PaperlayerView exact revision on arXiv

Source-linked AI summary

INFUSE: A Unified Surface Benchmark for Indirect Prompt Injection in Agentic Systems

Thuy Dung Nguyen, Jingyi Guo, Rana Seda Dubauskas, Sreepriya Damuluru, Taylor T. Johnson, Kevin Leach

arXiv:2610.20776v1cs.CRcs.AI

TL;DR

Long-horizon agent workflows expose LLMs to indirect prompt injection through untrusted environmental content, while existing evaluations often cover only isolated strings, single-step interactions, or narrow settings. INFUSE benchmarks these attacks across realistic tasks and interaction surfaces. It finds attacks succeed across model families, while instructional hardening is the most effective evaluated single intervention but has model-dependent utility effects.

  • Problem

    Existing IPI evaluations often focus on isolated malicious strings, single-step tool calls, or narrowly scoped agent configurations, despite agents’ exposure to untrusted external content.

    Source: §1 · pp. 1–2

  • Method

    INFUSE evaluates IPI through 40 long-horizon tasks and 56 attack scenarios, using realistic injection surfaces and paired heuristic and LLM-based scoring.

    Source: §1 · p. 3, §3 · p. 4, §3.2 · p. 6

  • Results

    19.6% of attack trajectories are judged compromised by the LLM evaluator (ASR-L), and 15.4% by the heuristic (ASR-H).

    Source: §4.2 · p. 6

  • Takeaways & Limitations

    Instructional hardening is the most effective single evaluated intervention, but its utility effects vary across models.

    Source: §5 · p. 9

    Sandboxed package mirrors and sinkholed exfiltration endpoints prevent successful attacks from incurring real-world harm in this setting.

    Source: H LIMITATIONS · p. 29

Abstract

from arXiv · show

LLM-based agents increasingly execute long-horizon, end-to-end workflows involving shell commands, code modification, dependency installation, and interaction with remote services. This growing autonomy expands their exposure to indirect prompt injection (IPI), where adversarial instructions embedded in external content are interpreted as legitimate task directives. Existing evaluations, however, often focus on isolated malicious strings, single-step tool calls, or narrowly scoped agent configurations. We introduce INFUSE, an end-to-end benchmark for evaluating IPI throughout the lifecycle of long-horizon agent workflows. INFUSE comprises 40 realistic tasks and a structured taxonomy of 56 attack scenarios spanning five threat categories. Attacks are injected through realistic interaction surfaces encountered during task execution, extending evaluation beyond attacks placed only in initial prompts or isolated tool interactions. We evaluate 19 LLMs from the GPT, Claude, Gemini, Llama, Gemma, and Qwen families, producing 41,824 adversarial trajectories (26,220 without defenses) and 720 benign reference runs. Across the benchmark, mean attack success reaches 19.6% under LLM-based evaluation and 15.4% under heuristic verification, with per-model ASR-L ranging from 3.2% to 41.9%. Existing guard models provide limited protection, while prompt-level instructional hardening reduces mean attack success from 58.2% to 14.3%, revealing substantial but model-dependent security-utility trade-offs. Our code is available at https://github.com/judydnguyen/infuse.

1 INTRODUCTION

INFUSE evaluates indirect prompt injection (IPI) in realistic, long-horizon agent workflows, addressing gaps in execution realism, attack-surface breadth, and attribution. Its evaluation finds substantial vulnerability across models and defenses, with instructional hardening reducing attack success but producing uneven utility trade-offs.

Motivation

  • IPI exploits agents’ exposure to untrusted content, where embedded instructions may override user tasks and misuse tool authority.Examples include documents, web pages, code comments, screenshots, and multimodal inputs.Source: §1 · p. 1

Benchmark gap

  • Prior evaluations often abstract away multi-turn execution, restrict attack surfaces, or conflate IPI with other failure modes.INFUSE combines execution realism, broad attack-surface coverage, and signal isolation in one framework.Source: §1 · pp. 1–2

Our Framework

  • INFUSE pairs 40 long-horizon tasks with 56 attack scenarios across five threat categories and realistic injection surfaces.Its evaluation spans 19 LLMs and uses heuristic and LLM-based scoring.Source: §1 · pp. 2–3

Contributions

  • Mean ASR-L reaches 19.6% across 41,824 attack trajectories, and no single evaluated defense is robust.Prompt-level hardening reduces ASR-L from 58.2% to 14.3% but introduces uneven utility trade-offs.Source: §1 · p. 3

2 RELATED WORKS

Prior work has characterized IPI and developed agentic benchmarks and defenses, but existing evaluations cover only parts of the threat. INFUSE is presented as a unified evaluation framework for realistic execution, broad injection surfaces, and attribution.

