AI agents follow attacks in documentation 2.6 times more than in code

The same injected instruction succeeds more often in documentation than in code or data files across three agent domains.

Big Tech

Chengquan Guo · Xiaodong Liu · Weiwei Yang · Mingqian Feng · Jialin Song · Qiyao Ma · +4 more

University of Chicago · Microsoft Research · University of Rochester · Simon Fraser University · University of California, Davis

Research Digest·30 October 2026·2 min read

Illustration: AI agents follow attacks in documentation 2.6 times more than in code

In one line

LLM agents treat some environment regions as more trustworthy than others, so indirect prompt injections succeed unevenly depending on where they are placed.

Before you read this

Three ideas this paper builds on

prompt injectionA security attack where malicious instructions are embedded into inputs to override an LLM's intended behavior.62 papers →agentic evaluationMeasuring AI agents' performance in complex tasks, highlighting failures in planning, monitoring, and real237 papers →agent safetyRisks from AI agents including timing errors, shutdown avoidance, collusion, overclaiming, and unsafe execution, mitigated by constrained decoding, safety harnesses, and swarm governance.143 papers →

Read it as

Large language model (LLM) agents read files, use tools, and carry out tasks, but attackers can hide malicious instructions in that content. Most prior work studied content, not location. Does location change obedience?

They built test environments for tool use, coding, and daily workflows, and placed the same harmful instruction in different spots, like documentation versus code or data files. They measured how often agents followed it.

They found a trust region effect: location matters. One agent obeyed an unsafe instruction in a README or TODO file 2.6 times more often than in a code or data file. So attackers can pick hiding spots to strengthen attacks, and defenders should treat all input regions as untrusted.

How it works

stage by stage

RSS

The Daily Edition

The front page in your inbox each weekday morning: the lead, the picks, and why each one earned its place.

Concepts

prompt injection trust region effect agentic evaluation agent safety reinforcement learning