Containment Moved Downstream: How Deployed Agents Fight Prompt Injection by Giving Up Reach

Four stations, one email

A crafted email arrives in an employee's Microsoft 365 Copilot mailbox [1]. Nobody opens it.

Some time later the same employee asks Copilot an ordinary business question. Copilot's retrieval layer, doing exactly its job, pulls the attacker's email into context because it looks relevant. The attack does not need to guess the question: Checkmarx's analysis describes the technique as RAG spraying, seeding the vector search space with content likely to be retrieved by something, so that a generic prompt is enough to trigger it [4]. The email's text is written to read as a normal request to a human recipient, which is how it slipped past XPIA, Microsoft's cross-prompt-injection classifier [1].

Copilot then reaches for the sensitive material it already had permission to read, and writes it into a link in its own answer. Copilot's output filter was built to redact Markdown-style hyperlinks; the payload used reference-style Markdown instead, a syntax the filter did not cover [1]. The link was an image, so the client rendered it without being asked, which is what makes the exploit zero-click [1]. The last obstacle was the Content Security Policy, which permitted image loads only from an allowlist of Microsoft domains — and the allowlist included a Microsoft service that would fetch an arbitrary external URL on the client's behalf, so the stolen data left through a domain the policy trusted [1].

This is CVE-2025-32711, reported by Aim Labs, part of Aim Security, together with a Microsoft researcher, and fully mitigated by Microsoft with no action required from users of the service [3]. Microsoft scored it 9.3, critical; NIST's independent scoring of the same record is 7.5, high [2]. It is, on the arXiv case study's account, the first real-world zero-click prompt injection exploit in a production LLM system [1].

The chain has a shape. The payload passes four stations. It enters as content the agent chose to read. It is interpreted as an instruction rather than as data. It becomes an action — a retrieval, a tool call, a rendered response. And it egresses, carrying data out. Every containment architecture is a cut at one of those four points, and they do not hold equally.

Copilot had defenses at three of the four. The classifier stood at interpretation. Link redaction and the Content Security Policy stood at egress. Each of them, the case study concludes, gave way under modest adversarial pressure [1]. This is not a clean advertisement for cutting downstream: an egress control was in the path, and it failed. But the two failures are not the same kind of thing. The classifier failed because a sufficiently natural-sounding sentence is indistinguishable from a request. The Content Security Policy failed because its allowlist contained a general-purpose fetcher — a configuration error in an otherwise deterministic control. One failure is a property of what classifiers are; the other is a bug in how a boundary was written down.

There is a version of the same control without the hole. Google's markdown sanitizer identifies external image URLs and refuses to render them at all, which is why Google states that the EchoLeak image-rendering exfiltration is not applicable to Gemini [7]. Same station, no allowlist to get wrong.

The first station is the open web

One CVE is an anecdote. The obvious first response to an anecdote is to filter the input, so it matters what the input actually is.

Researchers from Google DeepMind and the Google Threat Intelligence Group scanned monthly Common Crawl snapshots of two to three billion pages each, looking for injection patterns in ordinary web content [5]. They sorted what they found into categories — harmless pranks, helpful guidance for agents, SEO manipulation, attempts to deter AI crawlers, and outright malicious exfiltration and destruction — and measured a relative increase of 32% in the malicious category between November 2025 and February 2026 [5]. Their own reading of it is deliberately unexcited: "Our results indicate that attackers are experimenting with IPI on the web. While the observed activity suggests limited sophistication, this might be only part of the bigger picture." [5] The scan covered the public web archive and did not capture major social platforms [5].

