@inproceedings{wang-etal-2025-agentvigil,
    title = "{AGENTVIGIL}: Automatic Black-Box Red-teaming for Indirect Prompt Injection against {LLM} Agents",
    author = "Wang, Zhun  and
      Siu, Vincent  and
      Ye, Zhe  and
      Shi, Tianneng  and
      Nie, Yuzhou  and
      Zhao, Xuandong  and
      Wang, Chenguang  and
      Guo, Wenbo  and
      Song, Dawn",
    editor = "Christodoulopoulos, Christos  and
      Chakraborty, Tanmoy  and
      Rose, Carolyn  and
      Peng, Violet",
    booktitle = "Findings of the Association for Computational Linguistics: EMNLP 2025",
    month = nov,
    year = "2025",
    address = "Suzhou, China",
    publisher = "Association for Computational Linguistics",
    url = "https://preview.aclanthology.org/name-variant-enfa-fane/2025.findings-emnlp.1258/",
    doi = "10.18653/v1/2025.findings-emnlp.1258",
    pages = "23159--23172",
    ISBN = "979-8-89176-335-7",
    abstract = "There emerges a critical security risk of LLM agents: indirect prompt injection, a sophisticated attack vector that compromises thecore of these agents, the LLM, by manipulating contextual information rather than direct user prompts. In this work, we propose a generic black-box optimization framework, AGENTVIGIL, designed to automatically discover and exploit indirect prompt injection vulnerabilities across diverse LLM agents. Our approach starts by constructing a high-quality initial seed corpus, then employs a seed selectionalgorithm based on Monte Carlo Tree Search (MCTS) to iteratively refine inputs, therebymaximizing the likelihood of uncovering agent weaknesses. We evaluate AGENTVIGIL on twopublic benchmarks, AgentDojo and VWA-adv, where it achieves 71{\%} and 70{\%} success rates against agents based on o3-mini and GPT-4o, respectively, nearly doubling the performance of handcrafted baseline attacks. Moreover, AGENTVIGIL exhibits strong transferability across unseen tasks and internal LLMs, as well as promising results against defenses. Beyondbenchmark evaluations, we apply our attacks in real-world environments, successfully misleading agents to navigate to arbitrary URLs,including malicious sites."
}