Test-Time Search Amplification of Indirect Prompt Injection Against Tool-Using Agents
First seen Sep 8, 2026 · Updated Sep 8, 2026
This is an academic research paper (not an active exploit) that reframes indirect prompt injection as a search problem, showing that an attacker agent with more compute and structured strategy management becomes significantly better at finding and exploiting injection vulnerabilities in victim agents. The core finding is that attack success scales with attacker search budget and adaptive strategy, meaning current security evaluations that treat 'attack success' as fixed likely underestimate real-world risk against tool-using agents.
Technical Analysis
The paper introduces an 'agentic attacker' that performs environment reconnaissance, reasons over candidate injection strategies, and adaptively refines its attack using feedback from the victim agent's behavior, effectively running an automated red-team loop rather than a single crafted payload. The entry point remains classic indirect prompt injection: untrusted content in the environment (documents, tool outputs, web pages, etc.) consumed by the victim agent's context. What is novel is the attacker's use of increased test-time compute and explicit strategy management to systematically explore the attack surface, avoiding redundant search and converging on effective exploits faster and more reliably than static or one-shot injection attempts. This crosses agent boundaries because the victim agent's tool-use loop (ingesting external content, acting on it, and producing observable feedback) is exactly the channel the attacker's search harness exploits to iteratively improve its injected instructions.
Detection Signatures
- Repeated near-identical tool/document requests from the same session with incrementally varied phrasing (indicative of search iteration)
- Anomalous multi-turn probing patterns where injected content changes structure across retries
- Victim agent logs showing tool outputs or retrieved documents containing imperative instructions, role reassignments, or system-prompt-like phrasing
- High-frequency reconnaissance-style tool calls preceding a successful goal deviation
- Sudden behavioral shift in agent action sequence following ingestion of external/environment content
Remediation Steps
- 1
Treat injection resistance as budget-dependent
When red-teaming or certifying agents, evaluate robustness against attackers with varying compute/search budgets rather than a single static payload test.
- 2
Isolate and sanitize environment content
Apply strict content provenance separation (system/user vs. tool/environment) so retrieved or tool-returned text cannot be interpreted as instructions.
- 3
Rate-limit and monitor adaptive probing
Detect and throttle sessions exhibiting iterative reconnaissance/retry patterns characteristic of automated search-based attackers.
- 4
Constrain feedback leakage to attackers
Limit how much of the victim agent's internal reasoning or action outcomes is observable externally, reducing the signal an adaptive attacker can exploit.
- 5
Use structured tool-output validation
Apply schema/allowlist validation on tool and document outputs before they re-enter the agent's planning context.
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.