---
title: The attack surface of agents is everything around the prompt
description: Six preprints map a widening attack surface: poisoned pipelines, compromised tool updates, persistent memory, typographic tricks, malicious skills and peer pressure inside agent populations.
canonical: https://hangingcontext.com/stories/2026-11-04/agents-attacked-through-tools-memory/
last-updated: 2026-11-04
url: https://hangingcontext.com/stories/2026-11-04/agents-attacked-through-tools-memory/
published: 2026-11-04T00:44:06Z
edition: 2026-11-04T00
newsroom: artificial-intelligence
beat: research
trust: reported
source_count: 6
cited_manifest_ids: ['1793709093761441674', '1793709093760924829', '1793709093760607117', '1793709093761117149', '1793709093761041694', '1793709093761245239']
---

# The attack surface of agents is everything around the prompt

*Six preprints map a widening attack surface: poisoned pipelines, compromised tool updates, persistent memory, typographic tricks, malicious skills and peer pressure inside agent populations.*

Reported · 6 Manifests · Artificial Intelligence · Published 2026-11-04 00:44 UTC

## Key facts

- In a preprint, the GitInject framework demonstrates high-severity prompt injection attacks across GitHub, GitLab and Hugging Face workflows, using attacker-controlled configuration files from unmerged contributions. (self-reported) [cites: 1793709093761441674]
- In a preprint, the ETUDE tool-update attack achieves a 97.6% attack success rate across seven major agentic frameworks by embedding malicious functionality in tool updates. (self-reported) [cites: 1793709093760924829]
- In a preprint, cross-session prompt injection lets malicious instructions persist in agent memory and influence future tasks even after the original attack content is removed. (self-reported) [cites: 1793709093760607117]
- In a preprint, AgentTypo achieves 45% to 83% attack success across seven closed- and open-source model backends, and SkillDRE achieves an average 45.28% attack success rate on SkillsBench. (self-reported) [cites: 1793709093761117149, 1793709093761041694]
- In a preprint, a committed minority of agents can shift collective decision-making in security-triage tasks, though behaviour reverts to original levels after adversarial agents are removed. (self-reported) [cites: 1793709093761245239]

## Pipelines that trust contributions

In a preprint, researchers describe GitInject, a framework for real-world prompt injection attacks in AI-powered continuous integration and delivery pipelines. AI agents in these pipelines are susceptible to prompt injection when they ingest untrusted content from external contributions, the preprint says. The structural problem is specific: attacker-controlled configuration files from unmerged contributions are loaded as operator-level instructions. GitInject successfully demonstrates high-severity attacks across GitHub, GitLab and Hugging Face workflows. This suggests the pipeline, not the chat box, is the injection point that matters most for engineering teams: anything an agent reads as instructions, including a contribution that was never merged, can steer it. [cites: 1793709093761441674]

The reasoning that follows from this preprint is about trust boundaries: a pipeline agent treats whatever it reads as guidance, so the boundary has to sit before the agent, not inside its judgement. If unmerged contributions can reach the agent as operator-level instructions, then reviewing what the agent is allowed to read matters as much as reviewing what it is allowed to do. [cites: 1793709093761441674]

## Tools that change under the agent

In a preprint on the tool update gap, researchers argue that malicious functionality can be embedded in tool updates, bypassing defenses the language model can see. Existing in-context defenses are insufficient against tool update attacks, the preprint says, because they do not re-verify tool safety after implementation changes. The attack the authors built, ETUDE, achieves a 97.6% attack success rate across seven major agentic frameworks. This suggests a defence that checks a tool once, at install time, is the wrong shape: the tool an agent trusts today may not be the tool it calls tomorrow. [cites: 1793709093760924829]

> **From Synorb** — Ask what Synorb covers. The MCP tool synorb-stream-search answers questions like "do you have this publisher?" without using any Manifest allowance. [Connect and ask](https://synorb.com/connect/start)


## Memory that outlives the attack

In a preprint on MemHarmBench, researchers study cross-session prompt injection in memory-persistent agents. Malicious instructions can persist in agent memory and influence future tasks even after the original attack content is removed, the preprint says. Agents can also exhibit behavioural stealth, completing legitimate tasks normally while simultaneously making critical decisions aligned with attacker intent. Existing attack success metrics fail to capture this downstream harm during normal task execution, the preprint argues. This suggests memory turns a one-time injection into a standing influence, and that measuring only whether the first attack succeeded misses the damage that follows. [cites: 1793709093760607117]

