QueryIPI: Query-agnostic Indirect Prompt Injection on Coding Agents
Fuente:
arXiv
Salvato in:
| Autori principali: | , , , , , , , , , |
|---|---|
| Natura: | Preprint |
| Pubblicazione: |
2025
|
| Soggetti: | |
| Accesso online: | |
| Tags: |
Aggiungi Tag
Nessun Tag, puoi essere il primo ad aggiungerne!!
|
| _version_ | 1866918287960440832 |
|---|---|
| author | Xie, Yuchong Liu, Zesen Luo, Mingyu Zhang, Zhixiang Zhang, Kaikai Yuan, Yuanyuan Li, Zongjie Chen, Ping Wang, Shuai She, Dongdong |
| author_facet | Xie, Yuchong Liu, Zesen Luo, Mingyu Zhang, Zhixiang Zhang, Kaikai Yuan, Yuanyuan Li, Zongjie Chen, Ping Wang, Shuai She, Dongdong |
| contents | Modern coding agents integrated into IDEs orchestrate powerful tools and high-privilege system access, creating a high-stakes attack surface. Prior work on Indirect Prompt Injection (IPI) is mainly query-specific, requiring particular user queries as triggers and leading to poor generalizability. We propose query-agnostic IPI, a new attack paradigm that reliably executes malicious payloads under arbitrary user queries. Our key insight is that malicious payloads should leverage the invariant prompt context (i.e., system prompt and tool descriptions) rather than variant user queries. We present QueryIPI, an automated framework that uses tool descriptions as optimizable payloads and refines them via iterative, prompt-based blackbox optimization. QueryIPI leverages system invariants for initial seed generation aligned with agent conventions, and iterative reflection to resolve instruction-following failures and safety refusals. Experiments on five simulated agents show that QueryIPI achieves up to 87% success rate, outperforming the best baseline (50%). Crucially, generated malicious descriptions transfer to real-world coding agents, highlighting a practical security risk. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2510_23675 |
| institution | arXiv |
| publishDate | 2025 |
| record_format | arxiv |
| spellingShingle | QueryIPI: Query-agnostic Indirect Prompt Injection on Coding Agents Xie, Yuchong Liu, Zesen Luo, Mingyu Zhang, Zhixiang Zhang, Kaikai Yuan, Yuanyuan Li, Zongjie Chen, Ping Wang, Shuai She, Dongdong Cryptography and Security Artificial Intelligence Modern coding agents integrated into IDEs orchestrate powerful tools and high-privilege system access, creating a high-stakes attack surface. Prior work on Indirect Prompt Injection (IPI) is mainly query-specific, requiring particular user queries as triggers and leading to poor generalizability. We propose query-agnostic IPI, a new attack paradigm that reliably executes malicious payloads under arbitrary user queries. Our key insight is that malicious payloads should leverage the invariant prompt context (i.e., system prompt and tool descriptions) rather than variant user queries. We present QueryIPI, an automated framework that uses tool descriptions as optimizable payloads and refines them via iterative, prompt-based blackbox optimization. QueryIPI leverages system invariants for initial seed generation aligned with agent conventions, and iterative reflection to resolve instruction-following failures and safety refusals. Experiments on five simulated agents show that QueryIPI achieves up to 87% success rate, outperforming the best baseline (50%). Crucially, generated malicious descriptions transfer to real-world coding agents, highlighting a practical security risk. |
| title | QueryIPI: Query-agnostic Indirect Prompt Injection on Coding Agents |
| topic | Cryptography and Security Artificial Intelligence |
| url | https://arxiv.org/abs/2510.23675 |