Prompt injection doesn't care what your agent does for a living
7/31/2026
This post introduces the concept of analyzing prompt injection attacks through large-scale adversarial competitions. It details the methodology of pitting attacker and defender agents against each other across various scenarios, with a focus on identifying transferable rhetorical shapes of attacks. The post quantifies the prevalence of these transferable attacks (46%) and short, conversational attacks (15%). It also highlights the sensitivity of defender performance to minor attack variations (9% of winning attacks have near-identical failing twins). Recommendations are made to organize risk assessment around transferable mechanisms and to stress test by varying rhetoric. The post also discusses the implications for frontier models, noting that attacker identity and rhetorical clusters remain dominant factors, and indirect injection is common. Practical hardening advice includes separating trusted instructions from untrusted input and gating actions behind explicit confirmation.