Pith. sign in

REVIEW 3 major objections 3 minor 36 references

Agent reconnaissance before attacks lifts prompt-injection success by up to 67 points.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-01 11:33 UTC pith:TO6UGPS5

load-bearing objection The recon-is-useful claim is solid and well-ablated; the 67pp victory over prior frameworks is not yet established because the baselines are self-reproduced and compute is not matched. the 3 major comments →

arxiv 2607.19837 v1 pith:TO6UGPS5 submitted 2026-07-22 cs.AI cs.CRcs.LG

Know Your Agent: Reconnaissance-Driven Pentesting of AI Agents

Or Zion Eliav , Eyal Lenga , Shir Bernstien , Yisroel Mirsky This is my paper
classification cs.AI cs.CRcs.LG
keywords LLM agentsindirect prompt injectionagent reconnaissanceblack-box pentestingAI securityknowledge assetstool-using agentsattack success rate
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper argues that automated testing of AI agents against indirect prompt injection should work like a penetration test: probe the target, build a profile of its tools and policies, then attack with that knowledge. It formalizes this as agent reconnaissance, defines the knowledge assets an attacker can extract (tool schemas, guardrail wording, user task, response style, execution conventions), and claims these assets substantially improve attack success. On established agent-security benchmarks, the proposed framework, KYA, reportedly beats all baselines by up to 67 percentage points in attack success rate, across several foundation-model families. The authors also report success on a real-world open-source coding agent, where attack success is highest for objectives that look plausible within the agent's current task. If the claim holds, target-specific knowledge, not just clever payload wording, is the main driver of successful injections against tool-using agents, and defenders must treat agents' observable behavior as sensitive attack surface.

Core claim

The central discovery is that reconnaissance — deliberately extracting operational knowledge about a target agent before and between attack attempts — substantially improves automated indirect-prompt-injection testing. The paper identifies two weaknesses that make this knowledge leverageable: surface-form trust (W1), where agents treat copyable textual patterns like delimiters, role markers, and tool-call syntax as evidence of trusted origin, and coherence-based legitimation (W2), where agents accept requests that fit the surrounding task narrative even without verification. Knowledge assets are grouped into Evasion, Pretext, and Blueprint categories, each feeding one or both weaknesses. The

What carries the argument

The central object is the knowledge asset: a discrete piece of operational knowledge about a target agent, such as tool names, tool-call schemas, guardrail wording, user persona, current task, structural delimiters, and response style. The machinery is the reconnaissance-exploitation loop, in which an orchestrator maintains a target profile keyed by asset categories, consults a tactic library (each tactic listing prerequisite assets), and decides after every interaction whether to launch a scout probe for a missing asset or send a strategist-and-forger pair to synthesize a payload using the collected profile. This loop converts feedback from a payload-mutation signal into a structured target

Load-bearing premise

The headline margin rests on two load-bearing premises: that the best-effort reproductions of prior iterative frameworks are faithful to the originals, and that counting a tool call as a successful attack even when the agent retracts it or a guardrail blocks it reflects real-world compromise.

