LivePI: More Realistic Benchmarking of Agents Against Indirect Prompt Injection
Open accessAbstract
AI agents such as OpenClaw are increasingly deployed in local workflows with access to external tools. This creates indirect prompt-injection (IPI) risk: an agent may execute harmful instructions embedded in untrusted inputs such as email, downloaded files, webpages, repositories, or group-chat messages. Existing evaluations are often small, purely simulated, or focused on a narrow set of channels. We introduce LivePI (Live Prompt Injection), a structured benchmark for IPI risk in a production-like but test-controlled environment. LivePI covers seven input surfaces, twelve attack/rendering families, and five malicious goals, including protected-information exfiltration, unauthorized security-control changes, unsafe code retrieval or execution, inbox-summary exfiltration, and cryptocurrency transfer. We run LivePI on a real virtual machine with live but test-controlled email, chat, web, local-file, repository, and wallet interfaces. Across GPT-5.3-Codex, Claude Opus 4.6, Gemini 3.1 Pro, Kimi K2.5, and GLM-5, total attack success rates range from 10.7% to 29.6%. Group-chat injection is uniformly successful across the evaluated backbones in our deployment, and repository-link attacks produce high-severity failures despite a small denominator. We also evaluate a two-layer defense consisting of prompt-level filtering and pre-execution tool-call authorization. In the GPT-5.3-Codex setting, the defense intercepts all tested malicious-goal completions in LivePI before execution while preserving benign utility on PinchBench-derived workloads.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Closely related work evaluates high privilege agents, persistent compromise, attacks across execution stages, and safety violations over complete trajectories.
“Closely related work evaluates high privilege agents, persistent compromise, attacks across execution stages, and safety violations over complete trajectories (Wei et al., 2026; Zhao et al., 2026; Wang et al., 2026a; Tan et al., 2026; Liu et al., 2026).”
From HarnessRisk: A Lifecycle-Oriented Benchmark for Agent Harness Safety (2026) · cites this paper as Zhao et al., 2026
The Introduction (page unavailable) describes high-privilege agents, and the Attack techniques and Code-carried execution sections (pages unavailable) evaluate unsafe outcomes using interaction traces, tool calls, and execution artifacts. Our copy does not show LivePI evaluating persistent compromise as an outcome or explicitly organizing attacks across execution stages; its discussion of memory pollution credits other work. (LLM, conf=0.84)
Experimental — accuracy not yet measured
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
Judging LLM-as-a-Judge with MT-Bench and Chatbot Arena
Zheng, L., Chiang, W.-L., Sheng, Y., Zhuang, S., Wu, Z., Zhuang, Y., Lin, Z., Li, Z., Li, D., Xing, E. P., et al. (2023) · arXiv · doi:10.48550/arxiv.2306.05685 · Cited by 1,888 · see citing works
Greshake, K., Abdelnabi, S., Mishra, S., Endres, C., Holz, T., & Fritz, M. (2023) · Proceedings of the 16th ACM Workshop on Artificial Intelligence and Security · doi:10.1145/3605764.3623985 · Cited by 667 · see citing works
Red Teaming Language Models with Language Models
Perez, E., Huang, S., Song, F., Cai, T., Ring, R., Aslanides, J., Glaese, A., McAleese, N., & Irving, G. (2022) · Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing · doi:10.18653/v1/2022.emnlp-main.225 · Cited by 363 · see citing works
Universal and Transferable Adversarial Attacks on Aligned Language Models
Zou, A., Wang, Z., Carlini, N., Nasr, M., Kolter, J. Z., & Fredrikson, M. (2023) · arXiv · doi:10.48550/arxiv.2307.15043 · Cited by 197 · see citing works
InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents
