A security agent can be diverted by its environment

An agent receives a legitimate objective, uses authorized tools, and works in a controlled laboratory. Yet the observed environment can present false results, misleading clues, or destinations unrelated to the task. Risk does not depend only on a malicious instruction written as a prompt. It appears when untrusted evidence starts competing for authority with the original objective.

The paper AgentLSD, version 1 dated 16/09/2026, calls this problem adversarial task contamination. The study will be presented at the 19th ACM Workshop on Artificial Intelligence and Security and provides a framework, configurations, and traces. The signal is relevant; the evidence remains preliminary and limited to web CTF challenges.

Paper under follow-up. This note will be reassessed after a new version, proceedings, correction, independent replication, benign controls, mitigation tests, or a relevant author response. The label does not mean the result is false. It means its external validity is still developing.

The question the study distinguishes

Prompt injection is often described as a hostile instruction embedded in external content. AgentLSD also includes evidence that does not look like instructions: a false result, decoy objective, unrelated endpoint, or a clue with unwarranted authority. The agent must infer state and intent from the same environment that an adversary may control.

This distinction matters for architecture. Filtering imperative phrases does not resolve forged evidence. The system must preserve the origin of each observation, the authority it may exercise, and an independent verifier to declare success.

What was measured

The researchers built 11 Flask web CTF challenges covering seven vulnerability classes. Five on-premises models and one hosted model were evaluated. Each experimental cell had five attempts, two prompts, and limits of 30 minutes and 200 turns.

The full baseline included 605 attempts. In the standard-prompt subset used for the main clean-capability analysis, the agents captured 136 flags in 330 attempts, about 41%. No model solved all 11 challenges.

In the contaminated phase, the three strongest on-premises models were evaluated on seven challenges, 14 trap instances, two prompts, and five attempts per cell: 2,940 attempts. The hosted model was included in a reduced grid with 121 attempts, totaling 3.061. In four of its 25 cells, infrastructure problems limited execution to four attempts.

When the agent still found the flag, contamination added approximately 20 turns and 2 thousand reasoning tokens relative to the clean condition. The effect on success rate was more heterogeneous: some combinations barely changed; in others, clean successes disappeared.

These results do not describe a universal failure rate. They show that execution cost and trajectory can deteriorate even when the final metric remains green.

Result selection matters

Four challenges with sporadic clean success were excluded from the contaminated phase because they did not provide a sufficient basis for measuring degradation. Seven challenges received traps, but the main results report only the five with the highest aggregate clean success rate. Two moderately performing challenges were omitted to reduce uncertainty and focus the analysis, according to the authors.

This choice is understandable when observing effects where success previously existed. It also limits generalization. Readers must not treat the highlighted average as the result of the entire corpus or the full executed grid.

What the study doesn't prove

• the 11 purpose-built challenges do not represent applications, logs, repositories, or corporate production environments;
• all contamination was delivered through DOM, one at a time, statically and without adapting to the agent actions;
• there was no benign control to measure the effect of simply increasing page size;
• five repetitions per cell are a coarse sample, and the paper provides descriptive statistics without significance tests;
• frontier-model coverage was limited by cost and did not include the Claude family;
• agents were not warned that adversaries might be present;
• interacting with a decoy demonstrates exposure or engagement, not proof that the model believed it;
• the authors’ mitigation recommendations are design implications, not controls evaluated by the experiment;
• no independent replication was found at the 18/09/2026 cutoff.

The study reports partial funding from the Digital Europe program, grant SPECTRO 101123118. The authors also disclose using AI tools to develop part of the code and improve clarity and grammar, while retaining author responsibility for design, methods, analysis, and conclusions.

