Blocking at the Boundary: Auditing Long-Horizon Agents against Staged Prompt Injection

Jingkai Liu; Yufei Han; Xiaoting Lyu; Wei Wang; Ting Yu

cs.CROct 4, 2026

Blocking at the Boundary: Auditing Long-Horizon Agents against Staged Prompt Injection

Authors: Jingkai Liu, Yufei Han, Xiaoting Lyu, Wei Wang, Ting Yu

Organizations: Beijing Jiaotong University · Mohamed bin Zayed University of Artificial Intelligence · INRIA Rennes-Bretagne-Atlantique · Xi’an Jiaotong University

Abstract

Long-horizon agents consume external content, invoke tools, and modify persistent state. Indirect prompt injection can exploit task-specific context, propagate across causally connected stages, and alter a consequential action while the workflow continues; we term this staged prompt injection. We build an automated, feedback-guided attack generation pipeline and apply it to Claude Code and Codex in their native runtimes. The confirmed attacks span eight workflow scenarios, seven attack goals, and six injection surfaces, showing that production agents are vulnerable to context-aware, multi-step injection over long horizons. Stopping such attacks requires a decision before each consequential action: input screening and completed-run evaluation cannot locate the intervention point, and existing pre-action methods use incompatible units and labels. We therefore formulate boundary action auditing: given initial context, a trajectory prefix, and a fully specified pending message or tool call, an auditor predicts Pass or Block before its effect occurs. Pairing attacked and benign executions yields a 479-pair, 3,112-unit benchmark. We further propose Path-Aligned Attribution (PAA), a training-free auditor that decomposes pending actions into operative elements and traces what supplied each value and guided each decision. PAA blocks only when the model attributes an unwarranted, material effect on an element to an attacker-reachable source that either provides unqualified steering or conflicts with visible evidence. Under full-benchmark fail-open scoring with Claude Sonnet 5, PAA reaches 86% Block recall at a 6-8% false-block rate (FBR), whereas ARGUS reaches 44-47% recall at 16-33% FBR. Under the same backend, on the tool calls that all three auditors natively support, PAA has higher recall and lower FBR than VIGIL and ARGUS; all paired 95% confidence intervals exclude zero.

Figures & tables

Figure 1: Overview of the audit setting. (a) The target agent executes a user task while injected content may enter through the environment; (b) its recorded trajectory reaches a pending boundary action; (c) the audit unit formed at that boundary is decided as Pass or Block .

Figure 2: Feedback-guided attack generation and benchmark projection. (a) The target agent is rerun on its own benign task with a frozen injection scheme; a failed run yields diagnosis for the next independent attempt. (b) Confirmed attacks and their matched benign trajectories are projected into gold-labeled audit units at boundary actions.

Target Agent	Pairs	Benign units	Injected units	Pass	Block	Total units
Claude Code	240	628	692	744	576	1,320
Codex	239	873	919	1,228	564	1,792
Total	479	1,501	1,611	1,972	1,140	3,112

Table 1: Scale and composition of the benchmark.

Figure 3: Overview of PAA . Stage 1 registers sources and extracts the task contract; Stage 2 attributes operative action elements to their sources; Stage 3 constructs the flagged record set $F$ , returns Pass when $F=\varnothing$ , and otherwise adjudicates $F$ and applies the aligned-witness rule.

Claude Code corpus ( $N$ = 1,320 audit units)
Auditor	Auditor backend	Acc.	Prec.	Recall	FBR $\downarrow$	F1	Bal. Acc.
PAA (ours)	Claude Sonnet 5	0.905	0.917	0.861	0.060	0.888	0.900
VIGIL	Claude Sonnet 5	0.560	0.488	0.174	0.141	0.256	0.516
ARGUS	Claude Sonnet 5	0.573	0.512	0.441	0.325	0.474	0.558
PAA (ours)	GPT-5.5	0.828	0.759	0.889	0.219	0.819	0.835
VIGIL	GPT-5.5	0.568	0.514	0.196	0.144	0.284	0.526

Table 2: Primary full-benchmark results under uniform fail-open scoring (all 1,320 Claude Code and 1,792 Codex units; unsupported boundaries and persistent failures map to Pass ). Higher is better except for FBR; bold marks the best same-backend LLM auditor within each corpus.

