Source-linked AI summary
AgentLSD: Evaluating AI Security Agents Under Adversarial Task Contamination
Matteo Golinelli, Idilio Drago, Matteo Boffa, Francesco Bergadano, Bruno Crispo
TL;DR
Security agents encounter attacker-controlled evidence that can mislead them without giving instructions. AgentLSD uses paired CTF experiments to measure environmental deception; traps impose substantial effort costs, while effects on solving vary across model–challenge pairs.
Problem
Security agents process attacker-controlled content, and deceptive evidence can alter what they trust or explore without issuing instructions.
Source: §1 · p. 1Method
AgentLSD injects deterministic traps into paired web CTF challenges while preserving the intended task, and records agent interactions.
Source: §1 · pp. 1–2Results
Traps usually do not flip outcomes for agents that can already solve a challenge, but successful runs typically require +20 turns and solve-rate effects vary.
Source: §1 · p. 2, §7 · p. 10Takeaways & Limitations
Adversarial task contamination is a distinct robustness problem, and clean CTF performance alone does not capture agents’ responses to deceptive task evidence.
Source: §7 · p. 10The trap set is narrow: traps are DOM-delivered, static, and activated one at a time, and the corpus contains 11 web CTF challenges.
Source: §7.2 · p. 11
Abstract
from arXiv · showhide
AI agents for security inspect web pages, source code, logs, configuration files, and command outputs. These environments may contain deceptive artifacts that influence the agent's behavior. We call this adversarial task contamination. Whereas prompt injection relies on attacker-supplied instructions, task contamination also includes non-instructional evidence, such as fake results and decoy endpoints. We present AgentLSD, a controlled framework for studying adversarial task contamination. AgentLSD uses Capture the Flag (CTF) challenges as its experimental environment. We inject trap artifacts, such as fake flags, misleading hints, decoy endpoints, and hidden cues, while preserving the intended CTF solution. The framework supports paired clean and trap-augmented experiments with deterministic trap generation, runtime injection, telemetry, and delivery verification. We evaluate six models on 11 web CTF challenges. In the clean condition, agents capture 41% of the flags, and no model solves every challenge. We then measure the impact of task contamination. Even when the agent still recovers the flag, traps increase the number of turns (+20) and reasoning tokens (+2k). Solve-rate effects are more heterogeneous, as some model-challenge pairs are largely unaffected while others follow decoys or submit wrong flags. These results show that clean CTF performance understates vulnerability to deceptive task evidence. AgentLSD isolates this effect and provides a reproducible benchmark for studying it. We release the framework, configurations, trap specifications, and raw traces.
1 Introduction
Security agents must distinguish trustworthy instructions from attacker-controlled evidence, which can mislead them without issuing commands. AgentLSD provides paired clean and trap-augmented CTF experiments to measure how such deception affects solving and effort.
1 Introduction
- Adversarial task contamination adds attacker-controlled artifacts while keeping the canonical task and success criterion fixed, including deceptive evidence that issues no instruction.This overlaps with prompt injection but is not identical: contamination can change which evidence agents trust or explore.Source: §1 · p. 1
- AgentLSD pairs clean and trap-augmented web CTF challenges while preserving the intended vulnerability, solution path, and flag-checking logic.The framework uses reusable trap primitives, deterministic instances, runtime injection, telemetry, and delivery verification.Source: §1 · pp. 1–2
- Six models are evaluated on 11 web CTF challenges in the clean condition, with the strongest also tested in paired clean and trap conditions.The introduction organizes the study around clean solving, changes among clean successes, trap-family effects, and observable agent behavior.Source: §1 · p. 2
- 41% of flags were captured under clean conditions; under traps, successful agents typically used +20 turns and 2,000 reasoning tokens, while solve-rate effects varied.Goal-hijack and exploration-bait caused the largest degradation in these experiments.Source: §1 · p. 2
- The paper frames adversarial task contamination as a distinct robustness problem and releases the framework, configurations, trap specifications, and raw traces.The introduction also identifies agents’ exposure to attacker-controlled pages, source files, and logs as motivation for studying the threat.Source: §1 · pp. 1–2
2 Background and Related Work
Security agents ingest observations that adversaries may control, making evidence trust a security concern. The paper uses CTFs for controlled comparisons and positions AgentLSD as a way to study environmental deception beyond instruction-following attacks.
2.1 Agents for Security Analysis
- Agents combine task instructions, interaction history, and tool observations in context, but must still distinguish authoritative instructions from potentially adversarial content.Security workflows often involve dependent actions, while inspected artifacts may be attacker-controlled.Source: §2.1 · p. 2
2.2 CTFs as a Testbed
- CTFs provide objective flag-based success criteria and reproducible trials, enabling controlled comparisons while the base challenge remains fixed.They are imperfect models of production security work because flags are artificial and challenges are constructed as puzzles.Source: §2.2 · p. 2
2.3 Positioning
- Unlike prior work [19], AgentLSD holds a solvable task fixed and measures behavioral changes from added environmental artifacts, focusing robustness analysis on clean successes.The design includes traps that are indirect prompt injections and traps that test whether non-instructional evidence changes trust or exploration.Source: §2.3 · p. 2
- AgentLSD repurposes honeytokens and decoys as instrumentation: interactions become attribution signals for when an agent takes the bait.This makes environmental deception a controlled experimental framework rather than solely a defensive mechanism.Source: §2.3 · p. 3
3 Threat Model and Scope
The threat model gives an adversary control over selected artifacts in an otherwise unchanged, solvable security task. Its scope is bounded by fixed, trap-unaware experiments and excludes attacks on the agent or its infrastructure.
