# Preprint finds prompt changes sharply alter tool-agent attack success

_Published Monday, October 19, 2026 at 4:06 AM EDT · Science, AI · Latest · Tier 2 — Notable_

Researchers report that changing only the system prompt moved prompt-injection attack success from 0.2% to 43% on InjecAgent while model weights stayed identical. Their preprint audits 33,000 trajectories from eleven open-weight agents with 2-14B parameters on InjecAgent and AgentDojo.

A language-model judge classified most failed attacks as ignored instructions, at 76-80%, rather than explicit refusals, at 17-18%. In 21.7% of AgentDojo episodes, agents stayed safe but failed to complete the user's task. The researchers released their labeled corpus, judge prompt and analysis code; their results concern the tested small agents and benchmarks.

## Sources

- [cs.CL updates on arXiv.org](https://arxiv.org/abs/2610.23254)

---
Canonical: https://techandbusiness.org/newswire/xUE1CChjjLpGvroE5gVwh0
Published: 2026-10-19T08:06:33.496Z
Story chronology: 2026-10-19T04:00:00.000Z
Retrieved: 2026-10-19T11:01:35.274Z
Publisher: Tech & Business (techandbusiness.org)