AI Agent Security: Prompt Injection Defense Landscape

A comprehensive research landscape of AI agent security and prompt injection defense. This field has accelerated rapidly — most significant work has landed in the last 18 months, with a burst of papers in 2025-2026. This document catalogs the threat landscape, the six key defensive architectures, the benchmarks, and the open research gaps.

The Scale of the Problem

The Agent Security Bench (ASB), presented at ICLR 2025, tested 16 attack types against 11 defenses across 10 scenarios with 400+ tools and 13 LLM backbones. The result: an 84.3% average attack success rate. Current defenses fail 4 out of 5 times.

OWASP has designated prompt injection as LLM01:2025 — their top LLM security risk. This is not a theoretical concern. It is the single most critical security problem facing AI agent deployment today.

84.3% Average attack success rate across all tested defenses (ASB, ICLR 2025)

Reference

The Threat Landscape: Offensive Tools

A growing ecosystem of offensive tools targets AI agents at the infrastructure level. These are not prompt injection attacks — they are resource-exhaustion and trap attacks designed to waste agent compute, poison training data, or trap crawlers permanently.

Nepenthes

Creates infinite mazes of static files with no exit links. Traps the AI crawler permanently in a generated labyrinth of pages.

Iocaine

Reverse proxy using Markov chains to generate infinite gibberish. Deliberately poisons training data by feeding meaningless content to crawlers.

Cloudflare AI Labyrinth (March 2025)

Enterprise-grade version. Embeds hidden honeypot links in pages. Bots follow them into AI-generated but irrelevant pages, wasting compute. Also fingerprints the bot for a global blocklist. This is the tool getting the most mainstream adoption.

Miasma

Another variant in the same family of crawler traps. Same resource-exhaustion approach with different implementation.

Key insight: These are all infrastructure-level attacks. The AI agent never gets to run its reasoning or self-diagnostic because it is stuck in an infinite loop. No AI-level defense can help when the agent cannot think. The remedy must be external to the agent — a supervisor process with watchdog timers, action-sequence loop detection, and resource budgets.

The Six Defensive Architectures

Six key approaches to prompt injection defense, in order of maturity:

1. Dual-LLM Pattern (Simon Willison, April 2023)

Source: simonwillison.net/2023/Apr/25/dual-llm-pattern

The foundational architectural defense. Two models with different privilege levels:

  • Privileged LLM (P-LLM): Has tool access, plans actions, uses only trusted instructions from the user
  • Quarantined LLM (Q-LLM): Processes untrusted external content but has NO tool access

The quarantined model can read poisoned pages all day — it cannot DO anything with what it learns. The privileged model never sees raw external content, only the quarantined model's analysis of it.

2. CaMeL — Capability Machine for LLMs (Google DeepMind, March 2025)

Paper: "Defeating Prompt Injections by Design" (arXiv:2503.18813)

The formalization and evolution of the dual-LLM pattern. Key insight: stop trying to make the model impossible to trick, make the architecture secure instead.

CaMeL adds capability-based security on top of the dual-LLM split:

  • The P-LLM converts the user's request into a sequence of steps described as code
  • A custom interpreter executes those steps with explicit capability checks
  • Every piece of data carries provenance labels (trusted vs untrusted)
  • Untrusted data from tool outputs gets a security label that restricts what it can influence
  • Even if the model is fully compromised by injection, the capability system prevents it from taking actions beyond what the original task authorized

This is the strongest published defense. Google released the code.

GitHub: github.com/google-research/camel-prompt-injection | Paper: arxiv.org/abs/2503.18813

3. Spotlighting (Hines et al., March 2024)

Paper: "Defending Against Indirect Prompt Injection Attacks With Spotlighting" (arXiv:2403.14720)

Input transformation techniques to mark untrusted content so the model can distinguish instructions from data:

  • Delimiting: Wrap external content in clear boundary markers
  • Data marking: Add provenance tags to every piece of external content
  • Encoding: Transform external content (e.g., base64) so it is visually distinct from instructions

Results: Reduced attack success rate from >50% to <2% on GPT-family models with minimal task impact.

Simplest defense to implement — it is a prompt-engineering layer, not an architectural change. But also the most bypassable: sophisticated injections can use encoding tricks to escape the markers.

