{
 "license": "CC-BY-4.0",
 "attribution": "Fide AI, Agentic Cyber Explorer",
 "url": "https://agentic-cyber-explorer.pages.dev/findings/undefended-agents-follow-injections/",
 "asOf": "2026-09-26",
 "id": "undefended-agents-follow-injections",
 "claim": "Undefended tool-using agents follow injected instructions in a substantial share of benchmark cases.",
 "evidenceKind": "measured",
 "scope": "Benchmark settings with the models and attacks of 2024 and early 2025; rates vary widely by model, attack, and task, and are much lower for frontier models tested in 2026.",
 "topics": [
  "prompt-injection"
 ],
 "atlas": [
  "untrusted-content",
  "tools"
 ],
 "evidence": [
  {
   "event": "injecagent-benchmark-2024",
   "note": "ReAct-prompted GPT-4 followed injected instructions in 24% of base-setting cases."
  },
  {
   "event": "agentdojo-benchmark-2024",
   "note": "Undefended GPT-4o executed the attacker's goal in about 48% of cases under one attack."
  },
  {
   "event": "agent-security-bench-asb-2024",
   "note": "Indirect injection averaged 27.55% success across 13 backbones; a mixed attack adding direct injection and memory poisoning averaged 84.30%."
  },
  {
   "event": "us-aisi-agent-hijacking-evaluations-2025",
   "note": "Red-team attacks on Claude 3.5 Sonnet (October 2024) agents reached 81% success on held-out AgentDojo tasks."
  }
 ],
 "relations": [],
 "statusHistory": [
  {
   "status": "reported",
   "on": "2024-03-05",
   "why": "InjecAgent measures agents following injected instructions.",
   "event": "injecagent-benchmark-2024",
   "kind": "evidence"
  },
  {
   "status": "corroborated",
   "on": "2024-06-19",
   "why": "AgentDojo, from a different group, measures the same failure.",
   "event": "agentdojo-benchmark-2024",
   "kind": "evidence"
  },
  {
   "status": "qualified",
   "on": "2026-09-26",
   "why": "Public red-teaming competitions on 2025 and 2026 frontier models with built-in safeguards report much lower per-model success (0.5% to 8.5% in 2026), though every model was hijacked at least once. The substantial rates describe 2024 models and benchmarks.",
   "event": "gray-swan-caisi-aisi-indirect-injection-competition-2026",
   "kind": "evidence"
  }
 ],
 "halfLifeDays": 540,
 "wouldChange": "A benchmark showing current frontier agents rarely follow injections without defenses.",
 "fideQuestions": [],
 "methods": [
  "indirect-prompt-injection"
 ],
 "review": "assistant-drafted",
 "addedOn": "2026-09-25"
}