The Framing Gap: Indirect Prompt-Injection Exfiltration Defeats Surface-Level Defenses in Tool-Using Agents

arXiv:2608.27092 · cs.CR · Submitted 2026-08-27 · Read on arXiv

cs.CR

Submitted: 2026-08-27

Updated: 2026-08-27

Comments: 20 pages, 3 figures, 7 tables

License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/

Terminology

• Ablation — 10× in this paper · explained in 1 episode
• Robustness — 10× in this paper · explained in 5 episodes
• Benchmark — 6× in this paper · explained in 2 episodes
• Alignment — 5× in this paper · explained in 1 episode
• Provenance — 4× in this paper · explained in 3 episodes
• Benchmarking — 3× in this paper · explained in 3 episodes
• Fine-Tuning — 3× in this paper · explained in 5 episodes
• Generalization — 3× in this paper · explained in 13 episodes
• Trace — 2× in this paper · explained in 2 episodes
• Agent Memory — 1× in this paper · explained in 1 episode
• Computer and Communications Security — 1× in this paper
• Core — 1× in this paper · explained in 2 episodes
• Decode — 1× in this paper · explained in 2 episodes

Sources

• Defeating Prompt Injections by Design
• RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage
• Adaptive Attacks Break Defenses Against Indirect Prompt Injection Attacks on LLM Agents
• The Attacker Moves Second: Stronger Adaptive Attacks Bypass Defenses Against Llm Jailbreaks and Prompt Injections
• Your Agent's Memories Are Not Its Own: Forged Reasoning Attacks on LLM Agent Memory and Defenses

Related papers

• SoK: AI-Augmented Binary Reversing
• Relaxed Sender Anonymity for CBDC Interbank Settlement: A Zero-Knowledge Approach on Permissioned EVM
• Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages
• Efficient Fuzzy PSI under One-Sided Assumptions
• Sealing the Audit-Runtime Gap for LLM Skills
• Token Composition: A Graph Based on EVM Logs