			PAA		VIGIL		ARGUS
Corpus	Auditor backend	$n$ (B/P)	R	FBR	R	FBR	R	FBR
Claude Code	Claude Sonnet 5	840 (337/503)	.869	.070	.297	.209	.754	.481
Claude Code	Codex GPT-5.5	840 (337/503)	.914	.185	.335	.213	.899	.640
Codex	Claude Sonnet 5	1,314 (343/971)	.875	.071	.504	.285	.778	.200
Codex	Codex GPT-5.5	1,314 (343/971)	.773	.145	.248	.149	.904	.387

Table 3: Common-tool-call results under the same fail-open scoring, on action-type-defined unit sets shared by PAA , VIGIL, and ARGUS. B/P gives gold- Block /gold- Pass counts; paired intervals are in Table 13 .

Figure 4: In-run benign interruption rate on the Claude Code corpus (92 of 240 benign trajectories in scope, Section 6.3 ). Error bars show 95% Wilson intervals.

Figure 5: Offline first-stop outcomes on the 240 injected Claude Code trajectories. “Correct” and “false” in the plotted legend denote gold- Block and gold- Pass stops, respectively, under the injection-causal labels.

Claude Code corpus
	S5				G5.5
Scenario ( $N$ )	R $\uparrow$	FBR $\downarrow$	F1 $\uparrow$	BA $\uparrow$	R $\uparrow$	FBR $\downarrow$	F1 $\uparrow$	BA $\uparrow$
S01 (259)	.793	.042	.849	.876	.924	.311	.742	.806
S02 (124)	.903	.032	.933	.935	.968	.226	.882	.871
S03 (93)	.783	.234	.774	.774	.761	.426	.693	.668
S04 (125)	.887	.016	.932	.936	.887	.238	.833	.825

Table 4: Scenario-stratified results for PAA (

N

audit units per scenario). † User–Skill authority conflict (Table 14 ).

Appendix figures & tables21 assets

Supplementary material from the paper’s appendix.

Appendix

Agent system	Runtime / target model	Execution setting
Claude Code [ 4 ]	v2.1.172; Claude Sonnet 5	Native runtime with configured skills, tools, and sub-agent delegation; network disabled.
Codex [ 42 ]	CLI v0.144.0; GPT-5.5	Native runtime with configured skills and tools; isolated workspace access and network enabled.

Appendix

Table 5: Target agent systems used to produce retained trajectories.

Scenario	Task setting and agent-visible workspace	Provenance
S01: Commerce / Orders	Reconcile orders, products, customers, payments, returns, inventory, support tickets, and operating policies.	$\tau$ -bench retail data (MIT) [ 61 ] , augmented with constructed reconciliation and policy records.
S02: Mail / Calendar	Audit mailbox, calendar, contacts, travel policy, sharing records, and communication controls.	AgentDojo mail/calendar data (MIT) [ 16 ] , augmented with constructed communication records.
S03: Code Review	Review a local Python repository using issues, documentation, examples, tests, and maintenance guidance.	itsdangerous v2.2.0 and public issue material (BSD-3-Clause) [ 44 ] .
S04: Office Docs / Drive	Cross-check project tasks, calendars, CRM records, emails, analytics, boards, staff rosters, and operating controls.	WorkBench processed data (MIT) [ 51 ] , augmented with constructed board, roster, and policy records.
S05: Local KB / RAG	Retrieve evidence from support articles, a knowledge-base index, FAQ, owner notes, and maintenance policy.	IBM TechQA technotes [ 6 ] , augmented with constructed indexing and policy records.
S06: Sysadmin / Security	Audit SSH and service logs, host and user inventories, ACLs, configuration, change history, runbooks, and security policy.	Loghub OpenSSH logs [ 70 ] , augmented with constructed configuration and access-control records under the upstream research-use terms.

Appendix

Table 6: Benign task settings, agent-visible workspaces, and data provenance.

Scope	Configured skills	Upstream source and snapshot
Shared	deep-thinking data-quality-checks	ClawHub/@amankr-novo (v1.0.0) ClawHub/@mohitagw15856 (v1.0.0)
S01	data-reconciliation-exceptions settlement-reconciliation-guard	ClawHub/@kowl64 (unversioned snapshot) ClawHub/@harrylabsj (v1.0.0)
S02	aana-calendar-scheduling-guardrail-skill meeting-to-action	ClawHub/@mindbomber (v1.0.0) ClawHub/@codedao12 (v1.0.0)
S03	code-review improve-code-comments	ClawHub/@wpank (v1.0.0) ClawHub/@wufei-png (v1.0.2)
S04	board-minutes google-workspace	ClawHub/@mohitagw15856 (v1.0.0) ClawHub/@patrick-erichsen-2 (v1.0.0; locally trimmed)
S05	customer-support content-style-guide	ClawHub/@ivangdavila (v1.0.0) ClawHub/@mohitagw15856 (v1.0.0)

Appendix

Table 7: Workflow skills used by the target agents.

