paperMay 2026Unreviewed

From Prompt Injection to Persistent Control: Defending Agentic Harness Against Trojan Backdoors

Jiejun Tan, Zhicheng Dou, Xinyu Yang, Yuyang Hu, Yiruo Cheng, Xiaoxi Li, Ji-Rong Wen

Abstract

LLM agents are evolving from conversational chatbots to operational tools in real-world workspaces. In local agentic harnesses, an LLM can read and write files, call tools, and reuse workspace state across sessions. While such capabilities enhance utility, they also expose a new attack surface for attackers. Attackers can embed a prompt injection within a file or tool output. Agents may read this hidden instruction, store it, and execute it later. In this multi-step trojan attack paradigm, no in

Framework mappings

OWASP Top 10 for LLM Applications

LLM01Prompt Injection
LLM04Data and Model Poisoning

MITRE ATLAS

AML.T0020Poison Training Data
AML.T0051LLM Prompt Injection

Suggested from the entry's categories.

Cite

@misc{tan2026from,
  title = {{From Prompt Injection to Persistent Control: Defending Agentic Harness Against Trojan Backdoors}},
  author = {Jiejun Tan and Zhicheng Dou and Xinyu Yang and Yuyang Hu and Yiruo Cheng and Xiaoxi Li and Ji-Rong Wen},
  year = {2026},
  month = may,
  eprint = {2605.31042},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.31042}
}