Source-linked AI summary
AdapTools: Adaptive Tool-based Indirect Prompt Injection Attacks on Agentic LLMs
Che Wang, Jiaming Zhang, Ziqi Zhang, Zijie Wang, Yinghui Wang, Jianbo Gao, Tao Wei, Zhong Chen, Wei Yang Bryan Lim
TL;DR
External services make LLM agents more capable but expose them to indirect prompt injection, while existing attacks rely on static patterns and simple-model evaluations. AdapTools constructs transferable attack strategies and selects task-relevant tools to generate adaptive, stealthy attacks, achieving up to a twofold ASR increase while remaining effective against defenses. Its strategy construction faces scalability and generalization limits as tool-strategy combinations grow.
Problem
Existing IPI attacks rely on static patterns and evaluations on simple language models, limiting security assessment of fast-evolving reasoning agents exposed to external services.
Method
AdapTools combines adaptive attack strategy construction with attack enhancement that selects task-relevant tools and embeds malicious intent in realistic agent trajectories.
Results
AdapTools achieves up to a twofold increase in ASR across six LLMs and remains effective in the presence of defenses.
Takeaways & Limitations
IPI-3K and AdapTools provide tools for rigorous vulnerability assessment and for developing more secure agentic LLM systems.
Takeaways & Limitations
The attack-strategy retrieval process becomes computationally prohibitive and prone to erroneous tool-strategy mappings in long-context sequences, while fine-grained strategies generalize poorly to unseen conditions.
Abstract
from arXiv · showhide
The integration of external data services (e.g., Model Context Protocol, MCP) has made large language model-based agents increasingly powerful for complex task execution. However, this advancement introduces critical security vulnerabilities, particularly indirect prompt injection (IPI) attacks. Existing attack methods are limited by their reliance on static patterns and evaluation on simple language models, failing to address the fast-evolving nature of modern AI agents. We introduce AdapTools, a novel adaptive IPI attack framework that selects stealthier attack tools and generates adaptive attack prompts to create a rigorous security evaluation environment. Our approach comprises two key components: (1) Adaptive Attack Strategy Construction, which develops transferable adversarial strategies for prompt optimization, and (2) Attack Enhancement, which identifies stealthy tools capable of circumventing task-relevance defenses. Comprehensive experimental evaluation shows that AdapTools achieves a 2.13 times improvement in attack success rate while degrading system utility by a factor of 1.78. Notably, the framework maintains its effectiveness even against state-of-the-art defense mechanisms. Our method advances the understanding of IPI attacks and provides a useful reference for future research.
1 Introduction
Modern agents gain capability by accessing external services, but this expands exposure to indirect prompt injection. AdapTools addresses limitations of existing attacks with adaptive strategies and stealthier, task-relevant tools, achieving stronger attack performance against multiple agents and defenses.
- Motivation: External services such as MCP expand agent capabilities while exposing agents to injected instructions that can trigger unauthorized behavior.IPI attacks exploit interactions with intermediate servers, websites, and databases.
- Motivation: Reasoning agents require attacks that jointly provide robustness, adaptability, and stealthiness against internal scrutiny and evolving defenses.Static patterns can be filtered, while unrelated tools may be flagged as inconsistent with the user’s task.
- Approach: AdapTools combines adaptive attack strategy construction with attack enhancement through task-relevant tools and realistic agent trajectories.The workflow selects a suitable tool, generates matched prompts, embeds them in benign content, and returns the result to the agent.
- Results: AdapTools roughly doubles ASR over the best 14.5% baseline on GPT-4.1, DeepSeek-R1, and Gemini-2.5.On Qwen3, LLaMA3.1, and Mistral, average ASR is 58.1% versus 38.2% for the baseline; defenses reduce ASR by nearly 50%.
- Contributions: The work introduces IPI-3k, proposes a unified adaptive attack method, and evaluates it on open-source and commercial reasoning LLMs.The experiments assess whether the method bypasses existing security mechanisms, including defenses.