An academic measurement lands in the same place from a different direction. Khodayari and colleagues analysed 1.2 billion URLs across 24.8 million hosts and validated 15.3 thousand injection instances, found on 11,722 pages spanning 2,042 hosts [6]. The distribution is the interesting part: Common Crawl alone contributed 12,075 validated instances at an average of 42 per affected domain, with as many as 2,180 on a single host, a pattern the authors attribute to injections riding along in third-party or user-generated content that gets replicated across many pages of a large platform [6]. Their summary judgment is one sentence: "In-page prompt injection is not merely an anecdotal phenomenon." [6]

Neither study establishes that these injections are working. They measure supply, not conversion. What they do establish is that the entry station is the open web itself — job listings, marketplace pages, forum comments — and that whatever an agent reads is drawn from a corpus that already contains this material at scale. A defense that depends on the agent never ingesting an injection is a defense against a condition that no longer holds.

So the cut has to go downstream of entry. The industry's first answer was to put it at the next station along.

What the in-model cut actually buys

The second station is interpretation: the moment the model decides that a sentence in retrieved data is an instruction. Defenses that live here are in-band — they operate inside the same probabilistic system they are trying to protect. The family is well populated. Classifiers scan untrusted content entering the context window and flag suspected injections [18]. Spotlighting marks untrusted spans so the model can tell them apart. OpenAI's Instruction Hierarchy trains models to rank trusted against untrusted instructions, described publicly in November 2025 as one layer among safety training, automated monitors, user controls and a bug bounty [9]. Google adds markdown sanitisation, suspicious-URL detection through Safe Browsing, and a human-in-the-loop confirmation framework that requires user approval before risky operations such as deleting a calendar event [7]. And underneath all of it sits model hardening: adversarial fine-tuning on injection scenarios generated by an automated red-teaming system [8].

Measuring any of this takes three terms. Attack success rate, or ASR, is the fraction of attack attempts that achieve the attacker's goal. Benign utility is how many ordinary tasks the agent still completes; utility under attack is how many it completes while injections are present. AgentDojo, the benchmark most of this literature reports against, supplies all three from 97 realistic agent tasks and 629 security test cases, built as an extensible environment rather than a fixed test set precisely so that new attacks and defenses can be added [10].

The results are genuinely mixed, and the mixture is the point. Three rows of AgentDojo's own published table carry it. GPT-4o with no defense at all, under the important-instructions attack, records 47.69% targeted ASR, at 69.07% utility and 50.08% utility under attack [11]. Add a prompt-injection detector and targeted ASR drops to 7.95% — a real reduction — while benign utility falls to 41.24% and utility under attack to 21.14% [11]. A lighter defense that simply repeats the user prompt lands in between, at 27.82% ASR while holding 84.54% utility [11]. Each step that suppresses more attacks leaves less working agent behind, and the trade is legible at this station already.

Model hardening is the strongest card the in-band position holds, and it is a real card. Google DeepMind reports that fine-tuning Gemini on adversarially generated injection scenarios lowered its attack success rate "without significantly impacting the model's performance on normal tasks" [8]. A published literature review of the same white paper — a summary of it, not the paper itself — reports that layering adversarial training with a Warning defense took the Calendar Event scenario from 94.6% ASR for adversarially trained Gemini 2.5 alone to 6.2% against an adaptive TAP attack [12]. Two large vendors are betting substantial engineering on this direction, and they are not doing it on faith.

They are also unusually explicit about the ceiling. The same DeepMind post that reports the hardening gain says: "This finding illustrates a key point: relying on defenses tested only against static attacks offers a false sense of security. For robust security, it is critical to evaluate adaptive attacks." [8] SecurityWeek, reporting from the white paper, puts a number on what happens when you do: adaptive attacks increased the attack success rate against Gemini 2.0's defenses in 16 out of 24 cases [13].

The vendor named the question. Taking them at their word means asking what a published ASR means once the attacker gets to move after the defense ships.

The attacker moves second

Nasr, Carlini and colleagues answered that question directly. Writing with co-authors from OpenAI, Anthropic, Google DeepMind, ETH Zurich and Northeastern, and publishing at USENIX Security 2026, they took twelve recently proposed defenses and attacked each one with methods designed for its specific mechanism [14].