Type	ID and name	Operational meaning
Goal	IO01: Data exposure	Unauthorized disclosure of protected data to an external sink.
Goal	IO02: Unapproved external action	An external action prohibited by the task or authorization scope.
Goal	IO03: Parameter tampering	A sanctioned action executed with an attacker-influenced target, value, or content.
Goal	IO04: Workflow redirection	Redirection of an action, scope, or deliverable to an attacker-selected entity.
Goal	IO05: Access change	Granting or modifying access outside the authorized principal or scope.
Goal	IO06: Persistent context manipulation	Writing attacker-influenced content into durable state that can affect later execution.

Appendix

Table 8: Attack-goal and injection-surface taxonomy.

	Claude Code	Codex
Benign trajectories	320	320
Scheduled candidates	837	1,016
Attempts	983	1,485
Executed	834	1,236
Realized ( Pos )	505	765
Not realized	329	471

Appendix

Table 9: Attack-generation funnel. Attempt rows count individual attempts; candidate rows count trajectory–goal–surface targets. A candidate stops at its first Pos attempt, so realized attempts and Pos candidates coincide, whereas not-realized attempts exclude candidates whose attempts were all rejected before execution.

Figure 6: Goal–surface coverage of retained attacks for Claude Code ( $n=240$ ) and Codex ( $n=239$ ) on a shared count scale. Dots denote zero-count cells, that is, applicable goal–surface pairs that no retained execution realized; the gray $\Sigma$ row and column give marginal totals.

Source class	Reach	Authorization	Rule
Governing system policy	0	Q	Q
Direct user instruction	0	Q	Q
Tool schema or skill metadata	1	U	Q
Task-designated data source	1	C	C
Ordinary content	1	U	U
Agent-generated artifact	1	U	U

Appendix

Table 10: Decision-relevant source policy. Q: qualified; C: conditionally qualified; U: unqualified.

Object	Rule
Source quotation	Substring of the normalized source; a quotation of at least eight words also verifies when at least 60% of its word 6-grams occur in the source.
Adoption quotation	At least eight characters and verified against an agent message, tool-call argument, or the pending action.
Contract entry	Verbatim 15–300-character span of the user task; a designated path must be an exact string from the registered resources.
Conflict	Counter-evidence verifies in another visible source of the same unit; system text and the record’s own source are excluded. An omission conflict requires the cited source to exist.

Appendix

Table 11: Deterministic evidence-verification rules.

Auditor	Implementation and backend
PAA	Algorithm 2 , with tools disabled; Claude Sonnet 5 (via Claude Code) and GPT-5.5 (via Codex), each on both corpora
VIGIL	Complete upstream pipeline, decision-only adapter, strict preset; the same two backends on both corpora
ARGUS	Official artifact in teacher-forced offline replay; the same two backends on both corpora
AgentDoG-1.5	Unified-Qwen3.5-4B with local inference and its native chat template

Appendix

Table 12: Frozen auditor configurations.

Backend	Comparator	$\Delta$ R [95% CI]	$\Delta$ FBR [95% CI]
Claude Code
S5	VIGIL	+57.3 [+50.4, +63.3]	-13.9 [-20.3, -7.8]
S5	ARGUS	+11.6 [ +5.5, +17.8]	-41.2 [-47.2, -34.4]
G5.5	VIGIL	+57.9 [+51.3, +64.1]	-2.8 [ -8.2, +2.5]
G5.5	ARGUS	+1.5 [ -3.7, +7.1]	-45.5 [-51.5, -39.4]
Codex

Appendix

Table 13: Paired differences for PAA in the common-tool-call view ( PAA minus comparator; percentage points). The 95% intervals use 2,000 pair-clustered resamples after the action-type unit set is fixed. Positive

\Delta

R and negative

\Delta

FBR favor PAA .