2 Related Work
Prior work includes multiple IPI attack patterns, benchmarks, and input- or output-level defenses. Existing benchmarks have limited tool diversity and test coverage, motivating broader evaluation resources.
- IPI Attacks: IPI attacks originate in external data and can induce tool-oriented malicious behavior, system compromise, or private-data exfiltration.Injected instructions may appear benign to the agent, complicating detection and mitigation.
- IPI Attacks: Prior attacks include escape-character, context-ignore, combine, and LLM-optimized prompt-generation methods.These methods range from altering context parsing to combining strategies or generating more robust prompts.
- Defense Methods: Defenses include static instruction prevention, data-prompt isolation, sandwich prevention, classifiers, fine-tuned detectors, and heuristic filtering.These methods operate at input or output stages and use rules, classifiers, or trained models.
- Benchmarks: Existing benchmarks exhibit limited tool diversity and narrow test coverage for realistic agent scenarios.IPI-3K is introduced to evaluate adaptive attacks across more diverse modern tool ecosystems.
3 Adaptive Attack Trajectory Construction
IPI-3K broadens adaptive-attack evaluation with realistic multi-step trajectories and high-authority attack tools. Its construction separates adversarial entrypoints from terminal harms and supports systematic robustness testing.
- Dataset Construction: IPI-3K contains 3,691 benign agent trajectories covering multi-step processes that require external data retrieval.The dataset consolidates and reorganizes established benchmarks for more realistic agent scenarios.
- Dataset Construction: IPI-3K includes 277 attack tools with high-authority permissions to access sensitive user information.These tools extend the attack-tool set beyond narrow benchmark coverage.
- Attack Components: An entrypoint is the tool interface to an intermediate server that provides an adversarial access vector.In a shopping task, the entrypoint could query a product platform through an external server.
- Attack Components: Direct harm is the adversary’s terminal objective, categorized as data leakage, financial loss, or system harm.Commercial LLMs assign risk scores from 0 to 10 to help assess attack tools.
- Evaluation: Malicious intent is injected into retrieved clean content, enabling IPI-3K to support rigorous robustness evaluation of agentic LLMs.The benchmark is designed to support multiple attack methodologies.
4 Motivation
The motivation analysis examines why function-calling agents resist existing IPI attacks and identifies three exploitable failure modes. These observations motivate adaptive prompt construction and task-specific tool selection.
- Analysis: Post-hoc analysis with reasoning models examines attack failures that remain opaque because agents expose only final function names and arguments.The study evaluates representative attacks on IPI-3K using Qwen3-8B-Thinking and DeepSeek-R1.
- Reasoning Models: Under combined attack, thinking-enabled Qwen3-8B reaches 19.4% ASR, below non-thinking Qwen3-8B at 26.1%.The paper attributes this resistance to explicit chain-of-thought reasoning that compares prompts with the original task.
- Defense Analysis: Modern agents reject attacks for Security Risk and Red Herring reasons, indicating that static template attacks can be filtered by built-in safety mechanisms.The analysis argues that template-based prompt injection is difficult in real-world scenarios.
- Failure Modes: Unrelated Information is another failure mode because selected tools may not match the user’s goal.This task-specificity problem motivates the method’s tool-selection design.
5 Methodology
AdapTools models agent execution as iterative planning and environment interaction, then constructs adaptive attack strategies and selects task-relevant malicious tools. Its design targets Red Herring, Security Risk, and Unrelated Information while addressing strategy scalability and transferability.
- Agent Execution: Tool-augmented agents generate actions from user instructions and context, invoke external tools, and incorporate returned observations into subsequent reasoning.Execution trajectories record instructions, action-tool-observation tuples, and iterative context updates.
- Attack Design: AdapTools targets Red Herring, Security Risk, and Unrelated Information as exploitable failure modes in function-calling agents.Its modules respectively update attack strategies and embed adversarial payloads through vulnerable unrelated content.
- Attack Objective: The attack objective is to maximize the victim agent’s probability of executing a malicious tool by optimizing a strategy and generated adversarial prompt.The prompt generator conditions on the target tool and selected strategy, while the objective depends on the historical trajectory and injected observation.
