InjecAgent - Indirect Prompt Injection Benchmark for Tool-Using Agents

Overview

InjecAgent shifts the question from text output to actions. It asks whether an agent that reads external content through a tool, such as a review or an email, can be induced to call other tools against the user's interest.

Research question

How vulnerable are tool-integrated LLM agents to indirect prompt injection that aims at harmful actions or private data exfiltration?

Method and artifact

The benchmark consists of 1,054 test cases covering 17 user tools and 62 attacker tools. Attacker intentions are grouped into two primary categories: direct harm to users and exfiltration of private data. The authors evaluate 30 LLM agents in a base setting and in an enhanced setting where the attacker instruction is reinforced. This page keeps the categories conceptual and does not reproduce test-case content.

• uiuc-kang-lab/InjecAgent (GitHub) - official benchmark repository

Key findings reported by the authors

Source statements: the points below summarize what the cited publication reports for the models and configurations it tested.

• The evaluated agents were vulnerable to indirect prompt injection.
• The paper reports that a ReAct-prompted GPT-4 agent was vulnerable in 24% of cases in the base setting.
• In the enhanced setting, the reported success rate for that agent nearly doubled.
• The authors conclude that their findings raise questions about the widespread deployment of LLM agents.

Security interpretation

Site interpretation: this section is Prompt-Injection.net's explanation of why the work matters, not a claim made by the authors.

InjecAgent makes the agent risk concrete: once untrusted content and privileged tools share a context, the question is no longer only what the model says but what it is allowed to do. This supports treating tool calls as authorization decisions made outside the model.

Limits and caveats

• All percentages are historical results for the specific agents, prompting styles and dates tested.
• Tools are simulated; real deployments add their own permissions, confirmations and failure modes.
• A static test set does not capture adaptive attackers.

How to use this work

Use InjecAgent to structure agent threat models around user tools, attacker-reachable tools and the two outcome classes. Its categories map well to authorization and egress controls you can test in your own environment.

Related content on Prompt-Injection.net

• AI Agent Prompt Injection - How prompt injection in an agentic system can become a security-relevant action chain, why proposal is not authorization, and which deterministic gates break the chain.
• Tool Output Injection - Why a trusted tool does not make its returned content trusted, how tool results reach model context, and how provenance, capability limits and deterministic authorization contain agent impact.
• AI Agents and Tool Calling - How model proposals become actions: the tool-calling loop, availability vs permission, runtime authorization, approval, tool results as variable data and audit.
• Agent Authorization - How to authorize AI agent actions outside the model: initiating principal, agent identity, resource, action, parameters, destination, scope and policy version, with exact-action binding and downstream revalidation.
• Least Privilege - How to reduce the size, reach and lifetime of agent authority before any action is evaluated: identities, scopes, tool exposure, data access, JIT elevation, review and revocation readiness.
• Tool Output Injection (Lab) - A guided exercise on separating trusted tools from untrusted tool results and treating every follow-on tool, destination or action as a new authorization decision.