Prompt injection attacks fail 87-97% in real multi-skill agent deployments
Source published ·Modelwire updated
Original coverage: arXiv cs.LG ↗·How Modelwire adds context
The development
Researchers have exposed a critical gap in how AI agent security is evaluated. Prior work on prompt injection attacks against modular skill systems assumed the malicious skill was already selected for execution, but real deployments force skills to compete for retrieval first. This filtering mechanism reduces attack success rates by 87-97%, rendering existing threat models unrealistic. The team introduces CORSA, a new attack methodology that optimizes injections across both retrieval and execution phases, accounting for router behavior and task clustering. This work reshapes the threat landscape for production agent systems and forces a reckoning with how security research validates defenses in multi-skill environments.
Modelwire’s AI-generated summary of coverage from arXiv cs.LG.
Modelwire analysis
ExplainerOur AI-generated reading of the wider context and the next developments to watch.
The critical insight isn't that prompt injection works (it does), but that security research has been testing attacks in an unrealistic environment. By assuming the malicious skill is already selected, prior work bypassed the retrieval filtering that actually protects production systems. CORSA accounts for this real-world constraint.
This directly extends the evaluation critique from the Modelwire coverage two days ago on prompt-injection detectors. That story showed detectors fail to generalize across benchmarks; this one reveals the entire threat model for multi-skill systems has been misspecified. Together they expose a pattern: agent security research is validating defenses against scenarios that don't match deployment reality. The router filtering reducing attack success by 87-97% mirrors the earlier finding that detector performance collapses when moved from one benchmark to another, suggesting both papers are documenting the same underlying problem: labs are measuring robustness in isolation rather than end-to-end.
If CORSA's optimized injections achieve >50% success rates on real deployed agent routers (not lab simulations), that confirms the threat model gap is genuine and production systems are underdefended. If major agent frameworks (Google Skills, OpenAI's agent APIs) adopt router-aware security testing within the next six months, that signals the research has shifted industry practice.
This interpretation is generated from the summary above and the archive coverage cited below. Our methodology · Report an error
Coverage behind this analysis
These archive entries ground the connection in our analysis. They are ordered by source publication date, with links to our coverage and the original sources.
·arXiv cs.CL
Prompt-injection detectors fail to transfer between agent benchmarks
A new evaluation reveals that prompt-injection detectors widely used in LLM agent deployments fail to generalize across benchmarks, undermining the reliability of current selection methods. Researchers replayed tool calls from AgentDojo and tau-bench to construct ground-truth benign outputs, then tested fifteen detectors including Meta's Prompt Guard 2 against these realistic scenarios. The findings expose a…
MentionsCORSA · AI agents · skill routers · prompt injection
How this coverage is produced
Modelwire uses AI to generate summaries and context from source headlines, snippets, and selected archive coverage. Automated checks do not verify every claim, and items are not routinely reviewed by a person before publication. Zacaria Solis operates the site. Read the linked source for the full evidence and report errors through our corrections process.
Modelwire summarizes, we don’t republish. arXiv cs.LG originally reported this story as “Surviving the Router: Optimizing Skill Injections for Retrieval and Execution”. The full content lives on arxiv.org. If you’re a publisher and want a different summarization policy for your work, see our takedown page.