- Adaptive Attack Construction: Adaptive strategy construction generates diverse strategies, diagnoses failed attacks, and iteratively refines successful strategies for reuse across agent systems and datasets.Strategy distillation compresses fine-grained rules into a compact, transferable repository, addressing scalability and over-specialization.
- Attack Enhancement: Attack Enhancement selects malicious tools that are temporally plausible and semantically aligned with the current trajectory instead of sampling randomly.The design responds to defenses that cross-reference user intent with tool functionality and to coherence differences between task-relevant and incongruous tools.
6 Experiments
Experiments evaluate AdapTools across six LLM agents, multiple datasets, attack baselines, and defenses. The method consistently improves attack success, transfers across benchmarks, and retains effectiveness under detection mechanisms.
- Experimental Setup: AdapTools is evaluated on six open-source and commercial LLMs using the ReAct framework, three datasets, and attack and defense baselines.The datasets are IPI-3k, InjectAgent, and AgentDojo; defenses include MELON and Pi-Detector.
- Attack Performance: 2.13× higher ASR is achieved on commercial LLMs than the best baseline, with GPT-4.1 reaching 18.5% versus baseline averages below 8%.Gemini-2.5-Flash reaches 25.9% versus 9.2%, and DeepSeek-R1 reaches 13.5% versus 6.7%.
- Attack Performance: Open-source agents show weaker defense capability, with ASR exceeding 30% on average; Mistral-8B reaches 49.0%, while Qwen3-8B reaches 44.5%.LLaMA-3.1-8B has 31.4% ASR but severe utility degradation, whereas Qwen3-8B preserves benign utility more effectively.
- Defense Robustness: Defenses reduce AdapTools’ ASR by about 2×, whereas baseline attacks experience reductions of at least 3×.For GPT-4.1, ASR falls from 26.1% without defenses to 13.3% and 16.1% with defenses.
- Transferability: AdapTools transfers across datasets, outperforming Autohijacker by 3.6% on GPT-4.1 and 6.5% on Qwen3-8B in InjectAgent, while also leading on AgentDojo.The InjectAgent setting has lower overall ASR than the more realistic dataset, which the authors attribute to rapidly updated security mechanisms.
- Ablation Studies: Tool selection increases ASR by 4.7% on GPT-4.1 and 7.9% on Qwen3-8B, while iterative strategy optimization raises ASR from about 35% to over 80%.The iteration results eventually converge, with six or seven iterations yielding only slightly higher ASR than the default setting.
7 Conclusion
The paper addresses limitations of existing IPI attacks by introducing IPI-3k and AdapTools for more realistic evaluation of fast-evolving, reasoning-capable agents. Across six LLMs, AdapTools substantially increases attack success and remains effective under defenses.
- Contributions: IPI-3k provides a foundational dataset for simulating agent scenarios and analyzing IPI attack failure modes.The dataset supports more realistic evaluation of fast-evolving LLM-based agents, particularly reasoning models.
- Contributions: AdapTools combines adaptive attack tool selection with adaptive prompt generation to produce attacks that are adaptive, stealthy, and robust.The framework is designed for both attack tool selection and prompt generation.
- Findings: Across six LLMs, AdapTools achieves up to a twofold increase in ASR while remaining effective in the presence of defenses.The authors present the method as advancing understanding of IPI attacks and informing future research.
Impact Statement.
The work aims to improve LLM-agent security and robustness through vulnerability identification and the IPI-3K benchmark. It frames rigorous assessment and proactive defense as supporting public trust in autonomous agents.
- Impact: The study identifies vulnerabilities in function-calling trajectories and introduces the IPI-3K benchmark to support development of more secure AI systems.The authors state that these tools are intended to enable robust defensive research.
- Societal Consequence: The stated societal consequence is improved public trust in autonomous agents through proactive defense and rigorous vulnerability assessment.The authors report weighing the benefits of defensive research against potential misuse risks from disclosing attack methods.