The authors formulate indirect prompt injection as a test-time search process influenced by environment, user, and injection tasks. They introduce an agentic attacker equipped with a search harness that performs environment reconnaissance, structured reasoning, and adaptive evaluation with victim-agent feedback.
Findings indicate that increasing attacker compute during testing enhances the ability to discover and exploit vulnerabilities. Ablation studies show that explicit management of attack strategies is crucial for avoiding redundant searches and maintaining effectiveness at larger compute budgets.
These results suggest that security evaluations should consider both the attacker's search procedure and compute resources, rather than treating attack success as independent of the attacker's effort. The study highlights the importance of adaptive search over system attack surfaces as an underexplored security risk for tool-using agents.
Source: https://arxiv.org/abs/2609.04495