{
  "aliases": [],
  "authors": [
    "Mateusz Dziemian",
    "Maxwell Lin",
    "Xiaohan Fu",
    "Micha Nowak",
    "Nick Winter",
    "Eliot Jones",
    "Andy Zou",
    "Lama Ahmad",
    "Kamalika Chaudhuri",
    "Sahana Chennabasappa",
    "Xander Davies",
    "Lauren Deason",
    "Benjamin L. Edelman",
    "Tanner Emek",
    "Ivan Evtimov",
    "Jim Gust",
    "Maia Hamin",
    "Kat He",
    "Klaudia Krawiecka",
    "Riccardo Patana",
    "Neil Perry",
    "Troy Peterson",
    "Xiangyu Qi",
    "Javier Rando",
    "Zifan Wang",
    "Zihan Wang",
    "Spencer Whitman",
    "Eric Winsor",
    "Arman Zharmagambetov",
    "Matt Fredrikson",
    "Zico Kolter"
  ],
  "details": {
    "arxiv_snapshot": {
      "abstract_hash_method": "sha256-utf8-whitespace-collapsed-v1",
      "abstract_sha256": "e7fe52247e01f331021013dbc3003b3b828e134d7706ec1f587210ad286eee1d",
      "submitted_at": "2026-03-16T14:49:36Z",
      "updated_at": "2026-03-16T14:49:36Z",
      "version": 1,
      "versioned_url": "https://arxiv.org/abs/2603.15714v1"
    }
  },
  "environments": [
    "unspecified"
  ],
  "evidence": [
    {
      "method": "arxiv_api",
      "retrieved_at": "2026-10-17T12:31:16Z",
      "role": "primary",
      "sha256": "9289bc047b59e93f75703b72f5e92d9277e115238427519c343df550220e351b",
      "supports": [
        "name",
        "authors",
        "published_at",
        "updated_at",
        "identifiers.arxiv",
        "details.arxiv_snapshot"
      ],
      "url": "https://export.arxiv.org/api/query?id_list=2602.19870%2C2602.22769%2C2602.23166%2C2602.23320%2C2603.00198%2C2603.00842%2C2603.00991%2C2603.01050%2C2603.01145%2C2603.02236%2C2603.02795%2C2603.03278%2C2603.04549%2C2603.06713%2C2603.07106%2C2603.07670%2C2603.07853%2C2603.08706%2C2603.09716%2C2603.10002%2C2603.10664%2C2603.11139%2C2603.11320%2C2603.12483%2C2603.13026%2C2603.13247%2C2603.15714%2C2603.16065%2C2603.16289%2C2603.16839%2C2603.17216%2C2603.17378%2C2603.19313%2C2603.19685%2C2603.21489%2C2603.22527%2C2603.23638%2C2603.24157%2C2603.24639%2C2603.27646%2C2603.28069%2C2603.28407%2C2603.29418%2C2603.29847%2C2604.00528%2C2604.00886%2C2604.01194%2C2604.01438%2C2604.01560%2C2604.02985&max_results=50"
    },
    {
      "method": "editorial_primary_review",
      "retrieved_at": "2026-10-17T12:31:16Z",
      "role": "primary",
      "sha256": "9289bc047b59e93f75703b72f5e92d9277e115238427519c343df550220e351b",
      "supports": [
        "name",
        "kind",
        "summary",
        "environments",
        "topics",
        "scope"
      ],
      "url": "https://export.arxiv.org/api/query?id_list=2602.19870%2C2602.22769%2C2602.23166%2C2602.23320%2C2603.00198%2C2603.00842%2C2603.00991%2C2603.01050%2C2603.01145%2C2603.02236%2C2603.02795%2C2603.03278%2C2603.04549%2C2603.06713%2C2603.07106%2C2603.07670%2C2603.07853%2C2603.08706%2C2603.09716%2C2603.10002%2C2603.10664%2C2603.11139%2C2603.11320%2C2603.12483%2C2603.13026%2C2603.13247%2C2603.15714%2C2603.16065%2C2603.16289%2C2603.16839%2C2603.17216%2C2603.17378%2C2603.19313%2C2603.19685%2C2603.21489%2C2603.22527%2C2603.23638%2C2603.24157%2C2603.24639%2C2603.27646%2C2603.28069%2C2603.28407%2C2603.29418%2C2603.29847%2C2604.00528%2C2604.00886%2C2604.01194%2C2604.01438%2C2604.01560%2C2604.02985&max_results=50"
    }
  ],
  "id": "arxiv:2603.15714",
  "identifiers": {
    "arxiv": "2603.15714"
  },
  "kind": "paper",
  "last_verified_at": "2026-10-17T12:31:16Z",
  "licenses": {
    "code": null,
    "data": null,
    "document": null,
    "weights": null
  },
  "links": [
    {
      "rel": "primary",
      "url": "https://arxiv.org/abs/2603.15714"
    }
  ],
  "name": "How Vulnerable Are AI Agents to Indirect Prompt Injections? Insights from a Large-Scale Public Competition",
  "notes": "Reviewed against the complete retained official abstract. Experimental findings and release availability have not been independently reproduced or verified.",
  "published_at": "2026-03-16",
  "relations": [],
  "review_status": "curated",
  "scope": "core",
  "summary": "This public red-teaming study evaluates indirect prompt injection that both changes agent behavior and hides the compromise from the final response. Its scenarios include computer use alongside tool calling and coding, with analyses of transfer and model-dependent vulnerability.",
  "topics": [
    "safety-security",
    "evaluation",
    "robustness"
  ],
  "updated_at": "2026-03-16",
  "url": "https://arxiv.org/abs/2603.15714"
}