OPEN LINK ↗
// 5h agoBENCHMARK RESULT
Task-Tampering Benchmark Exposes Filter Blind Spots
Amazon Science’s benchmark tests 90 validated cases across three tool-use environments, showing that defenses tuned for explicit prompt overrides miss attacks that quietly corrupt observations or state. Detection-and-removal reduced objective attacks to 2.4% success but left observation and state attacks at 9.5% and 12.1%, while tool-policy gates blocked as little as 0% of attacked calls.
// ANALYSIS
Prompt-injection defenses often recognize commands, not unauthorized influence: fabricated facts can look like legitimate evidence while steering a real task. Agent builders need provenance-aware controls and argument-level authorization, not just smarter blocklists.
- –The benchmark covers productivity, DevOps, and marketplace agents with 1,433 injection variants.
- –State-targeting attacks succeeded roughly five times more often than objective-targeting attacks after filtering.
- –Tool gates struggled because tampered calls used legitimate tools with poisoned arguments or runtime-derived values.
- –The paper reframes prompt injection as an authority violation, not merely instruction-shaped text.
- –Consequential fields should be tied to explicitly authorized sources outside the model’s control.
// TAGS
task-tampering-prompt-injectionbenchmarkevaluationsecuritysafetyagenttool-use
DISCOVERED
5h ago
2026-11-08
PUBLISHED
5h ago
2026-11-08
RELEVANCE
9/ 10
AUTHOR
Extravagantor