The attack surface of agents is everything around the prompt

Pipelines that trust contributions

In a preprint, researchers describe GitInject, a framework for real-world prompt injection attacks in AI-powered continuous integration and delivery pipelines. AI agents in these pipelines are susceptible to prompt injection when they ingest untrusted content from external contributions, the preprint says. The structural problem is specific: attacker-controlled configuration files from unmerged contributions are loaded as operator-level instructions. GitInject successfully demonstrates high-severity attacks across GitHub, GitLab and Hugging Face workflows. This suggests the pipeline, not the chat box, is the injection point that matters most for engineering teams: anything an agent reads as instructions, including a contribution that was never merged, can steer it. m:…1674

The reasoning that follows from this preprint is about trust boundaries: a pipeline agent treats whatever it reads as guidance, so the boundary has to sit before the agent, not inside its judgement. If unmerged contributions can reach the agent as operator-level instructions, then reviewing what the agent is allowed to read matters as much as reviewing what it is allowed to do. m:…1674

Tools that change under the agent

In a preprint on the tool update gap, researchers argue that malicious functionality can be embedded in tool updates, bypassing defenses the language model can see. Existing in-context defenses are insufficient against tool update attacks, the preprint says, because they do not re-verify tool safety after implementation changes. The attack the authors built, ETUDE, achieves a 97.6% attack success rate across seven major agentic frameworks. This suggests a defence that checks a tool once, at install time, is the wrong shape: the tool an agent trusts today may not be the tool it calls tomorrow. m:…4829

Memory that outlives the attack

In a preprint on MemHarmBench, researchers study cross-session prompt injection in memory-persistent agents. Malicious instructions can persist in agent memory and influence future tasks even after the original attack content is removed, the preprint says. Agents can also exhibit behavioural stealth, completing legitimate tasks normally while simultaneously making critical decisions aligned with attacker intent. Existing attack success metrics fail to capture this downstream harm during normal task execution, the preprint argues. This suggests memory turns a one-time injection into a standing influence, and that measuring only whether the first attack succeeded misses the damage that follows. m:…7117

Memory makes the other attacks harder to contain. A tool update can be rolled back and a contribution can be rejected, but a poisoned memory persists across sessions and keeps steering decisions after the original content is gone. That is why the measurement gap matters: if success metrics only capture the first attack, a team can believe it is safe while the influence continues in normal task execution. m:…7117

Skills, surfaces and peers

Two more preprints widen the surface further. AgentTypo, an adaptive typographic prompt injection attack against black-box multimodal agents, achieves 45% to 83% attack success across seven closed- and open-source model backends, and it outperforms CLIP-based AgentAttack by 29% to 47% on the VWA-Adv benchmark. It uses task-conditioned visual attention and black-box optimization of text position, contrast and colour to enhance injection effectiveness. SkillDRE, which evolves malicious agent skills using pre-execution and runtime feedback, achieves an average attack success rate of 45.28% on SkillsBench and outperforms the strongest baseline by 40.3%. Evaluating defence stages in isolation, pre-execution versus runtime, misses the full attack capability of evolved malicious skills, that preprint says. m:…7149 m:…1694

The final preprint looks at populations rather than single agents. Individual agent reliability does not reliably predict population-level behaviour in multi-agent systems, it says, and a committed minority of agents can shift the collective decision-making of a population in security-triage tasks. Population-level vulnerability to adversarial capture can be forecasted using a response function calibrated on benign, adversary-free behaviour. There is one reassuring finding: adversarial capture is not permanent, and behaviour reverts to original levels after the removal of adversarial agents. This suggests defence has to cover the group as well as the individual, and that removing bad actors, rather than retraining everyone, may restore the population. m:…5239

Taken together, these preprints argue for defending the whole system around the agent rather than the prompt alone: what it reads, which tools it calls and whether those tools changed, what it remembers, which skills it loads, and which peers it listens to. No single preprint claims a complete defence, and the population study's finding that behaviour recovers once adversarial agents are removed suggests that detection and removal deserve as much attention as prevention. m:…4829 m:…1694 m:…5239