Agentic AI and Prompt Injection Attacks

  • IPI research has documented data theft and ecosystem contamination, alongside broader work on prompt injection and tool-using-agent risks.Greshake et al. (2023) characterized IPI and demonstrated these attack types.Source: §2 · p. 3

Agentic IPI Benchmarks

  • Existing benchmarks variously restrict interaction, execution realism, attack surfaces, or IPI-specific attribution; INFUSE targets all three gaps together.Its design combines long-horizon Docker tasks, multiple injection surfaces, and surface-level attack provenance.Source: §2 · p. 3

Prompt Injection Defenses

  • Defense research spans input filters, structural isolation, semantic guardrails, action policies, and system-level approaches.These directions motivate comparing defenses within a common end-to-end evaluation protocol.Source: §2 · pp. 3–4

3 METHODOLOGY

INFUSE evaluates agentic LLM systems against IPI in realistic, end-to-end settings. It combines long-horizon tasks, surface-aware attacks, and paired evaluation with heuristic and LLM-based scoring.

3 METHODOLOGY

  • INFUSE combines a benign task suite, adversarial task suite, surface-aware injection engine, stress-test variance generator, and sandboxed evaluation pipeline.Its design distinguishes static from dynamic injection surfaces and makes security part of the legitimate workflow.Source: §3 · p. 4

3.1 TEST SUITE CONSTRUCTION

  • Tasks vary in interaction surfaces, tool diversity, and horizon, with deterministic test harnesses enabling reproducible binary success scoring.The task schema also specifies uniform blocks and heterogeneity axes; attacks span five threat categories and use parameterized payloads, surfaces, placement strategies, and verifiable success criteria.Source: §3.1 · pp. 4–5, Table 2 · p. 5

3.2 EVALUATION PIPELINE

  • Each model-task-attack cell is run in paired benign and attacked conditions, then scored for security and utility using heuristics and an LLM judge.The pipeline records typed surface events and read/write/execute objects; the judge counts compromise only when injected text influences actions or decisions, and reports refusals separately.Source: §3.2 · pp. 5–6

4 EXPERIMENTS

The experiments evaluate 19 LLMs on 40 tasks using attack and benign runs, with security and utility measured through LLM and heuristic methods. They find substantial variation in attack success across models and tasks, defenses, and harnesses.

4.2 MAIN RESULTS

  • GPT-5 had 26.3% ASR-L, above GPT-5.4 (12.6%) and GPT-5-Nano (8.4%); its ASR-H was 25.8%, third-highest in the table.Claude-Sonnet-4.6’s 3.2% ASR-L reflects runs truncated by a binding cost cap, while refusal rates were at most 1.0% for every model.Source: §4.2 · pp. 6–7
  • 19.6% of attack trajectories were judged compromised by the LLM evaluator (ASR-L), versus 15.4% by heuristic verification (ASR-H).Table 3 reports security and utility across models, with averages calculated over available rows.Source: §4.2 · p. 6, Table 3 · p. 7
  • 51.6% ASR-L on T17, 49.9% on T13, 49.1% on T9, and 47.9% on T3 show substantial task variation; security-oriented tasks were not systematically safer.Figure 4 organizes ASR-L for attacks 101–120 by task and threat category.Source: Figure 4 · p. 8, §4.2 · p. 8
  • Model scale was not consistently associated with robustness: larger Llama and Gemma models had lower ASR-L, while the ordering reversed within Qwen.The Qwen comparison mixes scale and generation; Qwen2.5-14B and Qwen2.5-32B had near-identical Utility-Injected-L (62.9% vs. 63.1%).Source: §4.2 · p. 8

4.3 DEFENSE ANALYSIS AND HARNESS TRANSFER

  • The defense comparison uses a stress-test subset with 58.2% undefended ASR-L, compared with the full-benchmark average of 19.6%; its reductions should not be extrapolated to the full benchmark.The subset contains 20 attacks and up to 10 tasks selected for high baseline ASR.Source: §4.3 · p. 8
  • 43.9 percentage points: instructional hardening reduced mean ASR-L from 58.2% to 14.3%; delimiter isolation reduced it by 32.5 points, while input transformation reduced it by 16.3 points and increased it for two models.Those increases were 2.5 points for GPT-4o-mini and 4.9 points for Qwen2.5-14B; utility effects of instructional hardening varied by model.Source: §4.3 · pp. 8–9
  • 22.4% of previously compromised task–attack cells transferred across harnesses (102 of 456), with rates ranging from 9.3% to 35.7%.Transfer was conditional on prior compromise, and the reported absolute ASRs remain scoped to Mini-SWE-Agent.Source: §4.3 · p. 9, Table 4 · p. 9
  • Between-model ASR-L was associated with mean benign-run trajectory length (r ≈0.50), but the within-model relationship was approximately zero.The findings do not establish a causal effect of longer horizons; the paper recommends reporting task, harness, and resource settings alongside model identity.Source: §4.3 · p. 9

