Rethinking Indirect Prompt Injection as a Test-Time Search Problem (arXiv 2609.04495, Mon 7 Sep digest) reformulates indirect prompt injection as a test-time search over a task-dependent attack surface induced by the environment, user task and injection task. To operationalize it, the authors build an agentic attacker with a dedicated search harness: environment reconnaissance, structured reasoning over attack strategies, and adaptive evaluation using victim-agent feedback. Across heterogeneous tasks, increasing attacker test-time compute reliably improves vulnerability discovery and exploitation, while ablations show explicit strategy management is what sustains gains at larger budgets (avoiding redundant search). The conclusion: attack success is a function of the attacker's search procedure and compute budget, not a budget-independent property of the victim.
This closes a methodological hole in agent-security evaluation: a one-shot injection test that passes means little, because a patient attacker with the same agent and environment keeps finding ways in as its compute grows. Practical consequences: red-team reports should state the attacker compute budget; defensive evals should run adaptive multi-turn attackers, not single-attempt payloads; and budget-dependent curves (attacks found vs compute) are the right artifact to track for any tool-using agent shipping to users.
| Formulation | indirect prompt injection = test-time search over a task-dependent attack surface (environment x user task x injection task) |
|---|---|
| Attacker | agentic attacker with dedicated search harness: environment reconnaissance, structured strategy reasoning, adaptive evaluation using victim-agent feedback |
| Findings | attacker test-time compute improves vulnerability discovery/exploitation; explicit strategy management sustains gains at larger budgets; attack success is budget-dependent, not a fixed property of the victim |