Zhan, Q., Liang, Z., Ying, Z., & Kang, D. (2024) · Findings of the Association for Computational Linguistics: ACL 2024 · doi:10.18653/v1/2024.findings-acl.624 · Cited by 147 · see citing works
(2024) · doi:10.52202/079017-2636 · Cited by 139 · see citing works
OS-Harm: A Benchmark for Measuring Safety of Computer Use Agents
Kuntz, T. M., Duzan, A., Zhao, H.-C., Croce, F., Kolter, Z., Flammarion, N., & Andriushchenko, M. (2025) · Neural Information Processing Systems · doi:10.48550/arxiv.2506.14866 · Cited by 133
NeMo Guardrails: A Toolkit for Controllable and Safe LLM Applications with Programmable Rails
Rebedea, T., Dinu, R., Sreedhar, M. N., Parisien, C., & Cohen, J. (2023) · Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing: System Demonstrations · doi:10.18653/v1/2023.emnlp-demo.40 · Cited by 130 · see citing works
MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI AgentsPreprint
Zhu, K.-J., Yang, X., Wang, J.-D., Guo, W.-B., & Wang, W. Y. (2025) · International Conference on Machine Learning · doi:10.48550/arxiv.2502.05174 · Cited by 115 · see citing works
Prompt Injection attack against LLM-integrated Applications
Liu, Y., Deng, G., Li, Y., Wang, K., Wang, Z., Wang, X., Zhang, T., Liu, Y., Wang, H., Zheng, Y., et al. (2023) · arXiv · doi:10.48550/arxiv.2306.05499 · Cited by 100 · see citing works
The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agents
Jia, F., Wu, T., Qin, X., & Squicciarini, A. (2025) · Proceedings of the conference - Association for Computational Linguistics. Meeting · doi:10.18653/v1/2025.acl-long.1435 · Cited by 34 · see citing works
Liu, S.-Y., Li, C.-Z., Wang, C.-X., Hou, J.-Y., Chen, Z., Zhang, L.-T., Liu, Z., Ye, Q.-W., Hei, Y., Zhang, X., et al. (2026) · arXiv.org · doi:10.48550/arxiv.2603.24414 · Cited by 22
Uncovering Security Threats and Architecting Defenses in Autonomous Agents: A Case Study of OpenClawPreprint
Ying, Z.-H., Yang, X., Wu, S.-Y., et al. (2026) · arXiv.org · doi:10.48550/arxiv.2603.12644 · Cited by 20 · see citing works
Identifying the Risks of LM Agents with an LM-Emulated Sandbox
Ruan, Y., Dong, H., Wang, A., Pitis, S., Zhou, Y., Ba, J., Dubois, Y., Maddison, C. J., & Hashimoto, T. (2023) · arXiv · doi:10.48550/arxiv.2309.15817 · Cited by 19 · see citing works
Length-Controlled AlpacaEval: A Simple Way to Debias Automatic Evaluators
Dubois, Y., Galambosi, B., Liang, P., & Hashimoto, T. B. (2024) · arXiv · doi:10.48550/arxiv.2404.04475 · Cited by 17 · see citing works
The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructions
Wallace, E., Xiao, K., Leike, R., Weng, L., Heidecke, J., & Beutel, A. (2024) · arXiv · doi:10.48550/arxiv.2404.13208 · Cited by 14 · see citing works
AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agents
Andriushchenko, M., Souly, A., Dziemian, M., Duenas, D., Lin, M., Wang, J., Hendrycks, D., Zou, A., Kolter, Z., Fredrikson, M., et al. (2024) · arXiv · doi:10.48550/arxiv.2410.09024 · Cited by 11 · see citing works
Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agents
Zhang, H., Huang, J., Mei, K., Yao, Y., Wang, Z., Zhan, C., Wang, H., & Zhang, Y. (2024) · arXiv · doi:10.48550/arxiv.2410.02644 · Cited by 9 · see citing works
Defending Against Indirect Prompt Injection Attacks With Spotlighting
Hines, K., Lopez, G., Hall, M., Zarfati, F., Zunger, Y., & Kiciman, E. (2024) · arXiv · doi:10.48550/arxiv.2403.14720 · Cited by 8 · see citing works
Agent-SafetyBench: Evaluating the Safety of LLM Agents
Zhang, Z., Cui, S., Lu, Y., Zhou, J., Yang, J., Wang, H., & Huang, M. (2024) · arXiv · doi:10.48550/arxiv.2412.14470 · Cited by 6 · cited 1× · see citing works
“…LM-emulated sandbox to scale risk analysis [1], while later benchmarks such as AgentDojo, Agent Security Bench (ASB), Agent-SafetyBench, and AgentHarm broaden coverage to richer tasks, broader attack surfaces, and explicitly harmful multi-step behaviors in mostly simulated settings [2, 5, 20, 21].”