5 CONCLUSION

INFUSE evaluates indirect prompt injection across long-horizon agent workflows, realistic interaction surfaces, and a broad attack taxonomy. The authors report a broad and consistent threat, limited protection from existing guard models, and model-dependent utility effects from instructional hardening.

5 CONCLUSION

  • Indirect prompt injection is a broad and consistent threat: attacks compromise agent behavior, capability alone does not confer robustness, and instructional hardening is the most effective evaluated single intervention, with model-dependent utility effects.Associations with trajectory length and task surfaces motivate controlled follow-up experiments but do not establish causes.Source: §5 · p. 9

A.1.1 TASK SUITE CATALOG

  • The task suite’s task-category and difficulty distributions are summarized in Figure 6, while Figure 7 maps coverage across software-engineering skill axes.Per-task evaluation results appear in Appendix F.2.Source: §A.1.1 · p. 13, Figure 6 · p. 14, Figure 7 · p. 14

A.1.2 BENIGN TASK ENVIRONMENT STRUCTURE

  • Each task uses a common directory layout for benign and adversarial runners and the verifier, enabling evaluation under identical contracts across all 40 tasks.The benign overlay maps files and streams to targetable surfaces; verification checks final container state, with attack-specific heuristics separately checking adversarial objectives.Source: §A.1.2 · pp. 14–15

A.2.1 THREAT MODEL AND SCOPE

  • The threat model lets an adversary control runtime surfaces in advance, but excludes direct prompt injection, model tampering, inference-stack side channels, physical attacks, and multi-agent collusion.The adversary has no direct access to the system prompt, model weights, or user input.Source: §A.2.1 · p. 15

A.2.2 SUPPORTED INJECTION SURFACES

  • INFUSE distinguishes 15 runtime event types—12 read-side surfaces and three write events—from five payload-targeting categories; compatibility is their intersection.The 56 released templates use APPEND (50/56), PREPEND (5/56), and REPLACE (1/56); INLINE is supported but unused.Source: §A.2.2 · p. 15, Table 5 · p. 16

A.2.3 ATTACK SCENARIO CATALOG

  • The attack registry groups 56 scenarios into five threat categories while retaining finer-grained security-violation labels and representative scenarios.Table 6 maps registry labels to paper-level categories; Table 7 presents representative scenarios and their injection positions.Source: §A.2.3 · p. 15, Table 6 · p. 16, Table 7 · p. 17

A.3 EVALUATION PIPELINE

  • Each model–task–attack run initializes an injected Docker environment, executes the agent under fixed limits, records typed traces, then evaluates final state, the trace, and attack-specific artifacts.A.4’s LLM-judge rubric counts influence on actions or decisions as compromise, not merely noticing or discussing injected text.Source: §A.3 · p. 16, §A.4 · pp. 16–17

A.4.1 CROSS-FAMILY JUDGE COMMITTEE

  • Three judges disagree on 9.1% of 2,996 trajectories, while GPT-4o-mini’s residual self-family leniency is 2.4 points and is much smaller than between-model ASR-L spread.Pairwise agreement (93.5–94.8%) is comparable to the single judge’s 90.2% test–retest agreement; the self-preference effect is reported rather than treated as null.Source: §A.4.1 · p. 17, Table 8 · p. 18

A.4.2 HUMAN ANNOTATION STUDY

The human study compares blinded annotations of sampled trajectories with LLM-judge labels and consensus. The judge committee tracks human consensus closely, while the single judge is weaker on this sample.

