Preprint finds prompt changes sharply alter tool-agent attack success

Researchers report that changing only the system prompt moved prompt-injection attack success from 0.2% to 43% on InjecAgent while model weights stayed identical. Their preprint audits 33,000 trajectories from eleven open-weight agents with 2-14B parameters on InjecAgent and AgentDojo. A language-model judge classified most failed attacks as ignored instructions, at 76-80%, rather than explicit refusals, at 17-18%. In 21.7% of AgentDojo episodes, agents stayed safe but failed to complete the user's task. The researchers released their labeled corpus, judge prompt and analysis code; their results concern the tested small agents and benchmarks.