What would settle it

Run the same evaluation grid with the original implementations of the prior iterative frameworks (or with their exact published scoring functions and training data) and compare attack success; if the reconnaissance framework's margin over these faithful baselines drops to a few points, the claim that reconnaissance is the driver collapses. Separately, recount success only when the malicious tool call is actually executed and not blocked by a guardrail; if the framework's attack success rate falls dramatically, the scoring rule is carrying the result.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • Automated red-teaming of agents should interleave reconnaissance with exploitation; on the paper's evidence, payload-only iterative refinement leaves a large fraction of attacks undiscovered, with a measured gap of up to 67 percentage points in attack success rate.
  • Small amounts of target-specific knowledge can be decisive: the paper's single-asset ablation reports that knowing the user's current task raises attack success from 12.4% to 61.9% in an undefended setting and from 2.1% to 38.1% under a repeat-user-prompt defense.
  • Prompt-level defenses do not eliminate the reconnaissance advantage: delimiter-based fences left attack success essentially unchanged (86.3% vs. 86.0% without defenses), while a prompt-injection detector reduced but did not remove the advantage.
  • Reconnaissance matters most when an attack must be woven into a multi-step workflow; on single-step tasks, strong payload-generation baselines already saturate, so the gain is concentrated where the injected action must appear contextually plausible.
  • The weakness analysis implies that defenses should move away from wording-based guardrails toward provenance or authentication signals that cannot be forged by copying surface forms.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • If this finding holds, an agent's public-facing behavior is itself an attack surface: any logged-in user who can ask 'what can you do?' and observe tool calls is effectively being handed the blueprint for a stronger injection, so tool schemas and refusal wording should be treated as sensitive operational data.
  • The W1/W2 framing yields a concrete testable defense prediction: adding explicit runtime provenance markers (e.g., labeling tool output as untrusted) and fine-tuning agents to treat forged markers as untrusted should reduce reconnaissance-driven attack success more than any wording-level guardrail; this is not evaluated in the paper.
  • The coding-agent tier pattern — where risky objectives succeed more often than benign or dangerous ones — suggests attack success is governed by task plausibility relative to the agent's distribution of work. A red-teaming harness could score candidate objectives by this plausibility prior and pick the most promising before spending attempts.
  • Since reconnaissance gains depend on observing the agent's reactions, rate-limiting or hiding whether a tool call was blocked could raise the cost of reconnaissance; this is an untested extension of the paper's logic.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 3 minor

Summary. The paper argues that automated indirect-prompt-injection (IPI) testing of LLM agents should include reconnaissance—deliberate probing to extract operational knowledge about the target agent—rather than only payload refinement. It formalizes this as the extraction of 'knowledge assets' (tool schemas, guardrail wording, user task, execution conventions, etc.), organizes them into Evasion/Pretext/Blueprint categories, and attributes their leverage to two agent weaknesses: surface-form trust (W1) and coherence-based legitimation (W2). The proposed framework, KYA, interleaves reconnaissance and exploitation through Orchestrator, Reconnaissance, and Exploitation modules. The paper evaluates KYA on AgentDojo and InjecAgent across GPT-4.1, Llama 3.3-70B, and Gemini 3 Flash, reporting ASR improvements up to 86.0% on AgentDojo and 99.3% on InjecAgent, plus a case study on OpenHands. It claims to release KYA, the benchmarks, and baseline implementations.

Significance. If the results hold, the paper makes a valuable conceptual and practical contribution: it names and formalizes an underappreciated dimension of agent red-teaming, provides a concrete taxonomy of knowledge assets, and demonstrates through a controlled ablation that adding reconnaissance materially improves automated IPI testing. The strongest evidence is the internal no-reconnaissance ablation (Table 3: 27.4% vs 86.0% on AgentDojo), which controls for attacker model and budget, and the use of external benchmark tasks, multiple foundation models, confidence intervals, and component ablations. However, the specific quantitative headline—'surpasses all baselines by up to 67 percentage points'—is not yet established because it is measured against the authors' own best-effort reproductions of AgentVigil and AutoHijacker under unequal compute budgets. The conceptual claim is defensible; the numeric superiority claim needs additional verification or reframing.

