发表机构
Hefei University of Technology; University of Science and Technology of China（合肥工业大学; 中国科学技术大学）
机构由 AI 辅助整理，请以论文原文为准。AI 中文总结
本研究揭示主动智能体中提供方侧间接提示注入攻击：外部提供方无需访问用户上下文或入侵智能体，仅通过控制自身相关内容即可引导智能体推进其目标，利用合法用户上下文正当化并降低采纳摩擦，在多个环境中最高提升目标授权77.4个百分点，暴露了智能体服务能力可能被外部目标劫持的信任边界。
AI 中文摘要
主动型个人智能体越来越多地决定推荐什么内容、如何个性化建议以及提供哪些后续帮助，这为提供方侧的间接提示注入创造了一个新的用户决策攻击面。我们证明，外部提供方无需访问私人用户上下文、无需入侵智能体或获取额外权限：仅通过控制与其自身目标相关的内容，就能将原本良性的智能体引导至推进该目标，利用合法可用的用户上下文为其提供正当性，并主动降低采纳的摩擦。我们通过目标控制、私有绑定和预期支持来刻画这一失效模式，这三个方面分别引导智能体推进什么、如何将目标与用户关联，以及接下来提供哪些针对目标的具体帮助。在三个主动智能体环境和六个模拟用户模型中，完整攻击在所有测试的环境-用户模型组合中均增加了目标授权，宏观增益最高达77.4个百分点。受控重放表明，正确的用户-目标绑定比仅增加额外的提案细节更具影响力，而多轮扩展则揭示，即使没有最终授权，提供方的目标仍可通过重塑智能体对用户约束和抵制的响应方式而保持影响力。这些发现暴露了一个更广泛的信任边界：旨在服务用户的能力可能被重新定向至源自用户-智能体关系之外的目标。
英文摘要
Proactive personal agents increasingly decide what to recommend, how to personalize advice, and what follow-up assistance to offer, creating a new user-decision attack surface for provider-side indirect prompt injection. We show that an external provider need not access private user context, compromise the agent, or gain additional permissions: by controlling only content associated with its own target, it can redirect an otherwise benign agent to advance that target, recruit legitimately available user context to justify it, and proactively reduce the friction of adoption. We characterize this failure mode through Target Control, Private Binding, and Prospective Support, which respectively steer what the agent advances, how it connects the target to the user, and what target-specific assistance it offers next. Across three proactive-agent environments and six simulated user models, the full attack increases target authorization in all tested environment-user-model combinations, with a macro gain of up to 77.4 percentage points. Controlled replay shows that correct user-target binding is more consequential than additional proposal detail alone, while a multi-turn extension reveals that provider objectives can remain influential even without final authorization by reshaping how the agent responds to user constraints and resistance. These findings expose a broader trust boundary: capabilities designed to serve the user can be redirected toward objectives originating outside the user-agent relationship.
Comments30 pages, 7 figures, 13 tables