3 Threat Model and Scope
- The adversary controls selected artifacts encountered during normal solving, including their wording, placement, visibility, and plausibility, but not the model, prompt, tools, or runtime.The intended vulnerability, solution path, and flag remain unchanged.Source: §3 · p. 3
- Traps aim to derail investigation through misleading cues or false results, while the reference solution defines task identity and preserves the same flag across conditions.Agents can test cues against direct evidence; the study asks whether they do so reliably and within budget.Source: §3 · p. 3
- The experiments assume traps are static, model-agnostic, and unknown to agents, with no external help during a run.Results estimate susceptibility under a fixed prompt; adaptive attackers and instructions to distrust the environment remain future-work settings.Source: §3 · p. 3
- Claims concern controlled deception in CTF environments, not infrastructure compromise, prompt or weight manipulation, external attacks, malware, sandbox escape, or harm to third parties.Differences across models, scaffolds, and context windows do not support general claims about all agents or security workflows.Source: §3 · p. 3
4 AgentLSD Design
AgentLSD separates reusable trap specifications, deterministic instances, runtime delivery, and telemetry so the same challenge can be tested with or without controlled deception. Its taxonomy labels traps by intent independently of delivery surface and target object.
4 AgentLSD Design
- AgentLSD holds the intended solution path fixed while a selected trap is injected at runtime, interactions are recorded, and delivery is verified.This separation supports clean and trap conditions on the same base challenge.Source: §4 · p. 3
4.1 Trap Specification
- YAML primitives specify trap labels and payloads, while resolved instances materialize concrete artifacts and manifests index the configurations for selection and analysis.Primitive labels include perception channel, failure mode, target object, placement, and optional instrumentation.Source: §4.1 · pp. 3–4
4.2 Instance Generation
- Deterministic generation resolves randomized trap values from seeded inputs and checks route collisions and other constraints that guard against interfering with intended solutions.These checks are mechanical guardrails, not proof that a challenge remains semantically unchanged.Source: §4.2 · p. 4
4.3 Deception Runtime
- The runtime pins a resolved instance per request and modifies only eligible HTML responses on intended routes, with an option to return the original response after application errors.Supported DOM placements include visible text, hidden or offscreen nodes, metadata, accessibility labels, and comments.Source: §4.3 · p. 4
4.4 Verification and Telemetry
- A browser-based DOM verifier checks whether payloads reach HTML, visible text, or the accessibility tree, while telemetry records trap rendering and interactions with instrumented decoys.Recorded events include honeytoken hits, rabbit-hole transitions, fake-goal views, and endpoint-trap interactions.Source: §4.4 · p. 4
4.5 Trap Taxonomy and Collection
- The taxonomy separates trap intent from delivery surface and target object, allowing experiments to distinguish what a trap encodes from where it appears.Intent families range from explicit goal redirection to fabricated authority or validation cues and effort-consuming exploration bait or time sinks.Source: §4.5 · pp. 4–5, Table 1 · p. 5
5 Experimental Methodology
The methodology pairs clean and trap conditions while keeping each challenge’s code, vulnerability, flag procedure, and solution path constant. Trials span a controlled web CTF corpus and model set, with fixed prompts, protocol, and effort and solve-rate measures.
5 Experimental Methodology
- Each model first attempts clean challenges; trap trials then retain challenges the model set solves and activate one trap instance per paired trial.This avoids using challenges that no model solves cleanly as evidence about deception effects.Source: §5 · p. 5
5.1 Challenge Corpus
- The corpus contains 11 Flask web CTF challenges across seven vulnerability classes, with four challenges solved only sporadically excluded from the trap phase.Challenges were purpose-built and have fixed documented solutions and reproducible clean and trap deployments.Source: §5.1 · pp. 5–6
5.2 Models
- Six models are evaluated, but model differences describe concrete deployed systems because model family, scale, and other attributes vary jointly.GPT-5 serves as a capability reference but does not receive the full trap factorial because of cost.Source: §5.2 · p. 6
5.3 Task Prompts
- Trials use either a minimal task prompt or a methodical prompt that adds a structured workflow and representative vulnerability probes without challenge-specific solution hints.The presence of deception is not disclosed to agents.Source: §5.3 · p. 6
5.4 Clean and Trap Paired Conditions
- Trap conditions activate exactly one of 14 fixed DOM instances per trial, keeping the delivery channel constant and avoiding confounding textual susceptibility with vision capability.Pixel and hybrid primitives are left for future work.Source: §5.4 · p. 6
5.5 Protocol and Trials
- The protocol uses a shared OpenCode scaffold and black-box interface, fresh containers and flags, exact-flag checking, 30-minute timeouts, and a 200-turn limit.The on-prem trap phase comprises 2,940 trials; GPT-5 adds 121 trials on a reduced grid.Source: §5.5 · pp. 6–7
5.6 Metrics
- Solve rate measures exact-flag submissions and trap degradation is clean minus trap solve rate; turns, tool calls, and tokens measure effort.Telemetry and incorrect flag submissions indicate trap exposure or interaction, while transcript interpretation is left for deeper future analysis.Source: §5.6 · p. 7
6 Evaluation: Impact of Deceptions
Across clean trials, agents captured 41% of flags, while traps produced uneven solve-rate changes but consistently increased effort among successful recoveries. Trap-family and telemetry analyses show that success losses concentrate in redirective traps, while susceptibility depends on disengaging from decoys.
