Your Agent is More Brittle Than You Think: Uncovering Indirect Injection Vulnerabilities in Agentic LLMs

arXiv cs.CL / 4/7/2026

💬 OpinionIdeas & Deep AnalysisTools & Practical UsageModels & Research

共有:

Key Points

The paper shows that agentic LLMs are vulnerable to Indirect Prompt Injections (IPI), where malicious instructions hidden in third-party content can cause unauthorized actions like data exfiltration during normal multi-step tool use.
It argues that existing security evaluations using mostly isolated single-turn benchmarks miss key systemic weaknesses, so the authors evaluate six defense strategies against multiple IPI attack vectors across nine LLM backbones in dynamic tool-calling environments.
The results indicate pronounced fragility: advanced IPI attacks bypass nearly all baseline defenses, and some mitigations can even introduce counterproductive side effects.
Although malicious actions may be triggered almost instantaneously, the agents’ internal decision states show abnormally high entropy, suggesting a detectable “latent hesitation” signal.
The study proposes Representation Engineering (RepE) as a detection approach that monitors hidden states at the tool-input point, enabling a circuit breaker that intercepts unauthorized actions with high accuracy across diverse LLM backbones.

Abstract

The rapid deployment of open-source frameworks has significantly advanced the development of modern multi-agent systems. However, expanded action spaces, including uncontrolled privilege exposure and hidden inter-system interactions, pose severe security challenges. Specifically, Indirect Prompt Injections (IPI), which conceal malicious instructions within third-party content, can trigger unauthorized actions such as data exfiltration during normal operations. While current security evaluations predominantly rely on isolated single-turn benchmarks, the systemic vulnerabilities of these agents within complex dynamic environments remain critically underexplored. To bridge this gap, we systematically evaluate six defense strategies against four sophisticated IPI attack vectors across nine LLM backbones. Crucially, we conduct our evaluation entirely within dynamic multi-step tool-calling environments to capture the true attack surface of modern autonomous agents. Moving beyond binary success rates, our multidimensional analysis reveals a pronounced fragility. Advanced injections successfully bypass nearly all baseline defenses, and some surface-level mitigations even produce counterproductive side effects. Furthermore, while agents execute malicious instructions almost instantaneously, their internal states exhibit abnormally high decision entropy. Motivated by this latent hesitation, we investigate Representation Engineering (RepE) as a robust detection strategy. By extracting hidden states at the tool-input position, we revealed that the RepE-based circuit breaker successfully identifies and intercepts unauthorized actions before the agent commits to them, achieving high detection accuracy across diverse LLM backbones. This study exposes the limitations of current IPI defenses and provides a highly practical paradigm for building resilient multi-agent architectures.