GPT-5.5 reaches 52.1% IPI attack success rate at 100K attacker tokens in Workspace agent tasks

Auto-published from arXiv:2609.04495 by the mine-arxiv pipeline. Reviewed by an LLM judge (Sonnet) against the archive bar — see CONTRIBUTING. Notes: cleared review (confidence 0.73, flags: [no-prompt-excerpt])

Category

indirect-prompt-injection

Model

GPT-5.5 (OpenAI 2026) [victim]; GLM-5.2 (2026, Together AI) [attacker]

Surface

API / agent harness (tool-using agent with email, calendar, cloud-drive tools — Workspace suite derived from AgentDojo)

Setup

An agentic GLM-5.2 attacker with a dedicated search harness (environment reconnaissance, strategy tracking, and adaptive evaluate_injection feedback loop) iteratively probes injection vectors against a GPT-5.5 victim agent operating on 40 user tasks × 6 injection tasks (240 total pairs). Both models run with 'high reasoning effort'. Attacker system prompt instructs: 'Treat this as a SEARCH problem. Each evaluate_injection call is a probe: use its evidence to search over the attack surface — e.g. payload content/framing, which vector carries it (and which the victim actually reads).' Successful payloads are placed in task-adjacent data the victim must read during legitimate workflow completion (e.g., meeting notes, todo lists). No verbatim attack payload is published; Appendix D contains full system prompts with {goal} placeholders.

Reproduction anchor

Appendix D (full attacker/victim system prompts with tool documentation); benchmark: Workspace suite derived from AgentDojo (40 user tasks × 6 injection tasks, n=240). No public code or dataset release; work explicitly proprietary to Dynamo AI.

Observed behavior

GPT-5.5 victim agent executes the attacker's injected goal while also completing the user's benign task, achieving 52.1% ASR at 100K attacker tokens in the Workspace suite. Attack success rate increases monotonically with compute budget.

Expected behavior

The victim agent should complete only the user-specified task and refuse or ignore injected instructions embedded in tool outputs (emails, calendar entries, drive documents).

Reproducibility

low

Threat model

Adversaries who control any content a tool-using LLM agent reads — product reviews, emails, shared documents — can adaptively discover working IPI payloads by scaling attacker compute. Production workplace automation agents (e-mail triage, scheduling assistants, document processors) are exposed to this risk from motivated attackers who invest inference budget rather than pre-computing static exploits.

Novelty

First empirical demonstration that IPI attack success is a monotonically increasing function of attacker test-time compute, establishing vulnerability discovery as a search problem rather than a static exploit property.

Source

• arXiv: 2609.04495
• PDF: https://arxiv.org/pdf/2609.04495
• Categories: cs.AI, cs.CL, cs.CR
• Authors: Duong M. Nguyen, Joon Sik Kim, Blazej Manczak, Vaikkunth Mugunthan

Triage notes (auto)

• paperType: red-team-vuln
• estimatedCaseCount: 2
• triage reason: Systematically evaluates indirect prompt injection vulnerabilities across multiple tool-using agent tasks using an agentic attacker with reproducible search-based attack methodology; demonstrates concrete exploitation with adaptive feedback loops.

─────────────────────────────────────────────────────────────────────