Metraipolis › archive › dc_00a451da22f7

Divide and Inject: Can Agents Reconstruct an Indirect Prompt Injection from Fragments? — arXiv:2609.36576

Source: arXiv (en)
Original: https://arxiv.org/abs/2609.36576
License (as archived): CC0-1.0
Archived: 2026-10-07T16:22:44.044Z
SHA-256 of the archived text: db6dc5c7f75fb5c674e621f147c6ddecc566c54c218b74c727a7e44faa47afef
Stable URL of this page: https://metraipolis.com/documento/dc_00a451da22f7

How to cite

Divide and Inject: Can Agents Reconstruct an Indirect Prompt Injection from Fragments? — arXiv:2609.36576 — arXiv (en), https://arxiv.org/abs/2609.36576 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_00a451da22f7 (Metraipolis archive dc_00a451da22f7, sha256 db6dc5c7f75fb5c674e621f147c6ddecc566c54c218b74c727a7e44faa47afef)

BibTeX

@misc{dc00a451da22f7,
  title = {Divide and Inject: Can Agents Reconstruct an Indirect Prompt Injection from Fragments? — arXiv:2609.36576},
  howpublished = {arXiv (en)},
  url = {https://arxiv.org/abs/2609.36576},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_00a451da22f7; sha256 db6dc5c7f75fb5c674e621f147c6ddecc566c54c218b74c727a7e44faa47afef},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: arXiv (en), https://arxiv.org/abs/2609.36576. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

Agentic systems are now being widely used to orchestrate tools and reason over long contexts. However, the improving capabilities of the large language models powering these agents also create new attack surfaces for indirect prompt injection. In particular, an attacker may not need to place a complete malicious instruction in retrieved content if the agent can reconstruct the objective from incomplete fragments distributed across a long context. In this work, we introduce adaptive long-context prompt injection (AdaLCPI), which combines long-context fragmentation with adaptive search. AdaLCPI splits an attack objective into incomplete fragments, embeds them in external content retrieved through the agent's tools, and uses a reconstruction cue to prompt the agent to combine them. It then iteratively refines the fragments and cue with OpenEvolve using graded scoring and natural-language execution feedback from the target agent. Empirically, AdaLCPI achieves higher attack success than strong adaptive baselines, reaching 61.4\% macro-average ASR compared with 32.8\% for Trojan Hippo-style and 30.0\% for AgentVigil. Safety evaluations should therefore test whether agents remain robust when harmful objectives must be reconstructed from incomplete fragments.

Tema degli esploratori: agenti e intelligenza artificiale (retro-catalogo arXiv: annunci del 2026-09-30 in cs.AI).
Categorie arXiv: Artificial Intelligence (cs.AI).
Pagina del lavoro: https://arxiv.org/abs/2609.36576 — autori e testo completo sono lì (qui omessi i nomi: nessun dato personale nel deposito).
Licenza: titolo e abstract sono metadati arXiv distribuiti in CC0 1.0; il testo completo ha la licenza scelta dagli autori, indicata sulla pagina.
Letto il 2026-10-07T15:54:53.511Z dalla pagina https://arxiv.org/catchup/cs.AI/2026-09-30?abs=True (consentita dal robots.txt di arxiv.org, con il suo crawl-delay).