AdapTools: Adaptive Tool-based Indirect Prompt Injection Attacks on Agentic LLMs
College of Computing（计算学院）；Data Science, Nanyang Technological University, Singapore（数据科学，南洋理工大学，新加坡）；School of Computer Science, Peking University, China（计算机科学学院，北京大学，中国）
Che Wang, Jiaming Zhang, Ziqi Zhang, Zijie Wang, Yinghui Wang, Jianbo Gao, Tao Wei, Zhong Chen, Wei Yang Bryan Lim
The integration of external data services (e.g., Model Context Protocol, MCP) has made large language model-based agents increasingly powerful for complex task execution. However, this advancement introduces critical security vulnerabilities, particularly indirect prompt injection (IPI) attacks. Existing attack methods are limited by their reliance on static patterns and evaluation on simple language models, failing to address the fast-evolving nature of modern AI agents. We introduce AdapTools, a novel adaptive IPI attack framework that selects stealthier attack tools and generates adaptive attack prompts to create a rigorous security evaluation environment. Our approach comprises two key components: (1) Adaptive Attack Strategy Construction, which develops transferable adversarial strategies for prompt optimization, and (2) Attack Enhancement, which identifies stealthy tools capable of circumventing task-relevance defenses. Comprehensive experimental evaluation shows that AdapTools achieves a 2.13 times improvement in attack success rate while degrading system utility by a factor of 1.78. Notably, the framework maintains its effectiveness even against state-of-the-art defense mechanisms. Our method advances the understanding of IPI attacks and provides a useful reference for future research.
ICON: Indirect Prompt Injection Defense for Agents based on Inference-Time Correction
College of Computing and Data Science, Nanyang Technological University, Singapore（计算与数据科学学院，南洋理工大学，新加坡）；Alibaba（阿里巴巴）；School of Computer Science, Peking University, China（计算机科学学院，北京大学，中国）
Systematization of Knowledge: Security and Safety in the Model Context Protocol Ecosystem
Tribhuvan University（特里布文大学）；University of North Dakota（北达科他大学）；Youngstown State University（亚当斯州立大学）；University of Missouri（密苏里大学）；University of Toledo（托莱多大学）
The Verifiable Action Card: Trustworthy Human-in-the-Loop Control for Secure Autonomous Agents
Sir Syed CASE Institute of Technology（Sir Syed CASE 理工学院）；University of Engineering and Technology（工程与技术大学）；National Textile University（国立纺织大学）；King Fahd University of Petroleum and Minerals (KFUPM)（法赫德国王石油与矿物大学）
Whispers of Wealth: Red-Teaming Google's Agent Payments Protocol via Prompt Injection
School of Computing University of Georgia Athens, USA（佐治亚大学计算机学院 美国亚特兰大）；Department of Information Technology Kennesaw State University Kennesaw, USA（凯斯韦尔州立大学信息科技学院 美国凯斯韦尔）
RAISED: Self-Distillation for Robustness to Prompt Injection in LLM Agents
École polytechnique（巴黎综合理工学院）；Institut Polytechnique de Paris（巴黎理工学院）；CNRS（法国国家科学研究中心）；Google DeepMind（谷歌DeepMind）；Agence Ministérielle pour l’IA de Défense（法国国防部人工智能局）；IRT SystemX（法国系统X技术研究所）