6.2 Effect of Traps (Q2)
- Traps lowered flag capture unevenly but raised turns and reasoning-token use for every model among trap runs that still solved, with overhead ranging from almost none to more than double.Effort comparisons include only successful trap trials; because failed trials stop at the budget limit, the reported effort changes are conservative.Source: Figure 3 · p. 7, §6.2 · pp. 8–9
6.1 Clean-Condition Capability (Q1)
- Clean trials captured 136 of 330 flags (~41%); no model solved every challenge, and four challenges were solved only sporadically.Pairs without demonstrated clean capability were omitted from trap analysis.Source: §6.1 · p. 7, Table 3 · p. 8
6.3 Which Traps Matter (Q3)
- Goal hijack (n=4) and exploration bait (n=3) cause the largest flag-capture losses, while effort rises across essentially every family, including those preserving solve rates.False authority rests on one instance and should be interpreted with care.Source: Figure 4 · p. 8, §6.3 · p. 9
6.4 Trap Interaction (Q4)
- Bait was common (39–57% of trapped runs) but did not track fragility: GPT-OSS won 28% after engaging a decoy versus 65% when avoiding it.GPT-OSS spent a median of about 14 distinct steps on decoy routes, versus roughly 4 for Gemma and DeepSeek; telemetry indicates exposure and engagement, not belief.Source: §6.4 · p. 9
7 Discussion and Conclusion
AgentLSD pairs controlled, deterministic deceptions with fixed CTF challenges to measure their effects on security agents. The results show heterogeneous solve-rate effects and increased effort, while the framework’s current traps and challenge corpus limit generalization.
7 Discussion and Conclusion
- AgentLSD uses reusable primitives to generate concrete traps deterministically and inject them at runtime while keeping the challenge and its solution fixed.The paper positions the framework as a reproducible, open-source way to measure where and how deception affects agents.Source: §7 · pp. 9–10
- Traps rarely change outcomes for agents that already solve a challenge, but impose a large, heterogeneous effort tax; redirection traps drive most outcome loss.All trap families inflate effort, and telemetry shows fragility also depends on how long agents take to disengage from decoys.Source: §7 · p. 10
7.1 Generality and Mitigation
- Measured CTF effect sizes should not be extrapolated directly to production; other settings require domain-specific clean–trap pairs.The authors cite forged security-log events, code-review artifacts, and decoy cloud resources as settings where delivery and consequences may differ.Source: §7.1 · p. 10
- The authors propose provenance labels, independent success checks, trusted validation, and bounded exploration, but leave these mitigations for future evaluation.The flag checker prevents fake flags from counting as success, but not wasted agent budget.Source: §7.1 · pp. 10–11
7.2 Limitations
- AgentLSD’s traps are limited to static, single-at-a-time DOM artifacts, and its corpus contains 11 web CTF challenges with short-to-moderate solution paths.The study also lacks broader frontier-model measurements, benign-injection controls, and significance tests; each cell has five trials.Source: §7.2 · p. 11
A Use of Generative AI
The authors used generative AI tools during code development and text editing, while stating that the research design, analysis, and conclusions were theirs.
A Use of Generative AI
- Generative AI assisted code completions, boilerplate, implementation details, and clarity edits; authors report manually reviewing and adapting all generated code and text.They identify OpenAI 5th-generation and Google Gemini 3rd-generation models as the primary tools used.Source: A Use of Generative AI · p. 12
B Scaffold and Model Configuration
The experiments used a shared OpenCode agent definition across models, with model-specific context and output limits.
B Scaffold and Model Configuration
- All models used the same system prompt, tools, and sampling temperature; context and output limits followed the served model.GPT-OSS 120B alone used a reasoning-effort setting, set to the endpoint’s high value.Source: B Scaffold and Model Configuration · p. 12
C Evaluated Trap Examples
The examples show resolved trap payloads from several failure-mode families, including goal hijack, false authority, false validation, exploration bait, and time sink.
C Evaluated Trap Examples
- The listed resolved payloads pair misleading claims or cues with routes, flags, or parameters that can divert CTF solving.The paper identifies these as one example per failure-mode family; the artifact contains all 14 instances and their placement fields.Source: C Evaluated Trap Examples · p. 12