Rethinking Indirect Prompt Injection as a Test-Time Search Problem

The paper redefines indirect prompt injection as a test-time search problem, framing it as exploration over a task-dependent attack surface shaped by the environment, user task, and injection task. It introduces an agentic attacker equipped with a search harness that conducts environment reconnaissance, structured reasoning on attack strategies, and adaptive evaluation using victim-agent feedback. Experiments across diverse tasks show that higher attacker compute leads to better vulnerability discovery, and that managing search strategies is crucial to avoid redundancy and maintain gains at larger budgets.

Machine-generated by The Flow from the publisher's headline and feed description — not written or checked by a human. The full article lives at arXiv AI.

• agents