Beyond Instruction Override: Benchmarking Indirect Prompt Injection with Task-Tampering Attacks

Summary

Researchers introduce a benchmark for indirect prompt injection that tests task-tampering attacks, where planted content influences a decision the source is not authorized to make, rather than redirecting the agent's task. Across 90 validated cases in three tool-use environments and five LLMs, attacks on decision rules, available actions, and state had higher mean success than objective attacks without defense. A detection-and-removal defense cut objective-targeting attacks to 2.4% success but left observation- and state-targeting attacks at 9.5% and 12.1%, and a tool-policy defense still allowed 15.4% attack success.

Topics

• Prompt injection and jailbreaks

Related items

• MediumCVE-2026-123851: JetBrains Junie GitHub Action prompt injection bypass via HTML encodingSimilar attack · NVD/CVE Database
• InfoDecision Models as Retrieval Gates Against Injection and PollutionSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoMultimodal-SEA: Benchmarking AI Agent Security under Multimodal Social Engineering AttacksSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• MediumResearchers Bypass ChatGPT Lockdown Mode to Exfiltrate Chats Without User InteractionSimilar attack · The Hacker News
• InfoTrueFoundry & Straiker | AI Gateway Security for AgentsSimilar attack · Straiker Blog