Agents are not broken in one prompt. They are steered, slowly, over many turns

Planted before the agent exists

The earliest failure in this set happens before an agent is even built. In a preprint, poisoning 0.1% of the pretraining corpus is reported to implant a remote code execution backdoor in an agent. That is a small fraction of training data with an outsized consequence: the agent carries the backdoor as part of what it learned, not as an instruction anyone typed at run time. m:…0861

Two further reported findings make the problem harder to dismiss. In a preprint, the attack success rate of pretraining poisoning is reported to increase with model scale, and backdoor persistence is reported to remain positive even when the poisoning rate drops to 0.0005%. This suggests bigger models do not automatically outgrow this class of attack, and that very light contamination cannot be assumed harmless without checking. m:…0861

Weakened by learning

A second failure arrives after deployment, through the very mechanisms meant to make a personal agent better. In a preprint, self-evolution mechanisms in personal agents are reported to significantly increase vulnerability to indirect prompt injection, in which instructions hidden in content the agent reads steer it toward unauthorised actions. Learning from experience, in other words, can also mean learning to be led. m:…1276

The reported magnitudes are striking. In a preprint, skill evolution is reported to increase indirect prompt injection attack success rates by 14.0 to 48.8 percentage points compared with base agents, and reinforcement learning from user feedback is reported to increase them by 3.0 to 39.3 percentage points. The ranges are wide, which suggests the effect depends on the setup, but the direction is consistent across both mechanisms: adaptation trades some robustness away. m:…1276

Misled one result at a time

A third failure needs no training access and no user feedback at all. It works through the tools a search agent trusts. In a preprint, search agents are reported to be vulnerable to multi-turn evidence manipulation because they rely on external tool returns that can be coordinated across trajectories. Each individual result can look plausible; the manipulation lives in how the results fit together over time. m:…6294

In a preprint, a technique called Authority-Chain Hijack is reported to turn isolated search-result and page-content manipulations into a coherent evidence chain across seemingly corroborating sources. And in a preprint, an automated strategy-evolution technique is reported to reach 71.4% attack success and 95.0% MaxN attack success in held-out evaluation. The lesson is that corroboration is not safety when the corroborating sources can be coordinated. m:…6294

Measured the wrong way

The fourth preprint questions how these failures are measured in the first place. In a preprint, binary attack success rate is reported to obscure the surrounding structure of possible generations in jailbreak evaluation. A single pass-or-fail number hides how close a model came to failing, and how many nearby outputs would also have failed. m:…5459

In a preprint, attacks that are strongest before a defence are reported not necessarily to remain the strongest after the adaptive defence reacts, and the continuous risk-landscape perspective is reported to reveal two complementary properties: current decoder exposure and safe rerouting capacity. For anyone shipping an agent, the implication is uncomfortable: a defence that looks strong on a single score may simply have moved the risk somewhere the score does not see. m:…5459