context Purification