Rethinking Indirect Prompt Injection as a Test-Time Search Problem

A new arXiv paper (2609.04495v1) redefines indirect prompt injection as a test-time search problem, introducing an agentic attacker with a dedicated search harness that performs environment reconnaissance, structured reasoning, and adaptive evaluation. The study finds that increasing attacker test-time compute improves vulnerability discovery and exploitation, and that explicit strategy management is crucial for sustaining gains at larger budgets, suggesting security evaluations should account for both search procedure and compute budget.

arXiv:2609.04495v1 Announce Type: new Abstract: We formulate indirect prompt injection as a test-time search over a task-dependent attack surface induced by the environment, user task, and injection task. To operationalize this formulation, we introduce an agentic attacker with a dedicated search harness that performs environment reconnaissance, structured reasoning over attack strategies, and adaptive evaluation using victim-agent feedback. Across heterogeneous tasks, we find that increasing attacker test-time compute improves vulnerability discovery and exploitation, while ablations show that explicit strategy management is important for avoiding redundant search and sustaining gains at larger budgets. These results suggest that agentic security evaluations should characterize both the attacker's search procedure and compute budget, rather than treating attack success as a budget-independent property of the victim. More broadly, our findings identify the attacker's adaptive search over the system attack surfaces as an important and underexplored security risk for tool-using agents.