major comments (3)
  1. [§6.1 and Appendix C] The headline ASR gains over iterative baselines rest on the authors' own best-effort reproductions, which are not open-sourced and deviate materially from the originals. Appendix C.1 states AgentVigil is run with pure-ASR fuzzing and final ASR computed over all 629 cases including the fuzzing set; Table 10 shows AutoHijacker uses SQuAD-only training and GPT-4o-mini/GPT-4.1 instead of Llama-3.1-70B. KYA also runs on GPT-5 with 3 tactics + 10 exploitation attempts, while baseline models are weaker. The controlled no-recon ablation (Table 3: 27.4% vs 86.0%) supports the conceptual claim, but not the specific 'up to 67 percentage points' numerical margin. Please equalize attacker models/budgets, release the baseline implementations, or reframe the claim.
  2. [Appendix B.5 / Table 6] The OpenHands scoring rule counts a case as success when the agent merely issues the injected tool call, even if it retracts or a guardrail blocks it. The text acknowledges that dangerous objectives are 'frequently refused' but sometimes typed before retraction. This inflates the reported 21.9% ASR and makes the real-world validation hard to interpret. Please report execution-based ASR separately, or at least provide retraction/guardrail counts.
  3. [Abstract / Footnote 1 / §6.1] The paper promises release of KYA and baseline implementations, but Footnote 1 says source will be released with camera-ready, and the iterative baselines are 'best-effort reproductions' whose code is not provided. As submitted, the artifact needed to audit the central comparison is missing. Please provide code/implementations at review time and clarify the fuzzing/test split and final-ASR computation for AgentVigil.
minor comments (3)
  1. [Table 5] The column header 'ASR∆USR' is confusingly formatted; it should be two separate columns ('ASR' and 'ΔUSR') with clear units. Also, the table title has a typo: 'negativly' instead of 'negatively.'
  2. [§4.3] The delimiter-spoofing example uses '»...«' while the preceding defense states untrusted input appears between '«' and '»'. The opening/closing bracket usage appears inverted and should be corrected for clarity.
  3. [Figure 5] The Venn diagram percentages are hard to verify from the text alone. Please report the raw number of scenarios solved by each intersection in the caption or appendix.

Circularity Check

0 steps flagged

No significant circularity: KYA's central claim is supported by controlled empirical evaluation against external benchmarks, not by definitional or self-citational reduction.

full rationale

The paper's central claim—that reconnaissance substantially improves automated IPI testing—is an empirical hypothesis operationalized in KYA and tested against the external AgentDojo and InjecAgent benchmarks plus a no-recon ablation (Table 3: 27.4% vs 86.0%). The knowledge-asset taxonomy (Sec. 4.3) and weaknesses W1/W2 (Sec. 4.2) are explanatory constructs, not fitted parameters or equations; no predicted quantity is defined in terms of the measured outcome. The tactic library (Appendix D) is grounded in prior literature and Gray Swan challenge analysis, not in the evaluation labels, and the evaluation uses AgentDojo's deterministic success checks. The paper contains no load-bearing self-citations and invokes no uniqueness theorem. The re-implementations of AgentVigil and AutoHijacker (Appendix C) and the unequal compute budgets are threats to the comparison's fairness, but they are evaluation-validity concerns, not circularity: the baselines are not fitted to the conclusion, and the no-recon ablation independently controls for the reconnaissance contribution. Therefore, no step in the paper's derivation reduces by construction to its inputs.

Axiom & Free-Parameter Ledger

1 free parameters · 5 axioms · 0 invented entities

No numeric fitting to data; the hand-chosen interaction budget is the main ad hoc number. The load-bearing domain assumptions are the black-box access model, context-window serialization, and the paper's W1/W2 explanatory framework; the OpenHands scoring rule further assumes attempted tool calls reveal security impact. KYA's tactic library is hand-curated and not independently released.

free parameters (1)
  • KYA interaction budget = 3 tactics; 10 exploitation attempts per run
    Fixed cap chosen by authors; larger budgets likely raise ASR and it is unclear whether baselines receive matched budgets, so it affects the reported superiority magnitude.
axioms (5)
  • domain assumption LLM receives instructions and tool-retrieved data as a single serialized token stream, so provenance is not reliably distinguishable at inference time.
    Section 2: 'the model ultimately receives them as a single sequence of tokens'; necessary for IPI and W1.
  • domain assumption A black-box actor can register as a legitimate user, plant content in retrievable data sources, and observe the agent's full response trajectory including tool invocations.
    Section 3, Stage 1; defines KYA's access model.
  • ad hoc to paper Target profiles M can be populated reliably from probes; the paper assumes the profile grows monotonically and that extracted assets are correct.
    Section 5: 'M begins empty and grows monotonically across the session'; if probes fail or are misread, tactics fail, and no false-asset recovery is described.
  • ad hoc to paper W1 (surface-form trust) and W2 (coherence-based legitimation) are the two dominant weaknesses explaining why reconnaissance improves IPI.
    Section 4.2; this is the paper's own explanatory framework, not independently validated.
  • domain assumption AgentDojo/InjecAgent benchmark success criteria and the OpenHands scoring rule are valid proxies for real-world attack success.
    Section 6 and Appendix B.5; note OpenHands counts attempted tool calls even when blocked, making the proxy permissive.