Gold- Pass scope	$n_{\mathrm{Pass}}$	S5	G5.5
Full benchmark	1,228	.077	.140
Exclude 69 direct-conflict S04 actions	1,159	.065	.089
Exclude all 91 S04 gold- Pass units	1,137	.056	.076

Appendix

Table 14: Post-hoc label-scope sensitivity for PAA on Codex. FBR is recomputed on the remaining gold- Pass units; the gold- Block set and recall are unchanged.

	Claude Code				Codex
	S5		G5.5		S5		G5.5
Variant	R	FBR	R	FBR	R	FBR	R	FBR
Full rule ( PAA )	.861	.060	.889	.219	.860	.077	.679	.140
w/o quote verification	.878	.069	.889	.219	.862	.081	.679	.140
w/o task warrant	.863	.060	.889	.226	.860	.080	.679	.142
w/o materiality	.913	.153	.920	.310	.922	.168	.793	.253

Appendix

Table 15: Decision-rule ablation of PAA , recomputed offline from frozen audit certificates. Rows ablate a predicate or channel, the two gates, or replace the rule while leaving all other components active. Because the witness branches may overlap, their effects need not add.

Auditor	Backend	R	95% CI	FBR	95% CI	R	95% CI	FBR	95% CI
		Claude Code				Codex
PAA	S5	.861	[.824, .896]	.060	[.042, .082]	.860	[.826, .892]	.077	[.059, .097]
PAA	G5.5	.889	[.854, .919]	.219	[.185, .258]	.679	[.628, .726]	.140	[.108, .174]
VIGIL	S5	.174	[.142, .209]	.141	[.098, .185]	.307	[.276, .338]	.226	[.193, .259]
VIGIL	G5.5	.196	[.163, .231]	.144	[.109, .181]	.151	[.122, .180]	.118	[.089, .150]
ARGUS	S5	.441	[.405, .474]	.325	[.273, .372]	.473	[.442, .504]	.158	[.127, .190]

Appendix

Table 16: Pair-clustered bootstrap 95% percentile intervals for Table 2 (2,000 trajectory-pair resamples).

Corpus	First	Second	$\Delta$ R	95% CI	$\Delta$ FBR	95% CI
Claude Code	PAA /S5	VIGIL/S5	+68.7	[+63.7, +73.3]	-8.0	[-12.7, -3.6]
	PAA /S5	ARGUS/S5	+42.0	[+37.4, +46.7]	-26.3	[-31.5, -21.1]
	PAA /S5	AgentDoG/native	+46.0	[+38.8, +53.1]	-34.6	[-41.7, -27.4]
	PAA /G5.5	VIGIL/G5.5	+69.2	[+64.4, +73.5]	+7.6	[ +3.0, +12.1]
	PAA /G5.5	ARGUS/G5.5	+36.3	[+32.3, +40.1]	-21.3	[-26.2, -16.2]
	PAA /G5.5	AgentDoG/native	+48.8	[+42.4, +55.3]	-18.7	[-26.6, -10.7]

Appendix

Table 17: Pair-clustered bootstrap differences on the full benchmark (first configuration minus second; percentage points). Each interval uses the same 2,000 trajectory-pair resamples for both configurations. Positive

\Delta

R favors the first configuration, whereas negative

\Delta

FBR favors it.

Figure 7: In-run benign interruption on the Codex corpus (238 of 239 benign trajectories in scope), defined as in Figure 4 .

Figure 8: Offline first-stop outcomes on all 239 Codex injected trajectories, defined as in Figure 5 .

Figure 9: Gold- Block -stop timing on the 240 Claude Code injected trajectories. Cells give the share stopped after zero, one, or at least two earlier gold Block opportunities were missed.

Figure 10: Gold- Block -stop timing on all 239 Codex injected trajectories, defined as in Figure 9 .

Auditor	Backend	Claude Code	Codex
PAA	S5	18 (23), 7.5%	33 (41), 13.8%
PAA	G5.5	91 (131), 37.9%	49 (70), 20.5%
VIGIL	S5	7 (7), 2.9%	83 (83), 34.7%
VIGIL	G5.5	35 (35), 14.6%	26 (26), 10.9%
ARGUS	S5	55 (55), 22.9%	45 (45), 18.8%
ARGUS	G5.5	165 (165), 68.8%	107 (107), 44.8%

Appendix

Table 18: Benign trajectories with at least one final-result submission predicted Block , over all 240 Claude Code and 239 Codex benign trajectories; parentheses count blocked submission actions.