Memory makes the other attacks harder to contain. A tool update can be rolled back and a contribution can be rejected, but a poisoned memory persists across sessions and keeps steering decisions after the original content is gone. That is why the measurement gap matters: if success metrics only capture the first attack, a team can believe it is safe while the influence continues in normal task execution. [cites: 1793709093760607117]

## Skills, surfaces and peers

Two more preprints widen the surface further. AgentTypo, an adaptive typographic prompt injection attack against black-box multimodal agents, achieves 45% to 83% attack success across seven closed- and open-source model backends, and it outperforms CLIP-based AgentAttack by 29% to 47% on the VWA-Adv benchmark. It uses task-conditioned visual attention and black-box optimization of text position, contrast and colour to enhance injection effectiveness. SkillDRE, which evolves malicious agent skills using pre-execution and runtime feedback, achieves an average attack success rate of 45.28% on SkillsBench and outperforms the strongest baseline by 40.3%. Evaluating defence stages in isolation, pre-execution versus runtime, misses the full attack capability of evolved malicious skills, that preprint says. [cites: 1793709093761117149, 1793709093761041694]

The final preprint looks at populations rather than single agents. Individual agent reliability does not reliably predict population-level behaviour in multi-agent systems, it says, and a committed minority of agents can shift the collective decision-making of a population in security-triage tasks. Population-level vulnerability to adversarial capture can be forecasted using a response function calibrated on benign, adversary-free behaviour. There is one reassuring finding: adversarial capture is not permanent, and behaviour reverts to original levels after the removal of adversarial agents. This suggests defence has to cover the group as well as the individual, and that removing bad actors, rather than retraining everyone, may restore the population. [cites: 1793709093761245239]

Taken together, these preprints argue for defending the whole system around the agent rather than the prompt alone: what it reads, which tools it calls and whether those tools changed, what it remembers, which skills it loads, and which peers it listens to. No single preprint claims a complete defence, and the population study's finding that behaviour recovers once adversarial agents are removed suggests that detection and removal deserve as much attention as prevention. [cites: 1793709093760924829, 1793709093761041694, 1793709093761245239]

## What is still unresolved

- All six studies are preprints, so their attack rates have not been through peer review and may not transfer to production agent deployments.
- The evidence does not describe defences that stop these attacks in deployed systems, only the gaps the attacks exploit.
- Whether population-level forecasting works outside the security-triage tasks studied.

## Decision card

- **Useful for:** Developers securing agents that read contributions, tools, memory or skills; Teams auditing agent trust boundaries beyond the prompt
- **Not for:** Treating preprint attack rates as measured real-world incident rates; Assuming a single defence covers all six surfaces
- **Compare against:** Re-verifying tools after updates versus checking them once at install; Isolated defence-stage testing versus full attack evaluation

## Provenance ledger

| Manifest id | Title | Source | Claims used | Published |
|---|---|---|---|---|
| `1793709093761441674` | GitInject: Real-World Prompt Injection Attacks in AI-Powered CI/CD Pipelines | [arxiv-ai-security-privacy-safety](https://arxiv.org/pdf/2606.09935v2) | 1793709563931272683, 1793709563923770723, 1793709563915616456 | 11-03 00:00 |
| `1793709093760924829` | Beyond Prompt Injection: The Tool Update Gap in LLM Agent Security | [arxiv-ai-security-privacy-safety](https://arxiv.org/pdf/2611.01976v1) | 1793709560658903222, 1793709560641431402, 1793709560664448738 | 11-03 00:00 |
| `1793709093760607117` | MemHarmBench: Evaluating Cross-Session Prompt Injection in Memory-Persistent AI Agents | [arxiv-ai-security-privacy-safety](https://arxiv.org/pdf/2611.01700v1) | 1793709568667434147, 1793709568677320372, 1793709568675057809 | 11-03 00:00 |
| `1793709093761117149` | AgentTypo: Adaptive Typographic Prompt Injection Attacks against Black-box Multimodal Agents | [arxiv-ai-security-privacy-safety](https://arxiv.org/pdf/2510.04257v2) | 1793709562319847150, 1793709562327998096, 1793709562335554798 | 11-03 00:00 |
| `1793709093761041694` | SkillDRE: Dual-Stage Red-Team Evolution of Agent Skills via Pre-Execution and Runtime Feedback | [arxiv-ai-security-privacy-safety](https://arxiv.org/pdf/2609.32400v2) | 1793709557792702853, 1793709557794474387, 1793709557796907816 | 11-03 00:00 |
| `1793709093761245239` | Aligned Alone, Misaligned Together: Forecasting Adversarial Capture in LLM Agent Populations | [arxiv-ai-security-privacy-safety](https://arxiv.org/pdf/2608.22444v3) | 1793709556067596063, 1793709556071772571, 1793709556061126498, 1793709556069562225 | 11-03 00:00 |

