AI agents sometimes follow instructions hidden in the data they process, like an email assistant that reads a PDF and then deletes your messages because the PDF told it to. This is called a attack. After mid-2025, most published attacks stopped working on the latest models, and human security experts found it harder to break through. But that doesn't mean the problem is gone.
The researchers built a test where an attack's goal is a simple, harmless action like calling a random tool, not something dangerous. This isolates whether the model truly ignores hidden instructions. They then created an attacker that uses a swarm of AI agents working together to craft injection payloads, improving on past single-AI attackers.
On recent models from Google and others, this swarm attacker succeeded where simpler attacks failed. The finding shows that making AI models stronger does not by itself end prompt injection threats, defenses must also use layered system protections and ongoing automated testing.