How Vulnerable Are AI Agents to Indirect Prompt Injections? Insights from a Large-Scale Public Competition

Indirect prompt injection is an attacker hiding instructions in content an agent will read: an email, a code comment, a pull-request description, a sidebar on a web page. This paper adds a second requirement that matches how people use agents: the attack must also be concealed. Users mostly read the agent's final reply, not its tool logs. If the reply looks normal, the user has no reason to suspect that the agent just did something harmful.

Gray Swan AI ran the Indirect Prompt Injection Arena with the UK AI Security Institute, the US Center for AI Standards and Innovation, and labs including OpenAI, Anthropic, Amazon and Meta. Over three weeks, with a $40,000 prize pool, 464 participants made about 272,000 attack attempts against 13 models (models were anonymized to participants). There were 41 scenarios in three settings: tool-using agents (18), coding agents (15) and computer-use agents (8). In each, the attacker controlled one piece of external content, and success required both a programmatic check that the harmful action happened and a judge's check that the final reply concealed it. Harmful actions were chosen to fit the task: an email-triage agent marking a contract-deadline email as read, a coding agent inserting a backdoor while fixing a bug.

Results. Every model was broken. Attack success per attempt ranged from 0.5% for Claude Opus 4.5 to 8.5% for Gemini 2.5 Pro, with Claude and GPT models the most robust. Successes kept accumulating at a steady rate as attempts grew, so persistence paid off against every model. Attacks that broke the most robust model worked on 44% to 81% of the others; attacks that broke weak models rarely worked upward. One family of templates, which frames the conversation as a simulated environment with a fake control interface, worked across 21 of the 41 scenarios and 9 models.

The question a customer's security team will ask is "can someone make this agent do something harmful?" This paper's answer for every model tested is yes, at some rate, and the rate is not the whole story.

Low per-attempt rates still add up. At 0.5% per attempt, an attacker has even odds after about 136 attempts; at 8.5%, after 8. An agent reading thousands of external items a day will see hostile ones eventually. Plan for some injections to succeed.

Concealment changes incident response. A successful attack here leaves a normal-looking reply. If your detection depends on a user noticing something odd, these attacks will not be reported. Log tool calls and check them automatically.

Model choice helps, but not enough. Model family mattered more than benchmark capability, and the most robust models were far harder to break. But attacks that beat them transferred widely, which tells you the weakness is shared. The authors call for system-level defenses: constrain what the agent can do, and keep untrusted content away from control decisions.

Coding agents are not exempt. Coding scenarios had the lowest success rate, possibly because their transcripts came from real coding tools, but injections in comments, configuration files and PR descriptions still made agents run dangerous commands or approve changes they should not.