Rethinking Indirect Prompt Injection as a Test-Time Search Problem (arXiv 2609.04495, Mon 7 Sep digest) reformulates indirect prompt injection as a test-time search over a task-dependent attack surface induced by the environment, user task and injection task. To operationalize it, the authors build an agentic attacker with a dedicated search harness: environment reconnaissance, structured reasoning over attack strategies, and adaptive evaluation using victim-agent feedback. Across heterogeneous tasks, increasing attacker test-time compute reliably improves vulnerability discovery and exploitation, while ablations show explicit strategy management is what sustains gains at larger budgets (avoiding redundant search). The conclusion: attack success is a function of the attacker's search procedure and compute budget, not a budget-independent property of the victim.
Prompt injection should be evaluated as an attacker's test-time search
Rethinking Indirect Prompt Injection as a Test-Time Search Problem (arXiv 2609.04495, Mon 7 Sep digest) reformulates indirect prompt injection as a test-time search over a task-dependent attack surface induced by the environment, user task and injection task. To operationalize it, the authors build an agentic attacker with a dedicated search harness: environment reconnaissance, structured reasoning over attack strategies, and adaptive evaluation using victim-agent feedback. Across heterogeneous tasks, increasing attacker test-time compute reliably improves vulnerability discovery and exploitation, while ablations show explicit strategy management is what sustains gains at larger budgets (avoiding redundant search). The conclusion: attack success is a function of the attacker's search procedure and compute budget, not a budget-independent property of the victim.
Imported from the existing research archive. Migration preserves the recorded judgment and is not a fresh verification.
What this means for you
This closes a methodological hole in agent-security evaluation: a one-shot injection test that passes means little, because a patient attacker with the same agent and environment keeps finding ways in as its compute grows. Practical consequences: red-team reports should state the attacker compute budget; defensive evals should run adaptive multi-turn attackers, not single-attempt payloads; and budget-dependent curves (attacks found vs compute) are the right artifact to track for any tool-using agent shipping to users.
Public artifacts and validated results are different.
The recorded fact is the public work and its artifacts. Author-reported outcomes do not establish independent reproduction. Next checks include usable code, task conditions and third-party validation.
Evidence & related material
Technical details & scores
| Formulation | indirect prompt injection = test-time search over a task-dependent attack surface (environment x user task x injection task) |
|---|---|
| Attacker | agentic attacker with dedicated search harness: environment reconnaissance, structured strategy reasoning, adaptive evaluation using victim-agent feedback |
| Findings | attacker test-time compute improves vulnerability discovery/exploitation; explicit strategy management sustains gains at larger budgets; attack success is budget-dependent, not a fixed property of the victim |