WhitzardNUWA Lab ↗
NUWANUWA INDEX

Search NUWA Index

Research · Benchmarks · Findings · Perspectives

中文
← Library

Risk Evaluation · Benchmark

InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents

NUWA research note · independent review pending

First published: Source checked: 2026-10-25
Original source ↗Cite this record ↓Cybersecurity →
NUWA Research NoteResearch questionDesign and assumptionsSource findingsNUWA interpretationLimits and contrary evidenceResearch and decision relevanceInstitutions and rolesOriginal resources

Model-assisted reading · Selected sections of the original full text or official article; a complete section-by-section audit remains pending.

At a glance

NUWA interpretation: success rates require the valid-output denominator and simulation assumptions.

Research question

How vulnerable are tool-integrated agents to attacker instructions in external content?

Design and assumptions

1,054 simulated cases span seventeen user tools and 62 attacker tools; thirty agents are evaluated, with valid-output rates reported separately.

InjecAgent — Figure 6
Figure 6 · Original figure 6. Read alongside the protocol scope and limitations below. Original figure and source ↗

Source findings

ReAct GPT-4 was vulnerable in 24% of evaluated cases, with a near doubling in the enhanced condition.

Unparseable and otherwise invalid outputs are excluded from robustness assessment (§3.1).

NUWA interpretation

NUWA interpretation: success rates require the valid-output denominator and simulation assumptions.

Limits and contrary evidence

The enhanced setting uses one fixed reinforcement prompt; single-turn simulation does not capture all adaptive multi-step behavior.

Research and decision relevance

Model recommendation: retain validity rates and distinguish baseline from enhanced attacks.

Precise source locations

Source checking, extraction, editorial approval and replication are recorded separately. Methodology →

Institutions and roles

Research by University of Illinois Urbana-Champaign

Authors (4)

Qiusi Zhan · Zhixiang Liang · Zifan Ying · Daniel Kang

Evaluation protocols

InjecAgent →

Cite and reuse

Cite the original publication for its findings. Cite this NUWA record separately for its explanation and retained snapshot.

BibTeX ↓RIS ↓Record + source metadata · JSON ↓Reading coverage · JSONSuggest a correction
Original publication · BibTeX
@misc{injecagent,
  title = {InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents},
  url = {https://arxiv.org/abs/2403.02691},
  author = {Qiusi Zhan and Zhixiang Liang and Zifan Ying and Daniel Kang},
  year = {2024},
  date = {2024-03-05},
  version = {arXiv:2403.02691v3},
  note = {arXiv:2403.02691v3}
}
NUWA record · BibTeX
@misc{injecagent-nuwa,
  title = {InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents — NUWA research record},
  url = {https://whitzard.tech/en/nuwa/whitzard-index/work/injecagent/},
  version = {2026-10-29.1},
  organization = {NUWA Frontier AI Safety Lab},
  howpublished = {Retained note edition: https://whitzard.tech/nuwa/whitzard-index/data/record-editions/2026-10-29.1--injecagent.json},
  note = {NUWA research note. Source-reading scope and independent review status are stated on the record. Snapshot 2026-10-29.1. Retained note edition: https://whitzard.tech/nuwa/whitzard-index/data/record-editions/2026-10-29.1--injecagent.json.}
}

Evidence snapshot 2026-10-29.1 · Index updates · RSS

References

  1. [1] Qiusi Zhan, Zhixiang Liang, et al.. InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents. 2024-03-05. v3 [arXiv]; Author affiliations on the original paper title page; Abstract; §2 Benchmark Construction