A.4.2 HUMAN ANNOTATION STUDY

  • The 219-item sample combines 119 proportional random draws with 100 committee-disagreement cases, so population estimates require weighting the two sampling phases appropriately.The disagreement-enriched phase concentrates information about judge error; per-stratum inclusion probabilities are recorded.Source: §A.4.2 · p. 18
  • Annotators label each transcript as complied, recognized-and-refused, or unaffected, with compliance requiring that the injection change the agent’s actions or decisions.Annotators do not see judge outputs, and merely noticing or discussing injected text is not compliance.Source: §A.4.2 · p. 18
  • On the annotation sample, the judge committee tracks human consensus at κ = 0.918, while the single GPT-4o-mini judge reaches κ = 0.527.Annotators agree on the ASR-L construct at κ = 0.851; the committee’s agreement with human consensus is at least as high as annotators’ agreement with one another.Source: §A.4.2 · p. 18, Table 9 · p. 18
  • The single GPT-4o-mini judge labels compromise less often than humans on this sample: 0.237 versus 0.279.Extending this calibration to the full corpus requires accounting for the sample’s enrichment for judge disagreements.Source: §A.4.2 · p. 18
  • On 211 scorable items, the single judge disagrees with human labels on 37 (17.5%), including 24 of 60 human-labeled compromises (40.0%).The judge misses a substantial fraction of human-labeled compromises in this sample.Source: §A.4.2 · p. 18

A.4.3 CONCORDANCE WITH THE HEURISTIC METRIC

ASR-L and ASR-H often agree but capture different trajectories: judge-only flags commonly reflect partial compliance, while heuristic-only flags commonly reflect incidental artifact overlap.

A.4.3 CONCORDANCE WITH THE HEURISTIC METRIC

  • Across the reported 41,824-trajectory collection, ASR-L and ASR-H disagree on 10.80% of trajectories; on the separate no-defense subset, their binary compromised/not-compromised labels have Cohen’s κ = 0.62.Among disagreements, 76.7% are ASR-L=1 and ASR-H=0, while 23.3% are ASR-L=0 and ASR-H=1.Source: §A.4.3 · p. 18
  • Manual inspection of 50 disagreement cells suggests judge-only flags often reflect partial compliance, while heuristic-only flags often reflect incidental artifact overlap.Partial compliance includes adopting an injected goal or beginning to act on it without producing the targeted artifact; incidental overlap can arise when an otherwise expected tool action matches the heuristic pattern.Source: §A.4.3 · p. 19

B DATASHEET FOR INFUSE

INFUSE is intended for robustness and defense evaluation and comprises containerized tasks, attacks, an injection engine, and labeled trajectories. Its release documents use, implementation settings, and evaluation safeguards, while noting that sandbox results do not establish production success.

B DATASHEET FOR INFUSE

  • INFUSE is intended to support research on IPI robustness and defense evaluation, with 40 containerized benign tasks, 56 attack scenarios, a surface-aware injection engine, and labeled trajectories.Tasks were constructed from software-engineering workflows and payloads were hand-authored; task creation did not involve scraping external user data.Source: B DATASHEET FOR INFUSE · p. 19

C ETHICS AND BROADER IMPACT

  • Sandbox controls limit evaluation-time harm, but do not establish that the same attacks would succeed under production access and egress policies.Experiments use isolated sandboxes, sinkholed exfiltration endpoints, and sandboxed package mirrors; the release contains static payload templates rather than a trained attack-generation model.Source: C ETHICS AND BROADER IMPACT · p. 19

D.1 MODELS AND SERVING CONFIGURATIONS

  • Open-source models use vLLM with listed HuggingFace revisions and configurations, while proprietary models use provider APIs at listed snapshots.All models use temperature 0.0; supported top_p and top_k settings remain at provider defaults, as do reasoning budgets for thinking-capable models.Source: §D.1 · p. 19, Table 10 · p. 20

D.2 MINI-SWE-AGENT HARNESS CONFIGURATION

  • The harness gives the agent one shell command per turn, with task-specific step and dollar-cost limits.The default step limit is 20, overridden by task specifications; the full system prompt is reproduced in Appendix E.1.Source: §D.2 · pp. 19–20

D.3 DEFENSE ANALYSIS (EXTENDED)

  • The evaluated defenses intervene through in-context steering, input rewriting, or external classification.The listed approaches are instructional hardening and delimiter isolation, input transformation, Qwen Guard, and Llama Guard.Source: §D.3 · p. 20

D.3.1 METHOD DESCRIPTIONS

The section compares four defenses against environment-embedded injections and evaluates them on a high-vulnerability stress-test subset. The interventions either reinforce instruction authority, mark untrusted observations, transform their content, or filter them with external classifiers.

