Rethinking Indirect Prompt Injection as a Test-Time Search Problem

Summary

The paper reframes indirect prompt injection as a test-time search problem over an attack surface shaped by the environment, the user’s task, and the injection task. It introduces an agentic attacker with a dedicated search harness that first performs environment reconnaissance, reasons over structured attack strategies, and adapts its evaluation using feedback from the victim agent. Across heterogeneous tasks, giving the attacker more test-time compute improves both the discovery and exploitation of vulnerabilities. Ablation results show that explicit strategy management helps prevent redundant exploration and preserves these gains at larger compute budgets. The authors therefore argue that attack success should not be treated as a budget-independent property of the victim system. Instead, agentic security evaluations should report how the attacker searches and how much computation it receives. The paper identifies adaptive attacker search over system attack surfaces as an important, underexplored security risk for tool-using agents.