Where You Inject Matters: The Trust Region Effect in LLM Agents

Summary

Researchers built three agentic testbeds spanning tool use, coding, and daily workflow domains to study how the placement of an indirect prompt injection affects an agent's susceptibility. With injection content held fixed, an agent powered by GPT-5.4 followed an unsafe instruction in a repository documentation file (README or TODO) 2.6 times more often on average than the same instruction in a code or data file. The authors call this the trust region effect and build learning-based attackers that select better injection placements.

Topics

• Prompt injection and jailbreaks

Related items

• InfoOpenAI doubles ChatGPT Pro usage limits after backlash over planned 50% cutSame vendor · BleepingComputer
• InfoAPI credits benefit for eligible ChatGPT subscriptionsSame vendor · Simon Willison's Weblog
• InfoAmazon AWS posts 39% revenue growth as cloud rivals also accelerate Same vendor · CNBC Technology
• InfoBuilding a multiplayer game world with autonomous Fable-class modelsSame vendor · Simon Willison's Weblog
• InfoAn updated Model Spec for more capable and beneficial AISame vendor · OpenAI Blog