Context as the Attack Surface: A New Class of Agent Compromise
A new academic paper shows AI agents can be compromised without a single malicious instruction, just by corrupting what the agent trusts. Here's how the attack works, why most current defenses miss it, and where security teams should focus instead.
A new academic paper describes a way to compromise an AI agent that never touches a malicious instruction. This matters because it validates something the industry has been slow to accept: the point of vulnerability in an agent is the context it trusts. The instruction in this attack stays exactly the same throughout. Only what surrounds it changes what the agent believes is true, and from there, what it decides to do.
Three things stood out from my read:
- No malicious instruction is needed. The attack corrupts what the agent trusts, not what it is told. Defenses designed to catch bad instructions will not see it, which means the detection model needs to expand.
- The defenses most teams already have do not catch it. Content filters, sandboxing, even a human approving the action: the paper tested them against real, named systems and measured the results.
- The one approach that fully stops it cuts how useful the agent stays by more than half. That is the trade-off the industry is now facing, and it should change how security teams think about where to place their controls.
How the attack works
When an agent reads a piece of content, an email, a comment, a file, it sometimes has to guess where one piece of information ends and another begins. An attacker can plant a single stray character that makes the agent misread that structure, so it believes it is looking at data from a different, trusted source than it is.
One example from the paper: a single extra character hidden inside an email body was enough to make the model believe the email came from someone else entirely, someone it would trust. The tool handling the email never changed anything about the actual message. Only the model’s belief about it changed.
The researchers demonstrated this against real production coding and browser agents. Claude Code, Codex, and Gemini CLI were tricked into running shell commands they believed a repository maintainer had approved. Coding agents merged pull requests without the model ever reviewing the real code change. A browser agent clicked a different button than the one its user asked for. None of this needed a new capability the agent had to acquire, and none of it needed a person to fall for a phishing email. It lives in how these agents already read everyday data.
Why current defenses miss it
The paper tested this against real, named systems, including Meta’s LlamaFirewall and research approaches like Progent and CaMeL. The results follow a pattern that is worth understanding, because it shows up across almost every defense category.
Most prompt injection defenses are built to catch malicious instructions hidden in content. This attack does not contain one, so those tools have nothing to scan for. Sandboxing the agent’s actions gets closer, because it constrains what the agent can do regardless of why it is doing it. But writing a policy tight enough to catch everything proved hard in testing, and more than one in five attacks still got through the best sandboxing setup the researchers evaluated.
The defenses that performed worst relied on LLM-based classification, which introduces a structural problem: the detection mechanism is subject to the same interpretive uncertainty as the agent it is trying to protect. A non-deterministic judge trying to catch a non-deterministic failure is fragile by design.
The one approach that fully stopped the attack tracked trust at the level of the data itself, verifying where each piece of content came from before letting the agent act on it. It worked. It also cut the agent’s usefulness by more than half, because it treated anything connected to a flagged piece of data as suspect. That is the trade-off the paper surfaces most clearly: the only complete defense the researchers found comes at a cost most production environments would struggle to accept.
Human approval fares no better, for a simpler reason. The approval screen confirms that an action is about to happen, but rarely shows which specific element or target the agent picked. Until approval interfaces surface that level of detail, a manual confirmation step does not add meaningful protection against this class of attack.
Where to focus instead
We have argued before that prompt injection is not the main problem in agent security: the real risk is context drift as an agent moves through a workflow. This paper is close to the clearest proof of that argument yet.
The paper also shows why data provenance checks alone are not a sufficient answer. The defense that tracked provenance at the data level fully stopped the attack, but it cut the agent’s usefulness by more than half. For most production environments, that trade-off is not viable. What the paper does not test, and what we believe is the more operationally durable approach, is contextual governance: understanding how an agent’s context changes across a sequence of actions, and intervening at the points where corrupted context would lead to a harmful outcome, rather than trying to verify every piece of data before the agent touches it.
Agents are systems, not surfaces. Their configuration, context, tools, and behavior span multiple boundaries. An attack that corrupts what an agent trusts at the data level operates at the same layer where the agent’s own context and memory live.
A governance approach that reads that context continuously, baselines what normal looks like for a given agent, and shapes behavior through deterministic interventions can catch the moment an agent begins acting on corrupted context, without requiring the kind of blanket data quarantine that degrades usefulness. The implementation mechanism for this is lifecycle hooks: attached directly to the agent’s execution path to observe and intervene through its own configuration, rather than inspecting traffic from outside. Hooks are the delivery mechanism; the value is in what they enable, which is context-aware, inline governance that preserves operational efficiency.
Any vendor claiming a fix for this class of attack should be measured against the paper’s own published benchmarks. The researcher behind the paper has said OpenAI, Google, and Anthropic have not indicated a fix is shipped or even planned, so early claims are worth pressure-testing.
Read more on why prompt injection alone does not cover agentic risk, or talk to our team to see how your agent estate holds up against attacks like this one.
