Skip to main content
LLM Security Database
Skip to research details
Back to research findings

Prompt injection across agent privilege boundaries

Untrusted issue descriptions and tool responses can redirect privileged coding and tool agents. Twin Agent separates exploration from execution and restricts the information exchanged between them.

Published
Analyzed
Paper-reported evidence
Primary source linked
Read primary paper
Cite & share
Source BibTeX

Citation metadata is maintained by the primary source and may reflect a later revision.

Paper-evaluated models(3)

  • GPT-5.2
  • Gemini 2.5 Flash
  • Gemini 3.5 Flash
On this page

Description

Untrusted issue descriptions and tool responses can redirect privileged coding and tool agents. Twin Agent separates exploration from execution and restricts the information exchanged between them.

Examples

See the primary evaluation (opens in a new tab); this entry omits attack payloads.

Impact

The authors report GPT-5.2 attack success falling from 97.0% to 0.0% on static SWE-bench-injected cases, with utility increasing from 61.2% to 62.5%. Adaptive evaluation still succeeds in 11/232 cases (4.7%). These benchmark results provide no formal guarantee.

Affected Systems

  • SWE-agent, AgentDojo and DecodingTrust-Agent configurations evaluated in the paper.

Mitigation Steps

  • Separate untrusted-content processing from privileged execution.
  • Bound and screen messages crossing that boundary.
  • Check consequential actions against trusted intent; evaluate adaptive attacks and benign utility together.

Evidence

Research context and provenance

Research topics
Application layer
Prompt layer
Injection
AI agents
Coding agents
Chains & workflows
Integrity
Safety
Catalog identifier
LMVD-f0174a73
Internal research identifier, not an official CVE identifier.
Evidence and verification
Paper-reported; independent reproduction is not documented.
Primary source plus a dedicated evidence section.
Severity
Not rated by this catalog.
Source and publication type
arXiv · Research preprint.
Peer-review status is not provided by this source.
Author and publication status
Author metadata is not stored; see the primary paper.
Threat model and attacker access
Ability to influence untrusted model inputs or connected content.
Related deployment categories
Agent workflows; Coding agents
Taxonomy labels only; paper-specific deployment prerequisites are not inferred.
Affected systems
SWE-agent, AgentDojo and DecodingTrust-Agent configurations evaluated in the paper.

Research Paper

Twin Agent: Context Residual Compression for Privilege Separated Agents

Primary source: arXiv. Findings are reported by the cited research and have not been independently verified.

View Paper

Related research