Large language model agents are increasingly trusted with external APIs, persistent memory, and production execution privileges. Yet these systems still operate on raw text ingested across untrusted external channels, inheriting a fundamental architectural flaw: LLMs lack any native mathematical or structural boundary to separate privileged control instructions from untrusted data context.
Reframing Prompt Injection as Search
When tool-augmented agents ingest third-party data, indirect prompt injection lets external adversaries plant malicious instructions directly into the processing pipeline. Once parsed, these payloads hijack tool calls and execute actions under the agent's permission envelope, opening direct paths to arbitrary code execution and persistent data exfiltration.
To demonstrate how modern attacks actually unfold, researchers Duong M. Nguyen, Joon Sik Kim, Blazej Manczak, and Vaikkunth Mugunthan from Dynamo AI and UIUC reframed indirect prompt injection as a test-time search problem. The authors highlight that conventional safety benchmarks treat injection as a static string-matching exercise, completely ignoring the dynamic interaction trajectories that emerge across complex enterprise workflows.
"We formulate indirect prompt injection as a test-time search over a task-dependent attack surface induced by the environment, user task, and injection task."
As the Dynamo AI and UIUC team demonstrates, every user workflow exposes a unique, dynamic attack surface across tools and data feeds. Measuring actual defense posture requires quantifying how effectively an adversarial agent navigates that state space rather than grading static filter lists.
The Agentic Attacker Architecture
The research team deployed an agentic attacking harness designed around three explicit operational stages: Environment Reconnaissance, Strategic Reasoning and Search, and Output Evaluation with Feedback.
This framework maps the execution environment, orchestrates structured search trees over potential injection vectors, and iteratively refines payloads against intermediate execution feedback from the victim agent. Across diverse benchmark suites, the empirical data is unequivocal: scaling the attacker's test-time compute budget yields consistent gains in both vulnerability discovery and payload exploitation rates. Ablation data confirms that structured strategy pruning is essential to avoid redundant execution paths and maximize attack yield per compute dollar.
What this means:
Standard enterprise red-teaming relying on fixed, static evaluation budgets is fundamentally broken—it systematically underestimates exposure against compute-scaled, adaptive adversaries. Because offensive capability scales directly with inference-time compute, CISO and engineering teams must abandon static prompt guards in favor of runtime behavioural sandboxing and deterministic isolation of external data payloads.