Depth-Dependent Indirect Prompt Injection in Tool-Calling ReAct Agents: Injection Depth, Payload Framing, and Turn-Budget Sensitivity

Abstract

ReAct agents that interleave chain-of-thought reasoning with tool calls are increasingly deployed for real tasks such as scheduling, file retrieval, and data access. Their tool observation loop creates a direct attack surface: an adversary who controls any tool's return value can embed instructions that redirect the agent away from the user's goal, a threat known as indirect prompt injection. Existing benchmarks evaluate attack success rate (ASR) at a fixed injection position under fixed conditi

Categories

Framework mappings

Suggested from the entry's categories.

@misc{rashidi2026depthdependent,
  title = {{Depth-Dependent Indirect Prompt Injection in Tool-Calling ReAct Agents: Injection Depth, Payload Framing, and Turn-Budget Sensitivity}},
  author = {Mohammadreza Rashidi},
  year = {2026},
  month = may,
  eprint = {2605.30686},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.30686}
}