How Vulnerable Are AI Agents to Indirect Prompt Injections? Insights from a Large-Scale Public Competition

This public red-teaming study evaluates indirect prompt injection that both changes agent behavior and hides the compromise from the final response. Its scenarios include computer use alongside tool calling and coding, with analyses of transfer and model-dependent vulnerability.

AI-assisted editorial review against a primary source. This is a catalog annotation, not an independent reproduction or endorsement.

What is this resource?

Resource type

Research papers

Environment

unspecified

Topics

safety-security, evaluation, robustness

Record publication date

2026-03-16

Evidence retrieved

2026-10-17T12:31:16Z

Resource ID

arxiv:2603.15714

Recorded paper version

arXiv v1

Version updated: 2026-03-16T14:49:36Z.

This identifies the retained arXiv metadata snapshot; newly observed changes require separate review.

Authors

Mateusz Dziemian, Maxwell Lin, Xiaohan Fu, Micha Nowak, Nick Winter, Eliot Jones, Andy Zou, Lama Ahmad, Kamalika Chaudhuri, Sahana Chennabasappa, Xander Davies, Lauren Deason, Benjamin L. Edelman, Tanner Emek, Ivan Evtimov, Jim Gust, Maia Hamin, Kat He, Klaudia Krawiecka, Riccardo Patana, Neil Perry, Troy Peterson, Xiangyu Qi, Javier Rando, Zifan Wang, Zihan Wang, Spencer Whitman, Eric Winsor, Arman Zharmagambetov, Matt Fredrikson, Zico Kolter

Cite this paper

Download BibTeX · Download CSL JSON

Citations preserve the selected source edition, its authors and recorded date precision. Unrecorded venues and identifiers are omitted.

Explore related topics

Scope and limitations

Reviewed against the complete retained official abstract. Experimental findings and release availability have not been independently reproduced or verified.

Primary evidence and verification

Source retrieval is separate from experiment reproduction. Use the original publication or publisher page when citing claims about the resource.

1. arxiv api

   Retrieved 2026-10-17T12:31:16Z. Supports: name, authors, published_at, updated_at, identifiers.arxiv, details.arxiv_snapshot.

   Content fingerprint

   9289bc047b59e93f75703b72f5e92d9277e115238427519c343df550220e351b
2. editorial primary review

   Retrieved 2026-10-17T12:31:16Z. Supports: name, kind, summary, environments, topics, scope.

   Content fingerprint

   9289bc047b59e93f75703b72f5e92d9277e115238427519c343df550220e351b

Suggest a correction

Open a source-backed correction. Include this record ID and the original source. Read our editorial policy and coverage boundaries.