D.3.1 METHOD DESCRIPTIONS

  • Instructional hardening brackets the task as authoritative and repeats an anti-injection reminder after every observation.The reminder tells the agent to ignore instructions in files, terminal output, and environment data.Source: §D.3.1 · p. 20
  • Delimiter isolation wraps each observation in typed provenance markers and warns the agent not to follow instructions inside those blocks.A surface-specific label is used when available; otherwise the runtime applies a generic UNTRUSTED_DATA marker.Source: §D.3.1 · p. 21
  • Input transformation paraphrases natural-language observations to remove directive-like framing while preserving code, paths, structured data, and numbers.The agent’s own backbone performs the rewrite, and this is the only intervention that changes observation content.Source: §D.3.1 · p. 21
  • External guardrails classify each tainted observation and replace flagged content with a BLOCKED_INPUT placeholder.The two locally served classifiers are Llama-Guard-3-8B and Qwen3Guard-Gen-8B.Source: §D.3.1 · p. 21
  • Defenses are compared across five backbones on a high-baseline-ASR stress-test subset, not a representative estimate of the full benchmark.The controlled subset covers 20 attacks and 10 tasks; incomplete coverage means some per-model deltas use different cell sets.Source: §D.3.1 · p. 21

D.3.2 ADDITIONAL RESULTS: SYSTEM-LEVEL AND MODEL-LEVEL DEFENSES

On the evaluated shell-level adaptations, the system controls did not produce a measurable ASR-L reduction, while Meta-SecAlign did. The supplied appendix also documents the compute, prompts, suffix generation, and limits of additional quantitative analyses.

D.3.2 ADDITIONAL RESULTS: SYSTEM-LEVEL AND MODEL-LEVEL DEFENSES

  • 55% and 74%: Meta-SecAlign reduced ASR-L versus its Llama backbone at 8B and 70B, while neither system-level control yielded a distinguishable reduction.The system-level conclusions apply to the shell-level adaptations, not every realization of Progent or CaMeL; Progent also raised Claude-Sonnet-4.6 ASR-L from 6.5% to 27.1%.Source: §D.3.2 · pp. 21–22, Table 13 · p. 22, Table 11 · p. 22

D.4 COMPUTE, COST, AND REPRODUCIBILITY

  • The corpus contains 41,824 attack trajectories and 720 benign reference runs; fixed settings and recorded seeds aid reproducibility but do not guarantee identical API outputs.The reported corpus includes 26,220 undefended and 15,604 defended attack trajectories.Source: §D.4 · p. 23

E.1 AGENT SYSTEM PROMPT

  • The agent system prompt requires exactly one Bash command per turn and assumes each command starts from the workspace root.A per-instance template supplies safety constraints and task-completion sentinels.Source: §E.1 · p. 23

E.2 LLM-JUDGE PROMPT

  • The LLM judge labels trajectories as compromised, not compromised, or outright refusal by assessing whether actions serve an injected goal rather than the legitimate objective.Explicitly naming suspicious instructions does not alone count as compromise when the agent rejects them and continues the legitimate task.Source: §E.2 · p. 24

E.3 DEFENSE PROMPTS

  • The defense prompts reinforce the bracketed task, delimit untrusted observations, paraphrase directive-like text, or ask guard models to classify malicious content.The paraphraser is instructed to preserve code, paths, structured data, and numeric content.Source: §E.3 · pp. 24–25

E.4 GCG ADVERSARIAL-SUFFIX GENERATION

  • GCG suffixes are generated against Meta-Llama-3-8B-Instruct with 200 steps, search width 32, top-k 32, and seed 42.The generated suffixes are appended to plain-text payloads at the GCG obfuscation level.Source: §E.4 · p. 25

F ADDITIONAL QUANTITATIVE RESULTS

  • The appendix cautions that its additional analyses describe associations with compromise and that sample and resource limits constrain model comparisons.These analyses do not establish that changing a model, payload property, or task feature would cause the observed ASR difference.Source: F ADDITIONAL QUANTITATIVE RESULTS · p. 25

F.1 MODEL-SIDE ASSOCIATIONS

  • Between-model trajectory-length associations do not imply within-model associations, and neither that analysis nor cost-capped runs identify effects of forcing fewer turns or less reasoning.The model-demeaned trajectory-length association is approximately zero.Source: §F.1 · p. 26

F.2 PER-TASK RESULTS AND ASSOCIATIONS

The appendix reports per-task outcome estimates and descriptive task-level associations, then discusses selected high-ASR workflows and observed refusal and recognition patterns. The analyses are bounded by uneven coverage and do not identify independent or causal task predictors.

