'The Attacker Moves Second': adaptive attacks bypass 12 published jailbreak and injection defenses

Key facts

As stated in the sources, with where to find them.

• 12 defenses bypassed with attack success above 90% for most; most had originally reported near-zero ASR.Abstract
• Spotlighting and Prompt Sandwiching on AgentDojo: as low as 1% attack success under the benchmark's static attacks (authors' re-implementation) vs over 95% with the adaptive search attack.Section 5.1
• Meta SecAlign (AgentDojo): 2% originally vs 96% adaptive; PromptGuard and Protect AI detector: over 90%; PIGuard: 71%; MELON: 76%, rising to 95% with full defense knowledge.Sections 5.2-5.4
• A human red-teaming competition with 500+ participants and a $20,000 prize pool succeeded in every challenge on the subset of defenses included in the human study.Section 6; Appendix E

Findings that cite this record

Key questions this bears on

• Can prompt injection against AI agents be reliably defended?Not reliably. Defenses reduce injection but none has eliminated it; limiting what untrusted input can trigger is the most defensible approach.

Sources

• The Attacker Moves Second: Stronger Adaptive Attacks Bypass Defenses Against Llm Jailbreaks and Prompt InjectionsarXivOct 10, 2025Primary sourceAccessed Sep 25, 2026
• The Attacker Moves Second (HTML)arXivOct 10, 2025Primary sourceAccessed Sep 25, 2026
• New prompt injection papers: Agents Rule of Two and The Attacker Moves SecondSimon Willison's WeblogNov 2, 2025Secondary sourceAccessed Sep 25, 2026

Related records