Indirect Prompt Injection

Follow this topic Ask about this topic

Latest papers 68

11 papers in the last four weeks, up 57% on the four weeks before. 0.1% of all new papers.

All topics

Prompt-Injection Probes Learn the Conversation, Not Just the Injection
Oct 13, 2026Kaan Kale, Sriram VishwanathPrompt Injection Detection Indirect Prompt Injection
Georgia Institute of Technology
BrowseSafe++: Benchmarking Prompt Injection Detection Across Web Contexts, Languages, and Browser Views
Oct 12, 2026Yuetian Chen, Kaiyuan Zhang, Yuntao Du +6Prompt Injection Detection AI Agent Security Benchmarks
Perplexity · Purdue University · Rutgers University
When AI Finds Hidden Messages, Does It Report?
Oct 7, 2026William Guey, Rashik Jahangir, Pierrick Bougault +3AI Agent Monitoring AI Agent Auditing
Department of Industrial Engineering, Tsinghua University, Beijing, China · School of Environment, Tsinghua University, Beijing, China · School of Social Sciences, Tsinghua University, Beijing, China +1
Readable Before Actionable: Causal Tracing of Indirect Prompt Injection
Oct 4, 2026Zhe Yu, Wenpeng Xing, Xingxing Yang +1Causal Reasoning in Language Models Indirect Prompt Injection
Zhejiang University · Binjiang Institute of Zhejiang University · Hong Kong Baptist University
Who Is Your Agent Serving? Provider-Side Indirect Prompt Injection in Proactive Agents
Oct 4, 2026Rui Wang, Chao Wang, Xinchen Wang +3AI Agent Security Indirect Prompt Injection
Hefei University of Technology · University of Science and Technology of China
Hidden in the Comments: A Context-Injection Attack Surface in Code LLMs
Oct 4, 2026Noor Munir, Francesco Quinzan, Stephen RobertsLLM Security Indirect Prompt Injection
Department of Engineering Science, University of Oxford, Oxford OX1 3PJ, UK
Divide and Inject: Can Agents Reconstruct an Indirect Prompt Injection from Fragments?
Sep 29, 2026Michael Lee, Zhipeng Wei, Yue Dong +1Indirect Prompt Injection Prompt Injection Attacks
International Computer Science Institute · DSO National Laboratories · UC Riverside +1
CounterSteer: Suppressing Indirect Prompt Injection with Activation Steering
Sep 29, 2026Mark RussinovichLLM Agent Security Indirect Prompt Injection
Microsoft Azure
Prompt Injection Detection for Email Agents Through Attack Chain Modeling
Sep 25, 2026Ahmad Hashmi, Dhyey Patel, Yunting YinPrompt Injection Detection Indirect Prompt Injection
Department of Computer Science Eastern Michigan University Ypsilanti, MI, USA
TriFleetRCA: On-Premise LLM Root Cause Analysis for Kubernetes
Sep 20, 2026Rohit Patel, Susil Kumar Mohanty, Jeenal ChaudharyLLM Inference Cloud Computing
Department of Computer Science and Engineering Indian Institute of Technology Jodhpur, Jodhpur, India
Beyond Single-Model Injection: A Threat Model and Defense Architecture for Prompt Injection in Multi-Agent Systems
Sep 19, 2026Rudrendu Kumar Paul, Sourav NandyPrompt Injection Defense Prompt Injection Attacks on AI Agents
Boston University, Boston, MA, USA · University of Texas at Austin, Austin, TX, USA
Defusing Explosive Prompts: Understanding and Preventing Trigger-Based Prompt Injections in LLM Agents
Sep 18, 2026Justin Szczepaniak, Elad Feldman, Naum Viner +1Prompt Injection Attacks Prompt Injection Attacks on AI Agents
Tel Aviv University
ALIBI: Adversarial Legitimacy Injection in Binary Input against LLM Malware Analyzers
Sep 17, 2026Hyeongjun Choi, Wonyoung Jung, Haehoon Seo +1Adversarial Attacks on LLMs LLM Security
78ResearchLab Seoul, South Korea
DriftNet: A Dual-Head Trajectory Transformer for Detecting and Localizing Prompt Injection in LLM Agents
Sep 9, 2026Asif Pinjari, Mithun Paul Saint-GermainAI Agent Security Benchmarks AI Agent Monitoring
School of Informatics, Computing, and Cyber Systems Northern Arizona University Flagstaff, AZ, USA
No-Box Vulnerability Analysis: Description-only Detection of Indirect Prompt Injection Vulnerabilities in MCP Servers
Sep 9, 2026Zehua Zhang, Jie Hu, Pratham Hegde +13MCP Security Software Vulnerability Detection
School of Computing and Augmented Intelligence, Arizona State University
Architecting the Secure AI-SOC: A Neurosymbolic Framework for Pipeline Integrity and Threat Mitigation
Sep 9, 2026Anna Gazani, Spyridon Kounoupidis, Panagiotis Katsaros +3Cybersecurity Indirect Prompt Injection
Aristotle University of Thessaloniki, Greece · Clone Systems, Cyprus
CoER: Defending against Adaptive Indirect Prompt Injection via Adversarial Co-Evolution and Refinement
Sep 7, 2026Boyang Zhang, Qingxin Xiao, Lingwei Dang +1Reinforcement Learning AI Agent Security
School of Software Engineering, South China University of Technology
Rethinking Indirect Prompt Injection as a Test-Time Search Problem
Sep 3, 2026Duong M. Nguyen, Joon Sik Kim, Blazej Manczak +1Inference-Time Search AI Agent Security
