AI Agents Still Can’t Stop Prompt Injection Attacks, Researchers Warn

As developers rush to deploy AI agents capable of surfing the web, conducting research, shopping online and trading cryptocurrency autonomously, new research suggests the systems remain highly vulnerable to rapid injection attacks.

In a new study Published Thursday, researchers from Nanyang Technological University, ST Engineering, IBM Research and the University of Illinois Urbana-Champaign found that none of the AI ​​agents they tested consistently withstood rapid injection attacks.

“Existing security benchmarks adopt an attack-oriented perspective, focusing on the technical feasibility of injections while overlooking the nuanced distribution of resulting damage,” the researchers wrote. “In practice, however, the risk of rapid injection depends on the victim: a single exploit can have asymmetric impacts on different stakeholders, and the same attack pattern can exhibit significantly different effectiveness depending on who it targets.”

Rapid injection occurs when attackers embed hidden instructions into content that an AI agent encounters, causing it to follow the attacker’s directions rather than the user’s. To address gaps in existing evaluations of AI agents, the researchers developed StakeBench, a benchmark that tests how AI agents respond to rapid injection attacks in realistic online environments.

“We are now using StakeBench to characterize the conditions under which this vulnerability is amplified or suppressed, with an emphasis on [Indirect Prompt Injection] as the primary implementation-relevant channel,” the researchers wrote. “StakeBench examines three such factors: the semantic distance between the injected target and the user’s original intent, the consistency of surrounding environmental cues, and the position along the agent’s execution path at which the benchmark first exposes it to the injected content.”

The team ran 3,168 attack simulations using NanoBrowser and BrowserUse with GPT-5 and Gemini 2.5-Flash. Researchers found that direct injection attacks were successful more than 79% of the time across all configurations tested, and indirect attacks achieved success rates from 41.67% to 68.16%.

The research comes at a time when prompt injection attacks are becoming more common and AI agents are becoming more widespread.

In February, Microsoft researchers warned that hidden instructions embedded in AI summary links could influence the behavior of chatbots. In April, Google documented prompt injection attacks hidden on web pages that attempted to manipulate AI agents into leaking login credentials or sending payments. More recently, Microsoft revealed a flaw in Anthropic’s Claude Code GitHub Action that could have exposed users’ credentials.

The study also identified what researchers called “covert parasitism,” in which an AI agent completes a user’s task while furthering an attacker’s goal. For example, stealthy parasitism, caused by a rapid injection attack, can subtly influence product recommendations, sending users to a particular item without any obvious signs that the system has been compromised.

“These results indicate that prompt injection protection in deployable web agents is not a scalar property of the backbone model, but a distribution of damage whose realization is jointly determined by the involved stakeholder, the semantic alignment between the injected goal and the user’s task, and the architectural context in which the backbone is deployed,” they wrote.