pith-pipeline@v1.3.0-alltime-deepseek · 21839 in / 14555 out tokens · 146454 ms · 2026-08-01T11:33:19.206475+00:00 · methodology

0 comments
read the original abstract

Traditional pentesting uses reconnaissance at each step to uncover unseen weaknesses, build stronger attacks, and advance the objective; we argue that AI agents require the same treatment. We formalize agent reconnaissance by modeling the process and identifying the knowledge assets it seeks to extract: what they are, how they are used, and which agent weaknesses they exploit to give adversaries leverage in indirect prompt injection attacks. We instantiate these insights in Know Your Agent (KYA), a framework that automates black-box, reconnaissance-driven pentesting by probing agents, building target profiles, and using those profiles to craft stronger attacks. We evaluate KYA on agent-security benchmarks and a real-world coding agent, and release KYA, its benchmarks, and baseline implementations for reproducibility.

Figures

Figures reproduced from arXiv: 2607.19837 by Eyal Lenga, Or Zion Eliav, Shir Bernstien, Yisroel Mirsky.

Figure 1
Figure 1. Figure 1: Reconnaissance in the loop. Existing approaches [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: State chart comparing prior agent pentesting work [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: KYA overview. A: ⃝1 the Orchestrator decides whether to perform recon or an attack using the current target profile M; ⃝2 the respective module creates payloads with M. B: ⃝3 the agent is evaluated with the payload and ⃝4 the Orchestrator updates M accordingly. Loop to A. asset moves the payload closer to a trusted, mechanically executable form. 5. The KYA Framework KYA instantiates the reconnaissance-driv… view at source ↗
Figure 4
Figure 4. Figure 4: Example KYA execution trace achieving Slack [PITH_FULL_IMAGE:figures/full_fig_p009_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Overlap among different configurations of [PITH_FULL_IMAGE:figures/full_fig_p010_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: shows that even a single knowledge asset can substantially improve attack success. The no-knowledge baseline achieves 12.4% ASR without defenses and 2.1% with defenses. The most valuable asset is the Agent’s Task: A∩B∩C 23% A∩C 34% C 31% A 6% B 1% A∩B 1% B∩C 4% [PITH_FULL_IMAGE:figures/full_fig_p010_6.png] view at source ↗
Figure 7
Figure 7. Figure 7: Cumulative ASR over injection attempts on Agent [PITH_FULL_IMAGE:figures/full_fig_p013_7.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

36 extracted references · 11 linked inside Pith

  1. [1]

    Toolformer: Language models can teach themselves to use tools,

    T. Schick, J. Dwivedi-Yu, R. Dessì, R. Raileanu, M. Lomeli, E. Ham- bro, L. Zettlemoyer, N. Cancedda, and T. Scialom, “Toolformer: Language models can teach themselves to use tools,”Advances in neural information processing systems, vol. 36, pp. 68 539–68 551, 2023

    2023

  2. [2]

    React: Synergizing reasoning and acting in language models,

    S. Yao, J. Zhao, D. Yu, N. Du, I. Shafran, K. Narasimhan, and Y . Cao, “React: Synergizing reasoning and acting in language models,”arXiv preprint arXiv:2210.03629, 2022

    Pith/arXiv arXiv 2022

  3. [3]

    Webarena: A realistic web environ- ment for building autonomous agents,

    S. Zhou, F. F. Xu, H. Zhu, X. Zhou, R. Lo, A. Sridhar, X. Cheng, T. Ou, Y . Bisk, D. Friedet al., “Webarena: A realistic web environ- ment for building autonomous agents,” inInternational Conference on Learning Representations, vol. 2024, 2024, pp. 15 585–15 606

    2024

  4. [4]

