Oct 16, 2026
BRAC University audit finds 76-80% of failed prompt-injection attacks on small open-weight agents were ignored, not refused
BRAC University researchers audit 33,000 trajectories from eleven open-weight agents (2-14B parameters) on InjecAgent and AgentDojo with a label-blind LLM judge, and report that 76.3% (AgentDojo) and 80.3% (InjecAgent) of attacks the benchmarks scored as failed were ignored by the agent, against 18.0% and 17.2% genuinely refused. Holding models and attacks fixed, they report that a system prompt permitting instructions in tool outputs raised pooled InjecAgent attack success from 8.09% at baseline to 43.05%, while a matched prohibiting prompt lowered it to 0.22%. The study uses static injections, greedy decoding and a single LLM judge, and does not test adaptive attackers or live deployments.