Prompt injection doesn't care what your agent does for a living

This post details the findings from the AgentBeats Security Arena, a prompt-injection competition. It identifies four key rhetorical shapes (46% of winning attacks) that transfer across different agent domains (e.g., expense approval, supply chain). It also highlights that short, conversational attacks (15% of wins) are effective and difficult to block by surface features. The analysis reveals that scenario volume is not a reliable measure of coverage, as different attack mechanisms can exist within a single scenario. Furthermore, wins and fails are often separated by a single word or minor formatting change, emphasizing the need to benchmark near-misses. The post advocates for organizing risk assessment around transferable mechanisms rather than just domain coverage and suggests separating trusted instructions from untrusted input, gating consequential actions behind explicit confirmation.