> ## Content Index
> Fetch the complete content index at: https://www.notatechguy.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Prompt injection defense cuts agent attack rate from 37.8% to 4.4%
- URL: https://www.notatechguy.com/prompt-injection-defense-cuts-agent-attack-rate-from-37-8-to-4-4/
- Published: 2026-11-03T14:43:41.000Z
- Updated: 2026-11-03T14:43:41.000Z
- Description: A preprint called ATrust adaptively expands what an AI agent is allowed to trust, cutting hijack rates while improving task completion.
- Author: Marcello Babbili
- Tags: Technology & AI, AI Models, OpenAI

Attackers hijack GPT-4o agents 37.80% of the time on a standard benchmark by hiding rogue instructions in the data those agents read [S¹](https://arxiv.org/abs/2611.02741v1?ref=notatechguy.com). The authors of a November 2 arXiv preprint propose a defense that drops that to 4.37% while making the agent 10% more useful at its actual job [S¹](https://arxiv.org/abs/2611.02741v1?ref=notatechguy.com).

That second number breaks the usual bargain in agent security, where tighter defenses mean a less capable agent. The authors call the problem "over-defense": rigid trust rules that throw away task-essential content and leave the agent unable to finish its work [S¹](https://arxiv.org/abs/2611.02741v1?ref=notatechguy.com).

**My read:** The 37.80% to 4.37% reduction is striking, but it comes from two benchmarks the authors chose themselves, and the paper has not been peer-reviewed [S¹](https://arxiv.org/abs/2611.02741v1?ref=notatechguy.com). The "state-of-the-art" label they assign to AuthGraph, the defense they beat by 12.33%, is their own characterisation. No one outside the authors has confirmed that ranking [S¹](https://arxiv.org/abs/2611.02741v1?ref=notatechguy.com). The number I would watch is whether an independent lab can reproduce the attack-success-rate drop on a benchmark the ATrust authors did not design. Until then, this is a promising mechanism, not a shipped product.

### How the attack works

Indirect prompt injection, or IPI, is the attack where a malicious instruction is embedded not in the user's message but in a web page or an email the agent fetches and reads [S¹](https://arxiv.org/abs/2611.02741v1?ref=notatechguy.com). The agent cannot distinguish "here is data to summarise" from "here is an instruction to follow." That confusion lets attackers steal private information or trigger financial transactions [S¹](https://arxiv.org/abs/2611.02741v1?ref=notatechguy.com).

This is not a theoretical worry. As we found when [AI email agents complied with 45% of adaptive phishing attacks](https://www.notatechguy.com/ai-email-agents-comply-with-45-of-adaptive-phishing-attacks/), agents that handle email already fall for manipulated content at rates that would alarm any compliance team. And [agents have been caught harvesting email codes to bypass human approval](https://www.notatechguy.com/ai-agents-harvest-email-codes-to-bypass-human-approval/), exactly the kind of destructive operation IPI enables.

### What ATrust actually does

ATrust treats trust as something an agent earns step by step rather than grants all at once [S¹](https://arxiv.org/abs/2611.02741v1?ref=notatechguy.com).

It begins with the user's original query as the sole trusted input, what the authors call the "root trust anchor." Every piece of external data the agent encounters, whether a search result or an API response, is weighed against the trust boundary as it currently stands and what the agent is doing at that point in the task [S¹](https://arxiv.org/abs/2611.02741v1?ref=notatechguy.com). If the data is task-essential, it is admitted as a new trust anchor and allowed to shape subsequent decisions. If it is irrelevant, whether benign or malicious, it is excluded [S¹](https://arxiv.org/abs/2611.02741v1?ref=notatechguy.com).

Unlike existing defenses, ATrust does not make a single static decision about what is trusted. It expands the boundary adaptively as the task progresses, which the authors say preserves necessary environmental feedback while blocking injection attempts [S¹](https://arxiv.org/abs/2611.02741v1?ref=notatechguy.com).

### The numbers, and what they are measured against

The authors evaluated ATrust on two benchmarks: AgentDojo and AgentDyn [S¹](https://arxiv.org/abs/2611.02741v1?ref=notatechguy.com). Using GPT-4o as the engine, ATrust cut the attack success rate on the AgentDyn benchmark from 37.80% to 4.37% [S¹](https://arxiv.org/abs/2611.02741v1?ref=notatechguy.com). It also enhanced utility, the agent's ability to complete its assigned task, by 10.00% [S¹](https://arxiv.org/abs/2611.02741v1?ref=notatechguy.com). Against AuthGraph, which the authors describe as the state-of-the-art defense, ATrust outperformed it by 12.33% [S¹](https://arxiv.org/abs/2611.02741v1?ref=notatechguy.com).

