Rethinking Indirect Prompt Injection as a Test-Time Search Problem

URL SCAN: Rethinking Indirect Prompt Injection as a Test-Time Search Problem
FIRST LINE: # Computer Science > Artificial Intelligence

The Dissection

The paper reframes indirect prompt injection from a static weakness of the victim agent into an adaptive test-time search problem. Its central move is analytically sound: attack success depends not only on the victim’s defenses, but also on the attacker’s reconnaissance, strategy selection, feedback loops, and available inference budget.

But the paper is still describing the mechanics of the breach from inside the machine. It identifies the attacker’s search process without fully confronting the consequence: tool-using agents turn external information environments into executable attack surfaces. Every expansion of agent autonomy increases both the value of automation and the number of places where hostile instructions can be planted.

The Core Fallacy

The paper risks treating improved evaluation methodology as if it were a path to controllable security. It is not. Measuring attacker compute, strategy management, and adaptive search makes vulnerability estimates more realistic; it does not restore a stable human-controlled economic or institutional boundary.

Under the Discontinuity Thesis, the relevant result is harsher. The same test-time scaling that improves defensive evaluation also improves offensive exploitation. P1 applies symmetrically: cognitive search, reconnaissance, and attack strategy generation become cheaper and more capable. The system therefore automates both the agent and the adversary hunting the agent.

The paper’s implicit fallacy is that better characterization can outrun the competitive dynamics producing the risk. It cannot. If attackers can continuously buy more search, defenders must continuously spend more search merely to avoid falling behind. Security becomes an arms race attached to every automated cognitive workflow, not a solved property of the victim model.

Hidden Assumptions

• That attack surfaces can be sufficiently enumerated or modeled before attackers discover new ones.
• That victim feedback remains available and interpretable enough to guide evaluation without granting attackers operational advantage.
• That organizations can afford the escalating test-time compute required to evaluate systems at realistic attacker budgets.
• That defenses can preserve a meaningful distinction between trusted instructions and hostile environmental content once agents act across heterogeneous tools and data sources.
• That attack success can be treated primarily as a technical property rather than as a governance, liability, and deployment constraint.
• That increased security spending will scale faster than the number and complexity of agentic systems being deployed.
• That institutions can coordinate against insecure deployment at scale. P2 says they cannot reliably preserve human-only control domains once competitive pressure rewards greater autonomy.

Social Function

Classification: partial truth and transition management, with a layer of prestige signaling.

The paper provides a useful technical vocabulary for an unavoidable transition: agentic systems will be attacked adaptively, and static benchmark scores will understate the danger. Its search-harness framing is valuable because it exposes compute budget as a hidden variable.

Its social function is less radical. By converting a civilizational control problem into an evaluation protocol, it makes the problem legible to researchers and funders without forcing a conclusion about deployment limits, ownership, or institutional collapse. The breach becomes another benchmark to optimize. The industry can therefore continue scaling the systems that create the attack surface while presenting improved measurement as evidence of responsible control.

The Verdict

This is a technically credible autopsy of why indirect prompt injection is harder than static red-team testing suggests. It is not a solution to the underlying trajectory.

The paper reveals a compounding loop: more capable agents create larger attack surfaces; larger surfaces reward more attacker search; more attacker search forces more defensive compute; and competitive deployment keeps expanding the system regardless. Security evaluation becomes a permanent tax on automation, not a barrier to it.

In DT terms, the paper strengthens P1 and exposes the instability of P2. It does not stop the transition toward P3, where human labor loses economic necessity. It merely maps one of the parasite ecologies that will grow around the automated cognitive infrastructure. The likely winners are Sovereigns controlling compute, model access, telemetry, and defensive infrastructure, plus Servitors indispensable to verification, incident response, and high-consequence system maintenance. Everyone else is exposed to systems whose cognition is scalable and whose trust boundary is porous by construction.