F.2 PER-TASK RESULTS AND ASSOCIATIONS

  • Per-task estimates average model–task means over available models, with coverage varying from 12 to 19 models and 314 to 742 attack trajectories.Unobserved model–task pairs are not imputed, and task–attack compatibility depends on exposed injection surfaces.Source: §F.2 · p. 26, Table 14 · p. 26
  • Task-level ASR-L is plotted against path count, surface-file count, and step budget, but these descriptive associations do not isolate an effect of surface breadth.The three measurements are distinct, and task identity, difficulty, and attack compatibility vary jointly.Source: §F.2 · p. 27, Figure 8 · p. 27

G.1 CHARACTERISTICS OF SELECTED HIGH-ASR TASKS

  • The five highlighted high-ASR tasks were selected after observing high ASR, and their descriptive coding lacks a matched low-ASR comparison group.The coding therefore does not identify independent predictors or causal drivers.Source: §G.1 · p. 27, Table 15 · p. 28

G.2 REFUSAL TAXONOMY

  • An earlier snapshot recorded 100 judge-labeled refusals among 37,836 trajectories, and 98 of those refusals had Utility-L=0.The taxonomy distinguishes injection recognition from other reasons for stopping; its mechanisms are not an exhaustive frequency distribution.Source: §G.2 · p. 27, Table 16 · p. 28
  • Fourteen reviewed trajectories explicitly recognized an injection, and all 14 had Utility-L=0.Thirteen were from Claude-Sonnet-4.6 and one from Claude-Haiku-4.5; the reviewed sample does not establish family exclusivity or the training mechanism.Source: §G.2 · p. 27
  • Refusal rate, attack success, and task utility measure distinct outcomes and should be interpreted together.An injected blocker can make a refusal serve the adversary’s objective, while an environment error can stop a task without injection compliance.Source: §G.2 · p. 28

G.3 WORKED TRAJECTORY EXAMPLES

The examples distinguish verified exfiltration, explicit rejection, judge-detected compromise without a verified artifact, and a defense that blocks a fake prerequisite. Together they illustrate different outcomes the benchmark is designed to distinguish.

G.3 WORKED TRAJECTORY EXAMPLES

  • The fake security-audit injection led GPT-4o-mini to read and write credentials to a tracked file, producing ASR-L=1 and ASR-H=1.The heuristic verifier matched the exfiltrated credentials to a tracked attack signature.Source: §G.3 · p. 28
  • Claude-Sonnet-4.6 explicitly rejected an SSH-enabling injection and continued the documentation task, with RR=1 and both ASR measures at 0.The attack was embedded in a file the agent consulted during the legitimate task.Source: §G.3 · pp. 28–29
  • Gemini-2.5-Flash was judge-labeled compromised without a verified artifact, accounting for approximately 77% of judge–heuristic disagreements.The agent’s commands adopted injected framing, but the heuristic found no attacker-controlled commit, modified credential, or tracked exfiltration.Source: §G.3 · p. 29
  • Instructional hardening blocked a fake prerequisite, and GPT-4o-mini continued the disk-usage task with ASR-L=0 and ASR-H=0.The defense combined an initial anti-injection instruction with a reminder after the observation.Source: §G.3 · p. 29

H LIMITATIONS

INFUSE’s findings are bounded by its English-only task set, primary harness, hand-authored attacks, LLM-judge dependence, and sandboxed execution setting.

H LIMITATIONS

  • All tasks, payloads, and judge prompts are in English, so cross-lingual injection robustness is uncharacterized.Source: H LIMITATIONS · p. 29
  • Cross-harness testing covers only already-compromised Mini-SWE-Agent cells for three models each; other scaffolds remain unevaluated.The study establishes attenuation and non-zero transfer, not harness-specific absolute rates.Source: H LIMITATIONS · p. 29
  • The 56 hand-authored attacks do not test adversaries that adapt to the model under test, except GCG against open-source models.This limits conclusions about robustness to model-conditioned attacks.Source: H LIMITATIONS · p. 29
  • ASR-L uses a single corpus-wide judge that under-counted compromises in a 219-item human study, and population calibration depends on annotation sampling.The benchmark also reports judge-free ASR-H and provides a committee runner for rescoring trajectories.Source: H LIMITATIONS · p. 29
  • Sinkholed exfiltration endpoints and sandboxed package mirrors prevent successful attacks from causing real-world harm in this setting.Production realism depends on deployment-specific egress controls.Source: H LIMITATIONS · p. 29

Related papers

Loading 2610.20776v1…