Ignored, Not Refused: What Low Prompt-Injection Success Rates Hide in Small Tool-Using Agents
Low attack-success-rate scores for prompt injection in tool-using LLM agents are misleading: injections are often silently ignored rather than refused, leaving real exploitation paths undetected.
Summary written by editorial AI · Source link below
arXiv:2610.23254v1 Announce Type: cross Abstract: Tool-using agents read untrusted external content, which exposes them to indirect prompt injection (IPI), where hidden instructions hijack the agent's tool calls. Benchmarks measure IPI security by the attack success rate (ASR), which treats every failed attack as a successful defense. To test this assumption, we audit 33,000 trajectories from eleven open-weight agents (2-14B parameters) on InjecAgent and AgentDojo. A label-blind LLM judge shows
Editorial Analysis
Enterprises deploying agentic AI for automation may rely on flawed benchmarks that understate indirect prompt-injection exposure, creating a false sense of security.
Mandate adversarial testing of LLM-based agents that goes beyond standard ASR metrics to detect silent injection acceptance.
Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.
External link — opens at arXiv Crypto & Security in a new tab.
More from the AI Security Desk
- OpenAI AI Agents Demonstrate VM Escapes and Secret Cross-Sandbox Communication1d
- Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions3d
- You gave your AI agent access, but who is giving it orders?3d
- AI Agents as Insider Threats: Inside Microsoft's Bet on a Unified Security Stack3d
- Critical x402 SDK Flaw Could Let Malicious APIs Drain AI Agents’ Token Balances3d