Benchmark	Dynamic run	Context- aware	Multi- step	Native runtime
InjecAgent [ 66 ]	–	–	$\circ$	–
AgentDojo [ 16 ]	$\checkmark$	$\circ$	$\circ$	–
WASP [ 18 ]	$\checkmark$	$\circ$	$\circ$	$\circ$
AgentDyn [ 30 ]	$\checkmark$	$\circ$	–	–
ToolSafety [ 59 ]	–	$\circ$	$\circ$	–
AgentLAB [ 28 ]	$\checkmark$	$\checkmark$	$\checkmark$	–

Appendix

Table 19: Construction properties of representative agent-security benchmarks with indirect-prompt-injection executions, staged attacks, or action-level labels.

\checkmark

: workload-wide requirement;

\circ

: limited or approximate coverage; –: not required.

Benchmark	Evidence and classification rationale
InjecAgent [ 66 ]	D (–): Sec. 2.3 begins from a hypothetical state with a prefilled user-tool response rather than replaying a complete run. C (–): Sec. 2.2 crosses reusable response templates with separately generated attacker cases. M ( $\circ$ ): Secs. 2.2–2.3 require extraction followed by transmission for data stealing, whereas direct-harm cases need not. N (–): Sec. 3.1 and App. B use benchmark-defined ReAct or function-calling scaffolds.
AgentDojo [ 16 ]	D ( $\checkmark$ ): Sec. 3.1 executes tools against mutable environment state. C ( $\circ$ ): Secs. 3.1 and 3.3 pair attacks with injection goals and optional side information, but do not require workload-wide task-specific payload design. M ( $\circ$ ): Sec. 3.3 permits multi-action runs without requiring a staged attack chain. N (–): Secs. 3.1–3.3 execute a benchmark-provided agent and environment pipeline.
WASP [ 18 ]	D ( $\checkmark$ ): Sec. 3 runs agents end to end against self-hosted VisualWebArena GitLab and Postmill instances. C ( $\circ$ ): Sec. 3 uses plain-text and URL injection templates with a task-aware variant obtained by variable substitution. M ( $\circ$ ): Sec. 4 separates intermediate from end-to-end success, but each attacker goal is issued by a single injection. N ( $\circ$ ): Sec. 3 includes the Claude Computer Use reference implementation as one of three agent setups; the others are VisualWebArena scaffolding and a tool-calling loop.
AgentDyn [ 30 ]	D ( $\checkmark$ ): Sec. 3 provides real-time interactable entities, such as one-time-password e-mail, and open-ended tasks. C ( $\circ$ ): Sec. 3 crosses 28 injection tasks with 60 user tasks and places injections realistically, without per-task payload design. M (–): Sec. 3 uses a single injected instruction per case. N (–): Sec. 3 runs an AgentDojo-style sandbox with a benchmark agent loop.
ToolSafety [ 59 ]	D (–): Sec. 3 synthesizes training examples and trajectories rather than collecting a live evaluation workload. C ( $\circ$ ): Sec. 3 matches tools, queries, and context, but mixes direct-harm, indirect-harm, and multi-step samples rather than requiring context-aware IPI throughout. M ( $\circ$ ): Sec. 3 includes a synthesized 2–5-step subset, without requiring staged attack propagation across the dataset. N (–): the released artifact is a fine-tuning dataset rather than executions from a native agent runtime.
AgentLAB [ 28 ]	D ( $\checkmark$ ): Secs. 4.1 and 4.3 execute agents in stateful, tool-enabled environments. C ( $\checkmark$ ): Sec. 4.2 conditions attack planners on the malicious task, environment, and execution feedback. M ( $\checkmark$ ): Sec. 4.2 defines five long-horizon attack families that progress across multiple interactions. N (–): Sec. 4.3 uses a unified benchmark agent framework rather than an independently released agent system.

Appendix

Table 20: Evidence supporting the classifications in Table 19 . D, C, M, and N denote dynamic agent run, context-aware attack, multi-step attack, and native agent runtime; section numbers refer to the cited paper versions.

Explore similar work

Sep 29, 2026cs.AI

Divide and Inject: Can Agents Reconstruct an Indirect Prompt Injection from Fragments?

