Ignored, Not Refused: What Low Prompt-Injection Success Rates Hide in Small Tool-Using Agents

Summary

Benchmarks for indirect prompt injection in tool-using agents usually report attack success rate, which counts every failed attack as a defense. An audit of 33,000 trajectories from eleven open-weight agents (2-14B parameters) on InjecAgent and AgentDojo found that most failed attacks were ignored (76-80%) rather than refused (17-18%). Changing only the system prompt moved InjecAgent ASR from 0.2% to 43% with identical weights, and 21.7% of AgentDojo episodes stayed safe without completing the user's task.

Mitigation

The source recommends that evaluations report how attacks fail and whether the user's task is completed, alongside ASR. It also releases the labeled corpus, judge prompt, and analysis code.

Topics

• Prompt injection and jailbreaks

Related items

• MediumCVE-2026-95183: DeepSeek Harness context-compaction prompt injection via external contentSimilar attack · NVD/CVE Database
• InfoMobileInject: Evaluating Reasoning-to-Action Security of MLLM-Based Mobile Agents under Cross-Modal Consistency InjectionSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoSAFE-Mem: Secure Agentic Memory with Fine-Grained Authority and Governance-Aware RetrievalSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoIdentify, Classify, Act: Per-Instruction Controlled Compliance for LLMs over External DataSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoGRAD: Graph-Structured Antibody Defense for LLM AgentsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)