![Attack success rate on AgentDyn GPT-4o](https://storage.ghost.io/c/6e/89/6e896869-22ef-4281-a213-b4c462c17cff/content/images/2026/11/chart_975a31745ce8943d4342.png)

All of these figures are self-reported. The preprint has not undergone peer review, and no evidence in the source indicates third-party replication or production testing [S¹](https://arxiv.org/abs/2611.02741v1?ref=notatechguy.com). The benchmarks are specific test environments, and the authors' own risk notes acknowledge that results may not generalise to real-world deployments.

When we ran code from a related trust-region repository on our CPU-only sandbox box, the script crashed within five seconds on a missing Python module \[LAB1\]. That repo is not ATrust's own code, which does not appear to be publicly released. But the failure is a reminder that reproducibility in agent-security research remains thin: many defenses exist only as descriptions in papers.

### A crowded field

ATrust is not alone in trying to solve this. Microsoft's Sarah Bird, writing on the Foundry blog in June 2026, described the company's push for "open evals and a control standard" for trustworthy agents [P²](https://devblogs.microsoft.com/foundry/build-2026-open-trust-stack-ai-agents/?ref=notatechguy.com). A separate Fujitsu Research team, including Inderjeet Singh at Fujitsu Research of Europe, has published work on "stateful trust inference" for multimodal agents, treating adversarial intent as a latent variable to be detected at runtime [P⁴](https://arxiv.org/pdf/2602.21447?ref=notatechguy.com). And on GitHub, a project called AgentTrust offers pre-execution gating and attack-chain detection for tool-using agents, with 30 stars and an AGPL licence [P⁵](https://github.com/chenglin1112/AgentTrust?ref=notatechguy.com).

The common thread is that the industry has accepted agents cannot be secured by the model alone. The defence has to sit in the execution layer, between the model's output and the tool it wants to call.

### Who would use this first

A team building a customer-service agent that reads support tickets, fetches account details, and can issue refunds would feel the IPI threat most acutely. A malicious ticket could instruct the agent to refund every customer who asks. Today, that team likely relies on either a rigid allow-list of trusted data sources, which breaks when the agent needs to read a new ticketing system, or no defense at all.

ATrust's adaptive boundary would, in theory, let the agent read each new ticket as potentially trustworthy, evaluate it against the user's original request, and admit only the task-relevant content. The 10% utility gain matters here: the agent becomes safer and more capable at the same time, because it stops discarding information it needs.

The gap between theory and deployment is the open question. As we found when examining [a new LLM backdoor that hides attacks in logical reasoning](https://www.notatechguy.com/new-llm-backdoor-hides-attacks-in-logical-reasoning/), the attack surface for agents keeps expanding faster than the defenses. ATrust has not been deployed in production, and the authors provide no evidence of real-world testing [S¹](https://arxiv.org/abs/2611.02741v1?ref=notatechguy.com). The next checkpoint is peer review. Until an independent team reproduces the 37.80% to 4.37% drop on a benchmark they designed themselves, ATrust is a well-argued idea with promising numbers, and numbers that no one outside the authors has checked.

---

*Sources: [S1 — ATrust: Adaptive Trust Boundary Expansion for Securing LLM Agents](https://arxiv.org/abs/2611.02741v1?ref=notatechguy.com) · [P2 — Build agents you can trust across any framework with open evals and a ](https://devblogs.microsoft.com/foundry/build-2026-open-trust-stack-ai-agents/?ref=notatechguy.com) · [P3 — shiralab/adaptive-trpo](https://github.com/shiralab/adaptive-trpo?ref=notatechguy.com) · [P4 — arxiv.org](https://arxiv.org/pdf/2602.21447?ref=notatechguy.com) · [P5 — chenglin1112/AgentTrust](https://github.com/chenglin1112/AgentTrust?ref=notatechguy.com) · [LAB1 — Not A Tech Guy code lab: sandboxed run of python main.py](https://github.com/shiralab/adaptive-trpo?ref=notatechguy.com)*

## Related reading

- [AI email agents comply with 45% of adaptive phishing attacks](https://www.notatechguy.com/ai-email-agents-comply-with-45-of-adaptive-phishing-attacks/) — our technology desk, 2026-10-24
- [New LLM backdoor hides attacks in logical reasoning](https://www.notatechguy.com/new-llm-backdoor-hides-attacks-in-logical-reasoning/) — our technology desk, 2026-09-22
- [AI agents harvest email codes to bypass human approval](https://www.notatechguy.com/ai-agents-harvest-email-codes-to-bypass-human-approval/) — our technology desk, 2026-10-28

---

*Written from 6 sourced items, 4 of them primary, plus a sandbox run of the released code.*