Rethinking Indirect Prompt Injection as a Test-Time Search Problem
The paper reframes indirect prompt injection against tool-using agents as a test-time search problem, where an attacker adaptively explores the environment-, task-, and goal-dependent attack surface using reconnaissance, strategy tracking, and victim feedback. Its key insight is that attack success depends strongly on the attacker’s search algorithm and compute budget—not just the victim model’s inherent robustness—though the results seem bounded by the specific agentic attack harness and task suite, so broader generalization remains an open question.
Abstract
We formulate indirect prompt injection as a test-time search over a task-dependent attack surface induced by the environment, user task, and injection task. To operationalize this formulation, we introduce an agentic attacker with a dedicated search harness that performs environment reconnaissance, structured reasoning over attack strategies, and adaptive evaluation using victim-agent feedback. Across heterogeneous tasks, we find that increasing attacker test-time compute improves vulnerability discovery and exploitation, while ablations show that explicit strategy management is important for avoiding redundant search and sustaining gains at larger budgets. These results suggest that agentic security evaluations should characterize both the attacker's search procedure and compute budget, rather than treating attack success as a budget-independent property of the victim. More broadly, our findings identify the attacker's adaptive search over the system attack surfaces as an important and underexplored security risk for tool-using agents.