The Surface You Test Is Not the Surface That Breaks

Abstract

Tool-augmented LLM agents are vulnerable to prompt injection: a third party who controls part of the agent's context can plant instructions that the agent then executes as if they came from the user. Current evaluations report a single attack success rate per model on one channel, the tool output and treat that number as the model's vulnerability. But tool descriptions, which the agent reads at every turn before any tool is called, are themselves an injection surface that the attacker can choose

Categories

Framework mappings

Suggested from the entry's categories.

@misc{arman2026surface,
  title = {{The Surface You Test Is Not the Surface That Breaks}},
  author = {Shifat E Arman and Syed Nazmus Sakib and Nafiul Haque and Shahrear Bin Amin},
  year = {2026},
  month = may,
  eprint = {2605.30454},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.30454}
}