    Hug- ginggpt: Solving ai tasks with chatgpt and its friends in hugging face,

    Y . Shen, K. Song, X. Tan, D. Li, W. Lu, and Y . Zhuang, “Hug- ginggpt: Solving ai tasks with chatgpt and its friends in hugging face,”Advances in Neural Information Processing Systems, vol. 36, pp. 38 154–38 180, 2023

    2023

  5. [5]

    Openhands: An open platform for ai software developers as generalist agents,

    X. Wang, B. Li, Y . Song, F. F. Xu, X. Tang, M. Zhuge, J. Pan, Y . Song, B. Li, J. Singhet al., “Openhands: An open platform for ai software developers as generalist agents,” inInternational Conference on Learning Representations, vol. 2025, 2025, pp. 65 882–65 919

    2025

  6. [6]

    Not what you’ve signed up for: Compromising real- world llm-integrated applications with indirect prompt injection,

    K. Greshake, S. Abdelnabi, S. Mishra, C. Endres, T. Holz, and M. Fritz, “Not what you’ve signed up for: Compromising real- world llm-integrated applications with indirect prompt injection,” in Proceedings of the 16th ACM workshop on artificial intelligence and security, 2023, pp. 79–90

    2023

  7. [7]

    OW ASP Top 10 for Large Language Model Applications,

    OW ASP Foundation, “OW ASP Top 10 for Large Language Model Applications,” 2025. [Online]. Available: https://owasp.org/ www-project-top-10-for-large-language-model-applications/

    2025

  8. [8]

    Prompt injection attacks against gpt-3,

    Willison, “Prompt injection attacks against gpt-3,” 2022. [Online]. Available: https://simonwillison.net/2022/Sep/12/prompt-injection/

    2022

  9. [9]

    Ignore previous prompt: Attack techniques for language models,

    F. Perez and I. Ribeiro, “Ignore previous prompt: Attack techniques for language models,”arXiv preprint arXiv:2211.09527, 2022

    Pith/arXiv arXiv 2022

  10. [10]

    Agentvigil: Automatic black-box red-teaming for indirect prompt injection against llm agents,

    Z. Wang, V . Siu, Z. Ye, T. Shi, Y . Nie, X. Zhao, C. Wang, W. Guo, and D. Song, “Agentvigil: Automatic black-box red-teaming for indirect prompt injection against llm agents,”Findings of the Association for Computational Linguistics: EMNLP 2025, pp. 23 159–23 172, 2025

    2025

  11. [11]

    Topicattack: An indirect prompt injection attack via topic transition,

    Y . Chen, H. Li, Y . Li, Y . Liu, Y . Song, and B. Hooi, “Topicattack: An indirect prompt injection attack via topic transition,” inProceedings of the 2025 Conference on Empirical Methods in Natural Language Processing, 2025, pp. 7338–7356

    2025

  12. [12]

    Agentx- ploit: End-to-end red-teaming for ai agents powdered by multi-agent systems

    S. Qiu, Z. Wang, T. Shi, Z. Chen, W. Guo, and D. Song, “Agentx- ploit: End-to-end red-teaming for ai agents powdered by multi-agent systems.”

  13. [13]

    Adaptools: Adaptive tool-based in- direct prompt injection attacks on agentic llms,

    C. Wang, J. Zhang, Z. Zhang, Z. Wang, Y . Wang, J. Gao, T. Wei, Z. Chen, and W. Y . B. Lim, “Adaptools: Adaptive tool-based in- direct prompt injection attacks on agentic llms,”arXiv preprint arXiv:2602.20720, 2026

    arXiv 2026

  14. [14]

    Security challenges in ai agent deployment: Insights from a large scale public competi- tion,

    A. Zou, M. Lin, E. Jones, M. Nowak, M. Dziemian, N. Winter, V . Nathanael, A. Croft, X. Davies, J. Patelet al., “Security challenges in ai agent deployment: Insights from a large scale public competi- tion,”Advances in Neural Information Processing Systems, vol. 38, 2026

    2026

  15. [15]