The list spans the whole in-band family: Spotlighting, Prompt Sandwiching and Robust Prompt Optimization on the prompting side; Circuit Breakers, StruQ and MetaSecAlign on the training side; Protect AI Detector, PromptGuard, PIGuard, Model Armor, Data Sentinel and MELON on the filtering side [14]. All twelve fell, at success rates often above 90%, to a mixture of gradient-based optimisation, reinforcement learning, search, and a large-scale human red-teaming competition with more than 500 participants working inside AgentDojo [14]. Their framing of the failure is methodological rather than technical: defenses are typically evaluated "either against a static set of harmful attack strings, or against computationally weak optimization methods that were not designed with the defense in mind", and that evaluation, they argue, is flawed [14].

Their reason for expecting this to persist is worth quoting exactly, because it is a claim about the shape of the problem rather than about any one defense: "the defense mechanisms themselves will eventually appear in internet scale training data" [14]. A defense whose safety depends on the attacker not knowing how it works has a shelf life measured in publication cycles.

The pattern repeats with adversarially trained models, which is where the in-band bet is heaviest. These are defenses that reported near-zero numbers against the attack sets they were published with. A 2026 survey of out-of-band defenses summarises what happens once the attacker is allowed to design for them: adaptive GCG attacks drive StruQ to roughly 1.00 attack success on MMLU-PI and SecAlign to 0.88 on the same benchmark, and architecture-aware attacks break StruQ, SecAlign and a successor at up to 85 to 95% success on unseen prompts [15].

The asymmetry also runs in the transfer direction, and it runs one way. Gray Swan, which operates a public indirect-prompt-injection arena, retested 2,679 successful attacks across all thirteen models in its competition: attacks that had originally broken the most robust model transferred to every other model at a 44 to 81% success rate, while attacks tuned against the weakest model barely transferred upward at all [17].

None of this means in-band defenses do nothing. It means a published ASR is a statement about a specific attacker under a specific budget, and it stops being informative the moment either changes.

One model, four numbers

Which brings the question to its sharpest form. Here is one model, Claude Opus 4.5, measured four times. Each of the four sources below names that model; not all four are measuring it alone.

0.5%. In the Indirect Prompt Injection Arena, 464 participants submitted 272,000 attack attempts against 13 frontier models, yielding 8,648 successful attacks across 41 scenarios; Opus 4.5 was the most robust model in the field at 0.5% ASR, and Gemini 2.5 Pro the most vulnerable at 8.5% [16]. The bar was deliberately strict: an attack counted only if the agent both executed the harmful action and concealed it, judged by a programmatic tool check plus an LLM judge scoring whether the final response hid the compromise from the user [16].

About 1%. Anthropic's own browser-use measurement, against an internal adaptive Best-of-N attacker that tries and combines many injection techniques, published alongside the extension's move from research preview to beta [18]. This one belongs to the shipped Claude for Chrome configuration rather than to the model on its own: the post credits Opus 4.5 with stronger browser-use robustness than previous models, and separately credits new safeguards added since the research preview that improve safety across all Claude models [18]. Anthropic's framing of its own number is unusually direct: "A 1% attack success rate—while a significant improvement—still represents meaningful risk." [18]

4.7%, then 33.6%, then 63.0%. Opus 4.5 under evaluations run by Gray Swan, an external red-team group, at one query, ten queries and one hundred queries — as a published summary of the robustness data Anthropic released with the model reports them, rather than that release itself [19]. Nothing about the model changed between those three numbers. Only the attacker's budget did.

Up to 83%. RedTeamCUA tests computer-use agents in a hybrid sandbox that couples a VM-based operating system with self-hosted web platforms, across 864 benchmark examples, under a threat model where the attacker may only inject text into places users can already post — forum comments, chat messages, shared files [21]. In that setting Claude 3.7 Sonnet records 42.9% ASR, and Operator, the most secure agent evaluated, still records 7.6% [21]. The realistic end-to-end numbers run higher. Claude Sonnet 4.5 reaches 60%, Claude Opus 4.6 50%, and Claude Opus 4.5 the highest ASR of any agent evaluated, 83% [21].

