Reproduce “Assessing Automated Prompt Injection Attacks in Agentic Environments” on OpenResearch
Turn your favorite coding agents into research agents that review literature, develop hypotheses, and run experiments.
Universal app for Apple silicon and Intel. Requires macOS 11 or later.
About this paper
David Hofer, Edoardo Debenedetti, Florian Tramèr
The authors adapt black-box TAP and gradient-based GCG to test indirect prompt injections in stateful AgentDojo tasks. TAP uses a language model to propose and refine planted instructions, while GCG uses model gradients; success requires a verified unauthorized tool action. On Qwen3-4B, Universal TAP reached 45.2% ASR versus 24.1% for Universal GCG, but only about 4.5–4.7% against GPT-5, limiting the result to benchmarked, model-specific exploitation.
Summary by alphaXiv.
Tip: change arxiv.org to autoarxiv.org in any arXiv abstract link to open the paper here.