    "real attackers don’t compute gradients

    G. Apruzzese, H. S. Anderson, S. Dambra, D. Freeman, F. Pierazzi, and K. A. Roundy, “"real attackers don’t compute gradients": Bridging the gap between adversarial ml research and practice,”

  16. [16]

    Prompt injection attack against llm-integrated applications,

    Y . Liu, G. Deng, Y . Li, K. Wang, Z. Wang, X. Wang, T. Zhang, Y . Liu, H. Wang, Y . Zheng, L. Y . Zhang, and Y . Liu, “Prompt injection attack against llm-integrated applications,” 2023. [Online]. Available: https://arxiv.org/abs/2306.05499

    Pith/arXiv arXiv 2023

  17. [17]

    Agentdojo: A dynamic environment to evaluate prompt injection attacks and defenses for LLM agents,

    E. Debenedetti, J. Zhang, M. Balunovic, L. Beurer-Kellner, M. Fischer, and F. Tramèr, “Agentdojo: A dynamic environment to evaluate prompt injection attacks and defenses for LLM agents,” inThe Thirty-eight Conference on Neural Information Processing Systems Datasets and Benchmarks Track, 2024. [Online]. Available: https://openreview.net/forum?id=m1YY AQjO3w

    2024

  18. [18]

    Injecagent: Benchmarking indirect prompt injections in tool-integrated large language model agents,

    Q. Zhan, Z. Liang, Z. Ying, and D. Kang, “Injecagent: Benchmarking indirect prompt injections in tool-integrated large language model agents,” 2024. [Online]. Available: https://arxiv.org/abs/2403.02691

    Pith/arXiv arXiv 2024

  19. [19]

    Chatinject: Abusing chat templates for prompt injection in llm agents,

    H. Chang, Y . Jun, and H. Lee, “Chatinject: Abusing chat templates for prompt injection in llm agents,” 2026. [Online]. Available: https://arxiv.org/abs/2509.22830

    Pith/arXiv arXiv 2026

  20. [20]

    Prompt injection attack to tool selection in llm agents,

    J. Shi, Z. Yuan, G. Tie, P. Zhou, N. Z. Gong, and L. Sun, “Prompt injection attack to tool selection in llm agents,”arXiv preprint arXiv:2504.19793, 2025

    Pith/arXiv arXiv 2025

  21. [21]

    Obliinjection: Order-oblivious prompt injection attack to llm agents with multi-source data,

    R. Wang, Y . Jia, and N. Z. Gong, “Obliinjection: Order-oblivious prompt injection attack to llm agents with multi-source data,”arXiv preprint arXiv:2512.09321, 2025

    arXiv 2025

  22. [22]

    Agentvigil: Generic black-box red-teaming for indirect prompt injection against llm agents,

    Z. Wang, V . Siu, Z. Ye, T. Shi, Y . Nie, X. Zhao, C. Wang, W. Guo, and D. Song, “Agentvigil: Generic black-box red-teaming for indirect prompt injection against llm agents,” 2025. [Online]. Available: https://arxiv.org/abs/2505.05849

    Pith/arXiv arXiv 2025

  23. [23]

    Autohijacker: Automatic indirect prompt injection against black-box LLM agents,

    X. Liu, S. Jha, P. McDaniel, B. Li, and C. Xiao, “Autohijacker: Automatic indirect prompt injection against black-box LLM agents,” 2025, openReview preprint. [Online]. Available: https: //openreview.net/forum?id=2VmB01D9Ef

    2025

  24. [24]

    Agentxploit: End-to-end red-teaming for AI agents powdered by multi-agent systems,

    S. Qiu, Z. Wang, T. Shi, Z. Chen, W. Guo, and D. Song, “Agentxploit: End-to-end red-teaming for AI agents powdered by multi-agent systems,” 2025, openReview preprint. [Online]. Available: https://openreview.net/forum?id=xKJ0lVQEv7

    2025

  25. [25]

    Tooltweak: An attack on tool selection in llm-based agents,

    J. Sneh, R. Yan, J. Yu, P. Torr, Y . Gal, S. Sengupta, E. Sommerlade, A. Paren, and A. Bibi, “Tooltweak: An attack on tool selection in llm-based agents,”arXiv preprint arXiv:2510.02554, 2025

    arXiv 2025

  26. [26]

