CapLite: Prompt-Injection Defense for Small Language Model Agents without Model-Written Security Artifacts

Summary

Researchers tested whether small language model (SLM) agents can reliably write the security artifacts that enforcement defenses such as CaMeL, Progent, IPIGuard and DRIFT depend on. Across 15 open-weight models, the artifacts written by the agent's own model admitted attacks on 14 (Progent), 13 (IPIGuard) and 11 (DRIFT) of the models, and CaMeL's programs failed to run in up to 68% of episodes. The proposed CapLite derives its policy from tool schemas and admits writes only when the deciding arguments appear in the user's request, with no attack succeeding in 13,935 attacked AgentDojo episodes.

Related items

• InfoMobileProbe: Adaptive Security Evaluation of Mobile Agents via Trajectory-Aware InjectionSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoIntent-Aware Protection for AI AgentsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• MediumCVE-2026-126767: OpsTree REMS prompt injection exposes hidden system prompt via /api/v1/rca/chatSimilar attack · NVD/CVE Database
• LowYour Robot's Safety Functions Already Work. What If the Input Lies?Similar attack · VicOne Blog
• InfoTop GenAI security resources — November 2026Similar attack · Adversa AI Blog