A comprehensive research landscape of AI agent security and prompt injection defense. This field has accelerated rapidly — most significant work has landed in the last 18 months, with a burst of papers in 2025-2026. This document catalogs the threat landscape, the six key defensive architectures, the benchmarks, and the open research gaps.
The Agent Security Bench (ASB), presented at ICLR 2025, tested 16 attack types against 11 defenses across 10 scenarios with 400+ tools and 13 LLM backbones. The result: an 84.3% average attack success rate. Current defenses fail 4 out of 5 times.
OWASP has designated prompt injection as LLM01:2025 — their top LLM security risk. This is not a theoretical concern. It is the single most critical security problem facing AI agent deployment today.
A growing ecosystem of offensive tools targets AI agents at the infrastructure level. These are not prompt injection attacks — they are resource-exhaustion and trap attacks designed to waste agent compute, poison training data, or trap crawlers permanently.
Creates infinite mazes of static files with no exit links. Traps the AI crawler permanently in a generated labyrinth of pages.
Reverse proxy using Markov chains to generate infinite gibberish. Deliberately poisons training data by feeding meaningless content to crawlers.
Enterprise-grade version. Embeds hidden honeypot links in pages. Bots follow them into AI-generated but irrelevant pages, wasting compute. Also fingerprints the bot for a global blocklist. This is the tool getting the most mainstream adoption.
Another variant in the same family of crawler traps. Same resource-exhaustion approach with different implementation.
Key insight: These are all infrastructure-level attacks. The AI agent never gets to run its reasoning or self-diagnostic because it is stuck in an infinite loop. No AI-level defense can help when the agent cannot think. The remedy must be external to the agent — a supervisor process with watchdog timers, action-sequence loop detection, and resource budgets.
Six key approaches to prompt injection defense, in order of maturity:
The foundational architectural defense. Two models with different privilege levels:
The quarantined model can read poisoned pages all day — it cannot DO anything with what it learns. The privileged model never sees raw external content, only the quarantined model's analysis of it.
The formalization and evolution of the dual-LLM pattern. Key insight: stop trying to make the model impossible to trick, make the architecture secure instead.
CaMeL adds capability-based security on top of the dual-LLM split:
This is the strongest published defense. Google released the code.
GitHub: github.com/google-research/camel-prompt-injection | Paper: arxiv.org/abs/2503.18813
Input transformation techniques to mark untrusted content so the model can distinguish instructions from data:
Results: Reduced attack success rate from >50% to <2% on GPT-family models with minimal task impact.
Simplest defense to implement — it is a prompt-engineering layer, not an architectural change. But also the most bypassable: sophisticated injections can use encoding tricks to escape the markers.
Paper: arxiv.org/abs/2403.14720
Models multi-turn indirect prompt injection as a temporal causal takeover — the injection does not just corrupt content, it hijacks the agent's action trajectory over multiple turns.
The counterfactual re-execution is the key innovation — it does not just check "am I confused?" but "was my decision causally driven by untrusted input?"
Paper: arxiv.org/abs/2602.22724
An adaptive immune system for LLM agents. The first approach to recognize that defense should be learned over time rather than applied as a fixed policy.
Results: Cold-start achieves 81.1% success vs 36.6% for the strongest baseline. After 80 encounters, cumulative attack success rate drops from 35% to 6.1%, using only 2.44 antibodies on average. 89.9% of encounters reuse existing antibodies — compact transfer, not case accumulation.
Paper: arxiv.org/html/2608.04053
Uses causal attribution of tool invocations — checks not just inputs but the actual cause of each tool call. If a tool call was causally driven by untrusted content rather than user intent, it is flagged as injection.
Three major benchmarks exist for testing defensive approaches against prompt injection:
The standard benchmark for indirect prompt injection (IPI) defenses. Used by both AgentSentry and CaMeL for evaluation. Tests agents across multiple task scenarios with injected malicious instructions in tool outputs.
Benchmarking indirect prompt injection in tool-integrated agents. Focuses specifically on how injections propagate through tool-use chains and how different agent architectures handle the contamination.
The most comprehensive benchmark: 16 attack types x 11 defenses x 10 scenarios with 400+ tools and 13 LLM backbones. Result: 84.3% average attack success rate across all defenses tested.
GitHub: github.com/agiresearch/ASB
Two GitHub repositories track this rapidly evolving field:
The consensus is forming around layered defense. No single approach is sufficient:
The infinite loop / crawler-trap problem has no published agent-side defense. The AI-level defenses (AgentSentry, AgentAntibody) are advancing fast but all assume the agent can still think. When the agent is trapped in an infinite loop of generated pages, it cannot run self-diagnostics, cannot check its trajectory, cannot call for help.
The defenses that exist are all offensive tools (Nepenthes, Iocaine, AI Labyrinth) — there is no published defensive remedy for the agent side. The remedy must be external to the agent: a supervisor process with watchdog timers, action-sequence loop detection, and hard resource budgets. This is unexplored territory and the most obvious gap for novel contribution.