SOURCE-LINKED INTELLIGENCE

Rethinking Indirect Prompt Injection as a Test-Time Search Problem

arXiv · AI, language, vision and robotics · article · Sep 3, 2026 · UTC

We formulate indirect prompt injection as a test-time search over a task-dependent attack surface induced by the environment, user task, and injection task. To operationalize this formulation, we introduce an agentic attacker with a dedicated search harness that performs environment reconnaissance, structured reasoning over attack strategies, and adaptive evaluation using victim-agent feedback. Across heterogeneous tasks, we find that increasing attacker test-time compute improves vulnerability discovery and exploitation, while ablations show that explicit strategy management is important for

Read original source ↗ Open in workspace

recordType

paper

region

Global