Ignored, Not Refused: What Low Prompt-Injection Success Rates Hide in Small Tool-Using Agents
The paper audits 33k runs of small open-weight tool-using agents on indirect prompt-injection benchmarks and shows that low attack success rates usually mean the agents ignored the injected instruction, not that they explicitly detected and refused it. The useful twist is its ATOM breakdown separating attack outcome from task completion—showing prompt wording alone can swing ASR massively and that many “safe” runs fail the user task too—though the conclusions lean on an LLM judge and are limited to relatively small open models and existing benchmark setups.
Abstract
Tool-using agents read untrusted external content, which exposes them to indirect prompt injection (IPI), where hidden instructions hijack the agent's tool calls. Benchmarks measure IPI security by the attack success rate (ASR), which treats every failed attack as a successful defense. To test this assumption, we audit 33,000 trajectories from eleven open-weight agents (2-14B parameters) on InjecAgent and AgentDojo. A label-blind LLM judge shows that most failed attacks are ignored (76-80%) rather than refused (17-18%). With identical model weights, changing only the system prompt shifts InjecAgent ASR from 0.2% to 43%. Our Attack-Task Outcome Matrix (ATOM) further shows that in 21.7% of AgentDojo episodes, the agent stayed safe but did not complete the user's task. A low ASR therefore mostly reflects agents silently ignoring injections, not refusing them. Evaluations should report how attacks fail and whether the user's task is completed, alongside ASR. We release the labeled corpus, judge prompt, and analysis code.