Prompt Injection
3 items across 3 editions. First seen Fri 11 Sep, last seen Tue 15 Sep.
- arXiv:2609.13889, "When Malicious Instructions Persist: Persistent Memory Poisoning Attack on Harness-Based Agents" by Shuhuai Huang, Jingfeng Zhang and Hong Jia, submitted 12 September 2026 and announced in the arXiv listing of 15 September, reports: "Across all settings, PMPA achieves average Injection Success Rate (ISR) and Cross-session Attack Success Rate (C-ASR) of 73.7%/ 55.5% on OpenClaw and 66.9%/ 81.7% on Claude Code, while preserving benign task performance on both systems."
- The attack "embeds malicious instructions into benign external sources and induces the victim agent to write them into persistent memory without directly accessing to the agent framework", so the instructions survive into later sessions and trigger further actions and data leakage.
- On defence, the authors report that a targeted prompt-level defence "can reduce memory injection in many settings, but provides limited protection once the persistent memory has been poisoned".
- The paper is a preprint and has not been peer reviewed; the results are the authors' own evaluations against OpenClaw and Claude Code, and neither vendor has responded publicly.
- The paper, posted to arXiv on 10 September 2026, reports that agent payment protocols such as AP2 "produce cryptographically valid signatures for completed purchases, yet do not constrain the decisions that lead to them", and demonstrates three attacks carried by ordinary product-description text with success rates of "90%, 56%, and 73.3%, respectively".
- Testing covered "seventeen Google models, three unrelated agent frameworks, two cross-vendor anchors, and Google's own consumer assistant", so the failure is in the protocol's trust boundary rather than in one model.
- The authors propose A-VIP (AP2 Verified-Intent Protection), which binds each credential lookup to the session that requested it and each cart line to the listing actually seen, and release it with machine-checked invariants and "AP2-WhisperBench, a suite of 1,544 evaluation scenarios".
- Preprint from Ariel University and the Jerusalem College of Technology, not peer reviewed. The attacks are demonstrated in the authors' own test harness; the paper does not report any exploitation in live commerce.
- The paper (arXiv 2609.10854, submitted 9 September, announced in the cs.CR new listing) proposes "no-box" vulnerability analysis — auditing a system with neither access nor runtime interaction, using only functionality metadata. The prototype, MCPSEC, audits Model Context Protocol servers for indirect prompt injection using only the tool metadata exposed at server registration.
- Across 20 widely deployed MCP servers comprising 177 tools, human evaluators confirmed 95 vulnerable tools. MCPSEC identified 143 tools as vulnerable and recovered 94 of the 95 verified vulnerabilities (98.9% recall), against 80 (84.2%) for an LLM baseline, producing a hypothesised exploitation technique for each.
- The gap between 143 flagged and 95 confirmed implies a substantial false-positive rate, which the abstract does not quantify as a precision figure. The authors are explicit that hypotheses require later validation when access is available. The servers audited are not named in the abstract.