    Verigrey: Greybox agent validation,

    Y . Zhang, S. Kang, R. Meng, M. Böhme, and A. Roychoudhury, “Verigrey: Greybox agent validation,” 2026. [Online]. Available: https://arxiv.org/abs/2603.17639

    arXiv 2026

  27. [27]

    Skillject: Automating stealthy skill-based prompt injection for cod- ing agents with trace-driven closed-loop refinement,

    X. Jia, J. Liao, S. Qin, J. Gu, W. Ren, X. Cao, Y . Liu, and P. Torr, “Skillject: Automating stealthy skill-based prompt injection for cod- ing agents with trace-driven closed-loop refinement,”arXiv preprint arXiv:2602.14211, 2026

    Pith/arXiv arXiv 2026

  28. [28]

    Udora: A unified red teaming framework against llm agents by dynamically hijacking their own reasoning,

    J. Zhang, S. Yang, and B. Li, “Udora: A unified red teaming framework against llm agents by dynamically hijacking their own reasoning,” 2025. [Online]. Available: https://arxiv.org/abs/2503. 01908

    2025

  29. [29]

    Bench- marking and defending against indirect prompt injection attacks on large language models,

    J. Yi, Y . Xie, B. Zhu, E. Kiciman, G. Sun, X. Xie, and F. Wu, “Bench- marking and defending against indirect prompt injection attacks on large language models,” inProceedings of the 31st ACM SIGKDD Conference on Knowledge Discovery and Data Mining V . 1, 2025, pp. 1809–1820

    2025

  30. [30]

    Agent security bench (asb): Formalizing and benchmark- ing attacks and defenses in llm-based agents,

    H. Zhang, J. Huang, K. Mei, Y . Yao, Z. Wang, C. Zhan, H. Wang, and Y . Zhang, “Agent security bench (asb): Formalizing and benchmark- ing attacks and defenses in llm-based agents,” inInternational Con- ference on Learning Representations, vol. 2025, 2025, pp. 35 331– 35 366

    2025

  31. [31]

    Universal and context-independent triggers for precise control of llm outputs,

    J. Liang, G. Li, and Y . Yu, “Universal and context-independent triggers for precise control of llm outputs,”arXiv preprint arXiv:2411.14738, 2024

    Pith/arXiv arXiv 2024

  32. [32]

    Trojan’s whisper: Stealthy manipulation of openclaw through injected bootstrapped guidance,

    F. Liu, Z. Chen, T. Lan, H. Tan, Z. Xu, X. Li, G. Chen, Y . Meng, and H. Zhu, “Trojan’s whisper: Stealthy manipulation of openclaw through injected bootstrapped guidance,”arXiv preprint arXiv:2603.19974, 2026

    arXiv 2026

  33. [33]

    Openclaw docs,

    OpenClaw Docs, “Openclaw docs,” https://docs.openclaw.ai/, 2026

    2026

  34. [34]

    Fine-tuned deberta-v3-base for prompt injection detection,

    ProtectAI.com, “Fine-tuned deberta-v3-base for prompt injection detection,” 2024. [Online]. Available: https://huggingface.co/ ProtectAI/deberta-v3-base-prompt-injection-v2

    2024

  35. [35]

    Defending against indirect prompt injection attacks with spotlight- ing,

    K. Hines, G. Lopez, M. Hall, F. Zarfati, Y . Zunger, and E. Kiciman, “Defending against indirect prompt injection attacks with spotlight- ing,”arXiv preprint arXiv:2403.14720, 2024. Ethical Considerations This work is dual-use. Our goal is to help defenders evaluate agentic systems before deployment, identify indi- rect prompt-injection failures, and hard...

    Pith/arXiv arXiv 2024

  36. [2022]

    Available: https://arxiv.org/abs/2212.14315

    [Online]. Available: https://arxiv.org/abs/2212.14315

    Pith/arXiv arXiv