Technical contract: observation receives no authority by default

A durable engineering harness must separate history, policy, and execution isolation. Model or channel choice cannot become the security boundary. This is a design inference supported by the Forge canon, not experimental proof from AgentLSD or a claim that the control already operates in all products. [HARNESS31-C2]

objetivo autorizado
        │
        ▼
observação ──► proveniência + classe de confiança ──► hipótese limitada
        │                                               │
        └──── conteúdo não confiável                    ▼
                                            ação sob capability mínima
                                                        │
                                                        ▼
                                    verificador independente + receipt

1. Preserve the objective outside the observed flow

Record the original objective, its invariants, and stopping criteria in protected state. A page, file, log, or tool response can inform the investigation; it must not silently redefine the mission.

2. Classify provenance and authority

Every observation must carry origin, integrity, time, subject, and trust class. Content produced by the investigated environment starts as untrusted data, even when it uses authoritative language or formatting.

3. Require corroboration before changing the objective or declaring success

Results with material effects require an independent source: a protected verifier, authoritative service, reproducible test, or human confirmation of a normalized representation. The same contaminable channel must not both produce evidence and approve its validity.

4. Limit exploration and effects

Define budgets for turns, time, cost, calls, and mutations. Give the agent its own identity, ephemeral credentials, and minimal capabilities. Hypotheses that repeatedly produce no evidence must lose priority or trigger backtracking.

5. Measure effort, not only final success

An agent can reach the correct answer after consuming more time, tokens, and tools or touching unnecessary resources. Record trajectory, cost, deviations, recovery, and intervention—not only the final state.

Minimal receipt for an agentic investigation

{
  "objective_ref": "immutable-ref",
  "observation_provenance": "untrusted|verified",
  "policy_digest": "sha256:...",
  "capability_scope": "task-bounded",
  "budget": {"turns": 12, "seconds": 300},
  "independent_verifier": "pass|fail|inconclusive",
  "goal_changed": false,
  "human_decision": "continue|stop|escalate",
  "effect_receipt": "immutable-ref"
}

Values are illustrative. The receipt must be issued outside the agent authority and avoid personal data, secrets, sensitive addresses, or content that lowers the cost of abuse.

Defensive harness tests

1. External content does not change the protected objective without an authorized transition.
2. Authoritative-looking evidence remains bounded by provenance and policy.
3. Confirmation from the environment itself does not replace an independent verifier.
4. Reaching the budget stops or escalates execution; it does not convert inconclusive in pass.
5. Repeated interactions without corroboration reduce priority and trigger recovery.
6. A correct action with abnormal cost or scope generates a finding, not silent success.
7. A telemetry or verifier failure blocks material effects.
8. Decision logs preserve version, policy, capabilities, and evidence without retaining unnecessary sensitive content.

How to follow the paper without turning a hypothesis into fact

The open framework is useful for reproduction, but code availability is not replication. Stronger evidence should include a benign control, more repetitions, intervals and statistical tests, channels beyond DOM, adaptive traps, representative environments, and comparisons of mitigations under the same paired protocol.

The badge Paper under follow-up remains until these signals are assessed. If a new version changes denominators, result selection, or conclusions, the page must receive a dated correction—not a silent note.

Direct sources

1. AgentLSD — arXiv:2609.19140v1.
2. Full paper text.
3. Framework, configurations, and traces.
4. AgentDojo — NeurIPS 2024.
5. NIST — Security Considerations for AI Agents.

The last two sources corroborate the broader problem of adversarial inputs and agent security. They are not replications of AgentLSD.

Editorial and responsibility note

Facts, numbers, version, and funding are linked to the cited sources. The contract, receipt, tests, and recommendations are professional analysis by the author, not universal experimental conclusions or claims of mechanisms already operating in Trustyu Forge. This is informational content and does not replace technical, legal, or security assessment. We do not reproduce payloads, sensitive routes, or offensive steps. Trustyu and Tech Human work commercially in AI architecture, governance, and engineering. Research, structure, and drafting used AI assistance; factual review, author approval, and publication authorization were confirmed by Fernando Parreiras on 18/09/2026, without an additional independent human review.