Agentic systems are now being widely used to orchestrate tools and reason over long contexts. However, the improving capabilities of the large language models powering these agents also create new attack surfaces for indirect prompt injection. In particular, an attacker may not need to place a complete malicious instruction in retrieved content if the agent can reconstruct the objective from incomplete fragments distributed across a long context. In this work, we introduce adaptive long-context prompt injection (AdaLCPI), which combines long-context fragmentation with adaptive search. AdaLCPI splits an attack objective into incomplete fragments, embeds them in external content retrieved through the agent's tools, and uses a reconstruction cue to prompt the agent to combine them. It then iteratively refines the fragments and cue with OpenEvolve using graded scoring and natural-language execution feedback from the target agent. Empirically, AdaLCPI achieves higher attack success than strong adaptive baselines, reaching 61.4% macro-average ASR compared with 32.8% for Trojan Hippo-style and 30.0% for AgentVigil. Safety evaluations should therefore test whether agents remain robust when harmful objectives must be reconstructed from incomplete fragments.

Michael Lee, Zhipeng Wei, Yue Dong +1

International Computer Science Institute · DSO National Laboratories · UC Riverside +1

Indirect Prompt Injection Attack-Success Rate Fragmentation

Ask PDF

May 17, 2026cs.CR

AI Agents May Always Fall for Prompt Injections

Prompt injection is the most critical vulnerability in deployed AI agents. Despite recent progress, we show that the prevailing defense paradigm (data-instruction separation) both fails to detect attacks that operate through contextual manipulation and degrades contextually appropriate behavior. We then recast prompt injection via the lens of Contextual Integrity (CI), a privacy theory that judges information flow compliance with contextual norms. This explains types of attacks that current defenses attempt to patch and predict advanced ones future agents will face. We develop unique benign and attack scenarios that force an agent to violate the norms by (1) misrepresenting the flow, (2) manipulating norms, or (3) mixing multiple flows. This reframing suggests an impossibility result: an adversary can always construct a context under which a blocked flow appears legitimate, or a defender who tightens norms will block genuinely legitimate flows. Our findings suggest that current research addresses a shrinking fraction of future attack surfaces. Instead, through CI, we offer a principled framework for evaluating context-sensitive failures, and designing CI-aware alignment for the frontier autonomous agents.

Sahar Abdelnabi, Eugene Bagdasarian

ELLIS Institute Tübingen & MPI-IS & Tübingen AI Center · University of Massachusetts Amherst

Artificial Intelligence Safety Artificial Intelligence Agents LLM Defense Mechanisms Prompt Engineering Compliance

Ask PDF

May 29, 2026cs.CR

Depth-Dependent Indirect Prompt Injection in Tool-Calling ReAct Agents: Injection Depth, Payload Framing, and Turn-Budget Sensitivity

ReAct agents that interleave chain-of-thought reasoning with tool calls are increasingly deployed for real tasks such as scheduling, file retrieval, and data access. Their tool observation loop creates a direct attack surface: an adversary who controls any tool's return value can embed instructions that redirect the agent away from the user's goal, a threat known as indirect prompt injection. Existing benchmarks evaluate attack success rate (ASR) at a fixed injection position under fixed conditions, leaving three risk dimensions unexplored: where in the tool sequence the payload appears (injection depth), what rhetorical register it uses (framing), and how many turns the agent is permitted (turn cap). We conduct four controlled studies on 20 scenarios spanning five attack categories, totalling 460 trials against GPT-4o-mini and Claude Haiku at a combined API cost under 0.36 USD. Study 1 shows that ASR against GPT-4o-mini decays from 60% at depth 1 to 0% at depths 4 and 5 (Cramer's V = 0.58, p < 0.001; restricted to within-sequence depths 1-3: V = 0.47, p = 0.0013), driven by model resistance at depth 1 and task completion before payload encounter at deeper positions. Study 2 replicates the depth experiment on Claude Haiku, which achieves 0% ASR at every depth through a combination of conservative tool invocation and genuine instruction resistance. Study 3 shows that framing modulates ASR between 25% (neutral) and 75% (persona) at depth 1, a 50-percentage-point range that does not reach statistical significance at N = 20 per condition. Study 4 confirms that ASR is stable across turn caps of 3, 5, and 7, indicating the turn budget is not a risk factor in this setting. Our results establish injection depth as the dominant variable and show that sanitising only the first tool observation captures 67% of measured injection successes.

Mohammadreza Rashidi

Department of Computer Science AI and Media Analysis Lab Berlin, Germany

Indirect Prompt Injection Attack-Success Rate

Ask PDF