Indirect Prompt Injection Susceptibility in DeepSeek Harness (Research Benchmark)
First seen Aug 18, 2026 · Updated Aug 19, 2026
This is an academic security assessment (not an active exploit) measuring how susceptible the DeepSeek Harness agent is to indirect prompt injection delivered through tool outputs, files, and other untrusted content channels. Using the AI-Infra-Guard testing framework, researchers found measurable but moderate attack success rates (up to ~25.5% for hidden Unicode payloads in file mode), indicating real but partial resistance gaps rather than a fully broken system. The findings are useful for hardening DSH's handling of tool results and untrusted content before it reaches model context or triggers actions.
Technical Analysis
The study injects adversarial 'taint' content through 16 indirect channels (e.g., tool call results, file content, skills metadata) and 12 attack methods including fake-completion signaling and hidden Unicode encoding, targeting DeepSeek Harness's agent loop, tool registry, and model adapter. The entry point is untrusted content ingested via tool execution or file/session context rather than direct user prompts, which then influences the model's subsequent reasoning or tool-call decisions. Success is measured by whether the harness executes unintended tool actions or produces policy-violating outputs, judged both by deterministic rules and an LLM-based semantic judge, with LLMJudge detecting more subtle partial compliance than RuleJudge. The core risk is that content boundaries between 'tool output data' and 'instructions' are not consistently enforced, allowing crafted content returned from tools or embedded in files to redirect agent behavior — a classic confused-deputy pattern crossing the tool/model trust boundary. Because the study uses local fixtures with no external side effects, this represents a controlled research finding rather than an in-the-wild compromise.
Affected Systems
DeepSeek Harness, AI-Infra-Guard
Detection Signatures
- Anomalous partial-compliance responses following tool-result ingestion
- Hidden or non-printing Unicode characters embedded in file content processed by agent
- Tool or skill descriptions containing embedded imperative instructions directed at the model
- Unexpected tool-call sequences immediately following ingestion of external file/text content
- Discrepancy between rule-based judge and semantic judge flags on the same trace (indicates subtle injection)
Remediation Steps
- 1
Sanitize and normalize untrusted content
Strip or normalize hidden/non-printing Unicode and other steganographic encodings from file and tool-result content before it enters the model context.
- 2
Enforce strict content/instruction separation
Tag tool outputs and file content as untrusted data with clear delimiters and system-level policy preventing them from being interpreted as instructions.
- 3
Add tool-call policy hooks with allow-lists
Insert a policy enforcement layer between tool results and sensitive actions that validates intended actions against expected task scope before execution.
- 4
Use layered judges in production monitoring
Deploy both rule-based and semantic LLM-based judges in production to catch partial-compliance and subtle injection outcomes missed by single-method detection.
- 5
Restrict high-risk channels
Apply extra scrutiny or sandboxing to the highest-risk channels identified (file mode, hidden Unicode, skills channel) since they showed the highest attack success rates.
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.