Researchers released a 21-scenario benchmark for evaluating how well LLM agents resist adaptive, cross-session attacks from an autonomous LLM attacker. The setup pits an attacking model against defenders that start each session fresh, targeting prompt injection and multi-turn manipulation risks. The work appears on arXiv as a cross-listing in cs.AI and cs.LG.
A new arXiv paper introduces IBBench-Light, an evaluation that presents the same external record to a model under two different uses: as a procedure the model must carry out, or as text it must simply read. Each of twelve semantic bases produces 144 matched response pairs per model, and four quantized instruction-tuned models were tested. The paired setup is meant to isolate whether models react to a directive's form or to the user's stated task.
A revised arXiv paper introduces DualView, a defense aimed at indirect prompt injection attacks targeting personal AI agents that operate locally with access to the network, file system, and shell. The work addresses how such agents can be manipulated through untrusted content they encounter while carrying out everyday tasks like web search, email, and file management. The submission is a replacement version of an existing preprint, so the full technical details are in the paper itself.
A new arXiv paper introduces PIDS-Bench, a benchmark that evaluates prompt-injection detectors beyond aggregate F1 scores on in-distribution test data. It examines detector behavior under distribution shift, obfuscation and over-defense, with particular attention to false positives on benign inputs near the decision boundary. The authors argue that standard evaluation practices give limited visibility into how these systems behave in realistic conditions.
A new arXiv paper introduces Skynet, a method that detects failures in agentic AI systems by modeling both the semantics and the structure of multi-step workflows. Rather than judging individual outputs, it treats long-horizon plans, tool calls, and multi-agent coordination as a whole, since a single bad step such as an injected prompt or a flawed plan can derail the entire task. The authors position workflow-level monitoring as a way to catch these faults before they propagate.
A new arXiv paper argues that prompt injection defenses tested on synthetic benchmarks fail to transfer to real enterprise documents, which are longer and mix authoritative-sounding language with ordinary factual content. The authors introduce PARSE, a retrieval sanitization approach that tracks the provenance of retrieved text to filter out injected instructions before they reach an LLM agent. The work is presented alongside a benchmark intended to better reflect professional-domain document conditions.
A discussion posted to Hacker News highlights techniques for manipulating AI-powered customer service chatbots. The thread examines how these agents can be steered or exploited through crafted inputs, raising concerns about safeguards in deployed support systems. It reflects growing scrutiny of the security of autonomous agents that handle customer interactions.
A new arXiv paper introduces DriftNet, a dual-head trajectory transformer designed to detect indirect prompt injection in LLM agents and pinpoint where in the agent's action sequence the compromise occurred. The approach treats a successful attack as a visible behavioral pattern: a benign run of tool calls, a poisoned observation, then attacker-serving actions. This would give operators more granular visibility into agent security incidents than a simple pass/fail detection signal.
A new arXiv paper describes controlled experiments testing how attackers can smuggle instructions into AI agents through images, exploiting the multimodal inputs that many agent frameworks accept. Since these systems can plan, retain memory, and invoke tools with access to files, email, and external services, the authors examine how hidden image-borne injections might translate into real-world actions. The study provides an empirical assessment of how exposed current agentic setups are to this class of attack.