Preprint reports attacks that redirect AI agent decisions through untrusted context

Researchers report an attack that manipulates AI models used for agent routing, moderation and authorization, causing up to 24.00% end-to-end agent violations in tests. Their S1-Evo preprint targets models that select among rules and options rather than generate answers token by token. The work has not been peer reviewed. The attack alters untrusted fields to compete with the original task evidence, then reuses successful examples on unseen tasks. Across four benchmarks and three models, the researchers report a 71.99% mean attack success rate and a 57.47% high-confidence attack success rate on jev-1.14. The reported results come from benchmark and agent tests.