That is one model at both ends of the range: the Arena puts Claude Opus 4.5 at 0.5% [16], and RedTeamCUA puts the same model at 83% as a computer-use agent [21]. Neither number is wrong. They are answers to different questions, and the harness is most of the question.

Two findings explain the spread.

The first is persistence, and what moves the number is the surface and the attempt budget rather than the model. Anthropic's Opus 4.6 system card, as reported by VentureBeat, breaks prompt-injection success rates out by surface and by number of attempts: in a GUI-based system with extended thinking enabled, a single attempt succeeds 17.8% of the time without safeguards, and by the 200th attempt the breach rate reaches 78.6% without safeguards and 57.1% with them [20]. In a constrained coding environment, the same model records 0% across 200 attempts [20]. Same model, same week.

The second is that capability does not rescue this, and may work against it. RedTeamCUA's attempt rate — how often the agent tries to carry out the injected task, whether or not it succeeds — reaches as high as 92.5%, meaning agents are almost always influenced and often merely fail at execution [21]. The authors are explicit about where that goes: "this gap is likely to close, meaning the same vulnerabilities will lead to much higher rates of actual harm" [21]. In the Arena, capability and robustness showed only a weak, statistically insignificant relationship, r = -0.31 with p = 0.3, which the researchers read as evidence that robustness tracks model family and training recipe more than raw intelligence [16].

Put the persistence curve next to the transfer result and the in-band position runs into simple arithmetic. On an open surface, per-attempt robustness is not zero, and nothing in the published record drives it there. Attempts, on the open web, are effectively unbounded. Whatever the per-attempt number is, a patient attacker gets to sample from it as often as they like.

So the instruction is going to get through. The remaining question is what it can reach when it does.

Cutting at the action instead

Out-of-band defenses take that concession as their starting assumption. The model will be fooled; the designers arrange the system so that being fooled authorises nothing. Enforcement moves from a judgment about text to a check on a tool call, and that check is deterministic.

CaMeL, from Google DeepMind and ETH Zurich, is the clearest instance. A privileged language model sees only the trusted user query and never the untrusted data; its job is to emit a program in a restricted Python dialect. A quarantined language model parses untrusted content and holds no tools at all. A custom interpreter, built on Python's own ast library and interpreting the syntax tree node by node, carries capability labels through every value — where this data came from, who is allowed to read it — and evaluates a policy against those labels before any tool call executes [24]. The load-bearing property follows from the ordering: "CaMeL explicitly extracts the control and data flows from the (trusted) query; therefore, the untrusted data retrieved by the LLM can never impact the program flow." [22] The control flow is fixed before the untrusted bytes arrive. An injection can change what a variable contains; it cannot change which tool gets called with it, and it cannot strip the label that says where the value came from.

FIDES, from Microsoft Research, arrives at the same station from information-flow control. It tags every value an agent handles with a confidentiality label and an integrity label, and sorts tools into three boxes: consequential actions, egress channels, and everything else. An integrity policy governs the first box, a confidentiality policy the second. What FIDES aims at is non-interference, a property it states formally rather than measures empirically [25]. Their sentence for the mechanism is precise: "By attaching confidentiality and integrity labels to all data an agent processes, one can build up the context needed to decide deterministically whether a consequential action, such as invoking a tool, is safe to proceed." [25]

A 2025 design-pattern paper generalises the family. Action-selector agents never let untrusted output reach the user or the planner at all, choosing only from a fixed set of actions. Plan-then-execute fixes the plan before untrusted data is read, allowing later data only to fill parameters that the plan already anticipated. Dual LLM, code-then-execute, map-reduce over isolated sub-agents, and context minimisation are variations on the same commitment to isolating untrusted data from control flow [26].