Paper: arxiv.org/abs/2403.14720

4. AgentSentry (Zhang et al., February 2026)

Paper: "AgentSentry: Mitigating Indirect Prompt Injection in LLM Agents via Temporal Causal Diagnostics and Context Purification" (arXiv:2602.22724)

Models multi-turn indirect prompt injection as a temporal causal takeover — the injection does not just corrupt content, it hijacks the agent's action trajectory over multiple turns.

  • Detects takeover points via controlled counterfactual re-executions at tool-return boundaries. Essentially: "What would the agent have done if this tool output were different?" If the answer diverges significantly, that tool output contains an injection.
  • Context purification: Instead of blocking the whole task, it removes the attack-induced deviations while preserving legitimate task evidence. The agent continues with clean context.
  • Evaluated on AgentDojo benchmark: 74.55% Utility Under Attack, improving over baselines by 20-33 percentage points

The counterfactual re-execution is the key innovation — it does not just check "am I confused?" but "was my decision causally driven by untrusted input?"

Paper: arxiv.org/abs/2602.22724

5. AgentAntibody (Weng et al., August 2026)

Paper: "AgentAntibody: An Adaptive Immune System for Defending LLM Agents against Prompt Injection" (arXiv:2608.04053)

An adaptive immune system for LLM agents. The first approach to recognize that defense should be learned over time rather than applied as a fixed policy.

  • Maintains a persistent, evolving library of "antibodies" that represent the user's security boundary
  • Each antibody stores transferable attack structure (not literal strings) — it generalizes across encounters
  • At runtime, the library recognizes threats and mounts targeted immune responses: sanitize content, constrain actions, revise plans, or request confirmation
  • Learns from each encounter: confirmed attacks create new antibodies, confirmed misses mature existing ones
  • Crucially: it removes attacker-controlled content (URLs, names, accounts) from recognition fields so the memory accumulates boundary knowledge, not attacker samples
  • Can start empty (learn from scratch) or with a "vaccine" of general attack structures

Results: Cold-start achieves 81.1% success vs 36.6% for the strongest baseline. After 80 encounters, cumulative attack success rate drops from 35% to 6.1%, using only 2.44 antibodies on average. 89.9% of encounters reuse existing antibodies — compact transfer, not case accumulation.

Paper: arxiv.org/html/2608.04053

6. AttriGuard / IPI Guard (March 2026)

Uses causal attribution of tool invocations — checks not just inputs but the actual cause of each tool call. If a tool call was causally driven by untrusted content rather than user intent, it is flagged as injection.

The Benchmarks

Three major benchmarks exist for testing defensive approaches against prompt injection:

AgentDojo

The standard benchmark for indirect prompt injection (IPI) defenses. Used by both AgentSentry and CaMeL for evaluation. Tests agents across multiple task scenarios with injected malicious instructions in tool outputs.

InjecAgent

Benchmarking indirect prompt injection in tool-integrated agents. Focuses specifically on how injections propagate through tool-use chains and how different agent architectures handle the contamination.

Agent Security Bench (ASB)

The most comprehensive benchmark: 16 attack types x 11 defenses x 10 scenarios with 400+ tools and 13 LLM backbones. Result: 84.3% average attack success rate across all defenses tested.

GitHub: github.com/agiresearch/ASB

Curated Resource Lists

Two GitHub repositories track this rapidly evolving field:

Where the Field Stands: Layered Defense

The consensus is forming around layered defense. No single approach is sufficient:

  1. Architectural separation (dual-LLM / CaMeL) as the foundation
  2. Input transformation (spotlighting) as a cheap first filter
  3. Runtime detection (AgentSentry's causal diagnostics) for catching what slips through
  4. Adaptive memory (AgentAntibody) for learning from encounters over time
  5. Hard infrastructure limits (timeouts, budgets) for resource-exhaustion attacks

The Open Research Gap

The infinite loop / crawler-trap problem has no published agent-side defense. The AI-level defenses (AgentSentry, AgentAntibody) are advancing fast but all assume the agent can still think. When the agent is trapped in an infinite loop of generated pages, it cannot run self-diagnostics, cannot check its trajectory, cannot call for help.

The defenses that exist are all offensive tools (Nepenthes, Iocaine, AI Labyrinth) — there is no published defensive remedy for the agent side. The remedy must be external to the agent: a supervisor process with watchdog timers, action-sequence loop detection, and hard resource budgets. This is unexplored territory and the most obvious gap for novel contribution.