Shapira, N., Wendler, C., Yen, A., Sarti, G., Pal, K., Floody, O., Belfki, A., Loftus, A., Jannali, A. R., Prakash, N., et al. (2026) · arXiv · doi:10.48550/arxiv.2602.20021 · Cited by 6 · see citing works
Mind Your HEARTBEAT! Claw Background Execution Inherently Enables Silent Memory Pollution
Zhang, Y.-C., Zhao, S.-Q., Zhang, J., et al. (2026) · arXiv.org · doi:10.48550/arxiv.2603.23064 · Cited by 4
Wu, F., Cecchetti, E., & Xiao, C. (2024) · arXiv (Cornell University) · doi:10.48550/arxiv.2409.19091 · Cited by 3 · see citing works
ClawTrap: A MITM-Based Red-Teaming Framework for Real-World OpenClaw Security Evaluation
Zhao, H., & Cui, S.-Y. (2026) · arXiv.org · doi:10.48550/arxiv.2603.18762 · Cited by 3
ClawSafety: "Safe" LLMs, Unsafe Agents
Wei, B., Zhang, Y., Pan, J., Mei, K., Wang, X., Hamm, J., Zhu, Z., & Ge, Y. (2026) · arXiv · doi:10.48550/arxiv.2604.01438 · Cited by 1 · see citing works
WASP: Benchmarking Web Agent Security Against Prompt Injection Attacks
Evtimov, I., Zharmagambetov, A., Grattafiori, A., Guo, C., & Chaudhuri, K. (2025) · arXiv · doi:10.48550/arxiv.2504.18575 · Cited by 1 · see citing works
OpenAgentSafety: A Comprehensive Framework for Evaluating Real-World AI Agent Safety
Vijayvargiya, S., Soni, A. B., Zhou, X., Wang, Z. Z., Dziri, N., Neubig, G., & Sap, M. (2025) · arXiv · doi:10.48550/arxiv.2507.06134 · cited 1×
“OpenAgentSafety pushes closer to deployment by exposing agents to real browsers, shells, file systems, and messaging tools, yet still evaluates them inside a containerized sandbox [22].”
Wang, Y., Xu, F., Lin, Z., et al. (2026) · arXiv (Cornell University) · doi:10.48550/arxiv.2602.08412
Don't Let the Claw Grip Your Hand: A Security Analysis and Defense Framework for OpenClawPreprint
Shan, Z., Xin, J., Zhang, Y., & Xu, M. (2026) · arXiv (Cornell University) · doi:10.48550/arxiv.2603.10387
OpenClaw PRISM: A Zero-Fork, Defense-in-Depth Runtime Security Layer for Tool-Augmented LLM AgentsPreprint
Li, F. (2026) · arXiv (Cornell University) · doi:10.48550/arxiv.2603.11853
Trojan's Whisper: Stealthy Manipulation of OpenClaw through Injected Bootstrapped GuidancePreprint
Liu, F., Chen, Z., Lan, T., Tan, H., Xu, Z., Li, X. L., Chen, G., Meng, Y., & Zhu, H. (2026) · arXiv (Cornell University) · doi:10.48550/arxiv.2603.19974
A Security Analysis of the OpenClaw AI Agent Framework
Suwansathit, S., Zhang, Y., & Gu, G. (2026) · arXiv · doi:10.48550/arxiv.2603.27517
Flagged first, then by citations
Research works printed but not linked: 2
- Jingwei Yi, Yueqi Xie, Bin Zhu, Emre Kiciman, Guangzhong Sun, Xing Xie, and Fangzhao Wu. Bench- marking and defending against indirect prompt injection attacks on large language models. In Proceedings of the 31st ACM SIGKDD Conference on Knowledge Discovery and Data Mining V. 1, pages 1809-1820, 2025. 1, 3, 5
- Hakan Inan, Kartikeya Upasani, Jianfeng Chi, Rashi Rungta, Krithika Iyer, Yuning Mao, Michael Tontchev, Qing Hu, Brian Fuller, Davide Testuggine, et al. Llama guard: Llm-based input-output safeguard for human-ai conversations, 2023. URL https://arxiv. org/abs/2312.06674, 2(6):15, 2024. 3
Cited by
Sorted by citations
HarnessRisk: A Lifecycle-Oriented Benchmark for Agent Harness Safety
Bai, Y., Duan, J., Peng, J., Wu, X., Liu, S., Wang, S., & Chen, T. (2026) · arXiv · doi:10.48550/arxiv.2608.17597
- Authors
- Zhao, L., Bhaskar, A., & Dobriban, E.
- Affiliations
- University of Pennsylvania (US)
- ORCID
- Dobriban, Edgar
- Venue
- arXiv
- Publisher
- arXiv
- Published
- 2026
- ISSN
- 2331-8422 (ISSN-L)
- arXiv
- 2605.17986
- OpenAlex
- W7161679589
- Cited by
- 0
- References
- 32
- Type
- posted content
- Language
- en
- Open access
- green
- arxiv.org
- Licence
- Locations
- arXiv (Cornell University) (submittedVersion, cc-by)
- arXiv (Cornell University) (cc-by)
- Funders
- National Science Foundation
- Alfred P. Sloan Foundation
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Artificial Intelligence › Security and Verification in Computing
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Keywords
- indirect prompt injection, AI agent security, benchmarking, prompt filtering, GPT-4, Claude, Gemini
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