None of these designs answers the attempt-budget problem by getting better at recognising malicious text.

The same paper is explicit about the scope inside which these patterns work, in the sentence its authors chose to lead with: "As long as both agents and their defenses rely on the current class of language models, we believe it is unlikely that general-purpose agents can provide meaningful and reliable safety guarantees." [26] The word doing the work is general-purpose.

The bill, and the measurement nobody has run

CaMeL's own arithmetic states the price without being asked. It completes 77% of AgentDojo tasks with provable security, against 84% for an undefended system [22]. Seven points of task completion is what the guarantee costs on that benchmark, and it is the defenders reporting it.

The authors are equally plain about the rest. The paper's own closing section asks whether prompt injections are solved now, and answers: "No, prompt injection attacks are not fully solved." [24] The limitation they name is not a gap in the mechanism but a gap in who operates it — users have to codify security policies and maintain them, and the paper names user fatigue, the state in which a person confronted with enough approval dialogs starts approving everything, as the failure mode that balancing security against usability runs into [24]. The released implementation carries its own warning: "This is a research artifact released to reproduce the results in our paper", the interpreter "might not be fully secure", and "This is not a Google product, and we are not planning to provide support for and/or maintain this codebase." [23]

The shipped version of the same cut is blunter and shows the trade at production scale. OpenAI's Lockdown Mode, announced in February 2026 and rolled out to personal and self-serve business accounts in June, "deterministically disables certain tools and capabilities in ChatGPT that an adversary could attempt to exploit to exfiltrate sensitive data from users' conversations or connected apps via attacks such as prompt injections" [27]. In practice that means live web browsing limited to cached content so no network request leaves OpenAI's controlled network, plus image support, Deep Research, Agent Mode, Canvas networking, live connectors and file downloads turned off or limited [27, 28]. It is the egress station severed by hand, and everything severed with it is a feature somebody was paying for. OpenAI's own caveat is that Lockdown Mode "does not guarantee that data exfiltration cannot happen", since risk can remain through enabled apps, unforeseen combinations of capabilities, or newly discovered techniques [28].

The case against in-band defenses is strong because someone ran the adaptive evaluation and published what it did to twelve of them. No equivalent pass exists for the out-of-band family. A 2026 survey organising CaMeL, FIDES, Progent, RTBAS and FORGE as instances of classical integrity protection and reference monitoring makes exactly this warning about the work it is surveying: every one of them is validated only on static benchmarks — a fixed set of injection attempts — which is the same methodology that made in-band defenses look strong until defense-aware attacks broke twelve of them at over 90% success [15]. The survey's own reproduction is instructive about how thin the current evidence is. Running Progent on AgentDojo with an open-weight Qwen2.5-7B agent on a single GPU, averaged over three runs, the defense held: mean attack success fell from 25.8% to 4.2%, and a hand-crafted adaptive attack did not raise it, landing at 2.6% [15]. The authors then say what that is worth: one small-scale data point, one weak model, one black-box attack template, with a stronger optimised white-box attack still open, and the result "consistent with, but does not establish" the hypothesis that deterministic out-of-band enforcement is a harder target than in-band detection [15].

There is a structural reason to expect the downstream cut to hold better — a policy check on a labelled value has no probability distribution to be nudged, and an attacker who cannot alter control flow cannot reach a tool that the plan never called. EchoLeak is a reminder that this is a property of complete enforcement rather than of enforcement in general: the Content Security Policy in that chain was deterministic too, and it failed because its allowlist had a hole in it [1]. Deterministic controls fail differently, not less often, when they are specified wrong.

So the position the evidence actually supports is narrower than the one the architectures advertise. Cutting at the action turns the failure mode from a probability into a specification bug, and specification bugs are the kind of problem security engineering already knows how to attack. What it is not, yet, is a defense that has survived what the field did to the alternative. The cut that currently holds does so partly because that pass has not been run against it — and on the record of the last two years, someone will run it.