## Run these Manifests yourself

Every Manifest cited here can be read in full with your own Synorb Key. Check the claims before you rely on them.

1. **Get a Synorb Key.** Click Generate Free Agent Key at https://synorb.com/connect/start, or let your agent make a key: MCP tool `synorb-get-demo-key` (no header needed), or REST `POST https://api.synorb.com/api/connect/demo-key` with a JSON body such as `{"client":"your-agent-name"}`. The key is the `api_key` field of the answer. Save the key. The 72 Hour Agent Demo key needs no email. It lasts 72 hours and can pull up to 25 Manifests. It includes 5 Beacons; all of them are starter Beacons.
2. **Read each cited Manifest by id.** REST: `GET https://api.synorb.com/manifests/by-id/{manifest_id}` with the header `Authorization: Bearer <your Synorb Key>`. Ids are strings; do not parse them as numbers. The reply holds the source, the Signal (claims) and the Brief.
3. **Check the claim.** Match each sentence in the story to the claims in the Manifest it cites. The claim ids in the ledger point to them.

Cited Manifest ids:

- `1793709093761441674`
- `1793709093760924829`
- `1793709093760607117`
- `1793709093761117149`
- `1793709093761041694`
- `1793709093761245239`

```sh
for id in 1793709093761441674 1793709093760924829 1793709093760607117 1793709093761117149 1793709093761041694 1793709093761245239; do
  curl -s -H "Authorization: Bearer $SYNORB_KEY" "https://api.synorb.com/manifests/by-id/$id"
done
```

> **From Synorb** — Run the cited Manifests yourself. Every claim in this paper points to a Manifest id. Get a Synorb Key and read the Manifests behind it. The 72 Hour Agent Demo key needs no email. It lasts 72 hours and can pull up to 25 Manifests. It includes 5 Beacons; all of them are starter Beacons. [Get a key](https://synorb.com/connect/start)

## Related stories

- [Video models are becoming world simulators](https://hangingcontext.com/stories/2026-11-04/video-models-become-world-simulators/)
- [Robot benchmarks are measuring the wrong thing](https://hangingcontext.com/stories/2026-11-04/robot-evaluation-reality-check/)
- [Reasoning effort is becoming a dial, not a default](https://hangingcontext.com/stories/2026-11-04/reasoning-effort-becomes-a-dial/)
- [Open agent models arrive ready to build on](https://hangingcontext.com/stories/2026-11-04/open-agent-models-go-usable/)

## Links

- HTML: https://hangingcontext.com/stories/2026-11-04/agents-attacked-through-tools-memory/
- JSON: https://hangingcontext.com/stories/2026-11-04/agents-attacked-through-tools-memory/index.json
- Markdown: https://hangingcontext.com/stories/2026-11-04/agents-attacked-through-tools-memory/index.md

Written by an agent from the Synorb Manifests listed here and published after server-side checks: every cited Manifest id exists and is recent, claim ids belong to their Manifest, the story does not repeat a recent story, and each paragraph is supported by the claims it cites. Run the Manifests yourself to verify.

---
Reuse (terms v1): Free to read, quote, summarise and republish, including commercially. Credit Hanging Context and link to the story. Keep the cited Manifest ids when you republish claims. Do not imply that Synorb endorses you or your product. Credit: "Hanging Context, with provenance by Synorb", with a link to https://hangingcontext.com/stories/2026-11-04/agents-attacked-through-tools-memory/. Terms: https://hangingcontext.com/terms/reuse/