Indirect Prompt Injection Susceptibility in DeepSeek Harness (Research Assessment)

Technical Analysis

The research targets DeepSeek Harness's agent loop, tool registry, model adapter, and session-event handling, injecting adversarial content through 16 indirect channels (e.g., tool results, files, skills) and 35 payload objectives across 12 attack methods such as fake-completion and hidden Unicode encoding. The entry point is untrusted content returned from tool calls or file reads that the model processes as context, which can cause the agent to deviate from its intended task (goal hijack) without any direct user-supplied malicious prompt. Success is judged both by deterministic rule-matching and semantic LLM judgment, revealing that harder-to-detect partial compliance is more common under LLM-based judging (7.3% vs 2.0%), suggesting current rule-based defenses undercount actual susceptibility. The crossing point of concern is the boundary between tool/file output (untrusted) and the agent's action-taking policy — if tool-call policy hooks do not adequately sanitize or distrust this content, downstream sensitive actions could be triggered. All experiments were conducted with local fixtures and no external side effects, confirming this is a controlled research setting rather than an in-the-wild attack.

Affected Systems

DeepSeek Harness, AI-Infra-Guard (A.I.G)

Detection Signatures

• Tool or file outputs containing fake task-completion markers or false 'success' assertions designed to alter agent behavior
• Hidden/zero-width Unicode characters embedded in file content processed by agents
• Unexpected instructions embedded within skill definitions or skill-channel metadata
• Discrepancy between rule-based judged outcomes and semantic/LLM-judged outcomes on identical agent traces (indicates undercounted partial compliance)
• Agent session logs showing tool-call policy hooks bypassed after ingesting external file or tool content

Remediation Steps

1. 1

   Sanitize and isolate untrusted tool/file content

   Treat all content returned from tools, files, or skill registries as untrusted input; strip or neutralize hidden Unicode, encoded instructions, and completion-mimicking text before it reaches the model context.

2. 2

   Enforce tool-call policy hooks with allow-listing

   Implement strict policy checks between tool outputs and sensitive action execution, requiring explicit re-validation before actions are taken based on injected or externally sourced content.

3. 3

   Use layered judges for red-teaming

   Combine rule-based and semantic/LLM-based judges when evaluating agent robustness, since rule-based judges alone underreport partial compliance and subtle goal deviation.

4. 4

   Segregate model adapter context boundaries

   Clearly separate system/user instructions from tool-result content in the model context window to reduce the chance that injected content is interpreted as authoritative instructions.

5. 5

   Continuously benchmark with adversarial suites

   Adopt or replicate the A.I.G-style test harness (16 channels, 35 objectives, 12 methods) as part of CI/CD security regression testing for agent deployments.