Dynamo AI · University of Illinois Urbana-Champaign
Will the User Ever Know? Covert Indirect Prompt Injection Attacks on Tool-Using LLM Agents
Aug 31, 2026Yunseok Lee, Yunji Kim, Woojin LeeLLM Agent Security AI Agent Security Benchmarks
Dongguk University-Seoul
SIR: Self-improving Red-teaming for Compute Use Agents
Aug 31, 2026Chen Xiong, Zhiyuan He, Pin-Yu Chen +2Computer-Use Agents Indirect Prompt Injection
The Chinese University of Hong Kong · IBM Research · University of Zagreb, FER & Radboud University +1
Workspace Topology as an Attack Vector in Agentic Coding Assistants
Aug 14, 2026Alexandre G. R. Day, Pradeep Yadlapalli, Sriram Venkatapathy +9AI Agent Security Prompt Injection Attacks on AI Agents
AI Foundations, Capital One
Toward Metacognitive One-Shot Indirect Prompt Injection: Strategy Abstraction Via Outcome-Conditioned Reflection
Aug 9, 2026Sihan Hou, Xinmeng Hou, Zhijun Zhang +5AI Agent Security Benchmarks Indirect Prompt Injection
1Nankai University · 2Nanyang Technological University · 3Technical Lead, R&D, Tianjin 712 Mobile Communication Co., Ltd. +1
StepJack: Benchmarking Computer-Use Agent Safety Against Multi-Step Indirect Prompt Injection
Aug 6, 2026Zhuoxin Zhan, Akbar Rafiey, Avery Ma +2Computer-Use Agents AI Agent Safety
Simon Fraser University · RBC Borealis · New York University
Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure
Aug 1, 2026Jianshuo Dong, Yiming Liu, Maosen Zhang +6Indirect Prompt Injection Prompt Injection Defense
Tsinghua University · MatrixOrigin · Nanyang Technological University +1
IssueTrojanBench: Benchmarking AI Coding Agents Against Malicious Issue Requests
Jul 22, 2026Ankur Singh, Jinqiu Yang, Tse-Hsun ChenAI Coding Agents AI Agent Security
Concordia University Montr´eal, Canada
Know Your Agent: Reconnaissance-Driven Pentesting of AI Agents
Jul 22, 2026Or Zion Eliav, Eyal Lenga, Shir Bernstien +1AI Agent Security AI Agent Security Benchmarks
Faculty of Computer and Information Science Ben-Gurion University of the Negev Beer-Sheva, Israel
They'll Verify. They Just Won't Act. How Authority Framing and Laundered Code Turn a Trusted Agentic CI/CD Pipeline Into an Attack Surface
Jul 21, 2026Yohann SidotLLM Agent Security Indirect Prompt Injection
Senthex Research
NetInjectBench: Benchmarking Indirect Prompt Injection in Tool-Using Large Language Model Agents for Network Operations
Jul 11, 2026Ruksat Khan Shayoni, Muhammad Faraz Shoaib, S M Asif Hossain +1AI Agent Security Benchmarks Indirect Prompt Injection
School of Computing, Wichita State University, Kansas, USA · Department of Computer Science, American International University-Bangladesh, Dhaka, Bangladesh
Unicode TAG-Block Concealment of Tool-Metadata Payloads in the Model Context Protocol: An Approval-View Fidelity Gap Across Three Independent Server Implementations
Jul 7, 2026Mohammadreza RashidiAdversarial Attacks MCP Security
Department of Computer Science AI and Media Analysis Lab Berlin, Germany
Agent Data Injection Attacks are Realistic Threats to AI Agents
Jul 6, 2026Woohyuk Choi, Juhee Kim, Taehyun Kang +3AI Agent Security Indirect Prompt Injection
Seoul National University · Largosoft · University of Illinois Urbana-Champaign

Oct 13, 2026J/K move · Enter open · S save

Prompt-Injection Probes Learn the Conversation, Not Just the Injection

Kaan Kale, Sriram Vishwanath

Georgia Institute of Technology

Prompt Injection Detection Indirect Prompt Injection Hidden-State Probing Shortcut Learning

Open paper AskPDF arXiv

Linear probes on a model's hidden states are used as cheap monitors for indirect prompt injection: they screen the tool outputs an agent reads and send suspicious ones to a slower second check, so every false alarm has a cost. But a probe learns whatever separates its training examples. The standard evaluation of injection probes can be passed without the model: conversation position and text lengths alone reach 0.91-0.98 AUROC. When each attack is compared with the same conversation without the injection, or with harmless text formatted like an injection, standard probes flag most of these harmless cases. We add such cases to the training data as matched negatives. Across six open models, in applications seen during training and at the default threshold, changing only the training data cuts false alarms on injection-free conversations from 41-80% to 4-27%, and on harmless look-alikes from 92-98% to 3-16%. With a threshold set on normal traffic, our probe still catches a median 95% of the attacks that fooled the agent (91% without our data). In new applications, false alarms stay low, but detection depends on the model and on how the threshold is set. The same data also helps a text-only filter.