A new arXiv paper proposes ActGuard, a defense that audits an LLM agent's planned tool calls before they are executed. The approach targets indirect prompt injection, where malicious instructions hidden in tool outputs can hijack an agent's behavior. The authors position it as an alternative to existing defenses such as prompt hardening and content filtering.
A revised arXiv paper introduces DualView, a defense aimed at indirect prompt injection attacks targeting personal AI agents that operate locally with access to the network, file system, and shell. The work addresses how such agents can be manipulated through untrusted content they encounter while carrying out everyday tasks like web search, email, and file management. The submission is a replacement version of an existing preprint, so the full technical details are in the paper itself.
A new arXiv paper argues that prompt injection defenses tested on synthetic benchmarks fail to transfer to real enterprise documents, which are longer and mix authoritative-sounding language with ordinary factual content. The authors introduce PARSE, a retrieval sanitization approach that tracks the provenance of retrieved text to filter out injected instructions before they reach an LLM agent. The work is presented alongside a benchmark intended to better reflect professional-domain document conditions.
A new arXiv paper introduces PIDS-Bench, a benchmark that evaluates prompt-injection detectors beyond aggregate F1 scores on in-distribution test data. It examines detector behavior under distribution shift, obfuscation and over-defense, with particular attention to false positives on benign inputs near the decision boundary. The authors argue that standard evaluation practices give limited visibility into how these systems behave in realistic conditions.
Researchers released a 21-scenario benchmark for evaluating how well LLM agents resist adaptive, cross-session attacks from an autonomous LLM attacker. The setup pits an attacking model against defenders that start each session fresh, targeting prompt injection and multi-turn manipulation risks. The work appears on arXiv as a cross-listing in cs.AI and cs.LG.
A discussion posted to Hacker News highlights techniques for manipulating AI-powered customer service chatbots. The thread examines how these agents can be steered or exploited through crafted inputs, raising concerns about safeguards in deployed support systems. It reflects growing scrutiny of the security of autonomous agents that handle customer interactions.
A new arXiv paper describes controlled experiments testing how attackers can smuggle instructions into AI agents through images, exploiting the multimodal inputs that many agent frameworks accept. Since these systems can plan, retain memory, and invoke tools with access to files, email, and external services, the authors examine how hidden image-borne injections might translate into real-world actions. The study provides an empirical assessment of how exposed current agentic setups are to this class of attack.
A new arXiv paper introduces DriftNet, a dual-head trajectory transformer designed to detect indirect prompt injection in LLM agents and pinpoint where in the agent's action sequence the compromise occurred. The approach treats a successful attack as a visible behavioral pattern: a benign run of tool calls, a poisoned observation, then attacker-serving actions. This would give operators more granular visibility into agent security incidents than a simple pass/fail detection signal.
A new arXiv preprint outlines a neurosymbolic approach for protecting AI-driven security operations centers from attacks on their data pipelines. The work focuses on indirect prompt injection through log poisoning, a vector where adversaries plant malicious text in logs that downstream language models then process. The proposed framework aims to verify pipeline integrity and mitigate such threats rather than relying on LLM defenses alone.
A new arXiv preprint describes an approach for finding indirect prompt injection vulnerabilities in MCP servers without needing system access or live interaction. The method works from descriptions alone, targeting third-party audits of closed-source, remotely hosted, or commercially gated software where conventional analysis is not possible. The authors position it as a way to assess critical systems that analysts cannot directly inspect or probe.