An attacker does not need to touch an agent's prompt to hijack it. A new benchmark called ToolHazard plants malicious instructions in the environment agents read through their tools -- files, databases, API responses -- and finds that whether the attack works depends heavily on where the text sits. Injections placed near the end of an agent's observations, and encountered early in a long task, succeed substantially more often than the same text placed elsewhere. Free-form tool output is measurably more dangerous than structured JSON or YAML.
Key facts
- ToolHazard covers 87 long-horizon tasks across 28 stateful environments with 512 tools.
- Three components generate the attacks: an environment simulator that builds executable stateful environments, an attacker agent that finds viable injection points and writes environment-specific payloads, and a user simulator.
- Alignment data generated by the framework improved security on both ToolHazard-Bench and the AgentDojo benchmark while preserving task utility, tested on Qwen3-4B and Qwen3-8B.
- Primary source: ToolHazard: Scaling Adversarial Environments for Security Evaluation and Alignment of LLM-based Agents, with full text on arXiv.
Prompt injection is usually explained with a typed example: a user pastes text that tells the model to ignore its instructions. That framing is out of date. An agent with tools spends most of its context window reading things it fetched itself -- a support ticket, a code comment, a search result, a row in a database -- and a language model has no mechanism that separates "content I was asked to process" from "instructions I should follow." Anything the agent reads is a candidate instruction. We covered the underlying reason this works in an earlier piece on why models read tone rather than tags.
What ToolHazard adds is scale and realism. Rather than hand-writing attack strings, it builds working environments with state -- systems where actions have consequences that persist across steps -- then uses an attacker agent to hunt for viable injection points inside them and write payloads tailored to each. That produces something existing evaluations mostly lack: attacks against long tasks in which an agent has to accomplish a real multi-step goal and where the payload competes with genuine work for the model's attention.
The positional findings are the practical contribution. Two effects show up. Injections encountered earlier in the execution trajectory land more often -- the agent has not yet built momentum toward its actual objective, so a redirection is cheap. And injections placed near the end of an agent's observations land more often than the same text buried in the middle, which fits everything known about how models weight recent context when choosing a next action.
The analogy is a forged memo slipped into a stack of paperwork. It matters enormously whether it sits on top of the pile and whether it arrives at the start of the day, before anyone has settled into what they were actually supposed to do. The content of the forgery is the same either way.
That has an immediate consequence for anyone building agent tools, and it is not the obvious one. The usual mitigation advice concerns what an agent is allowed to do. This work says something about how tool results should be assembled: if the tail of a tool's output is the highest-risk position, then appending untrusted content -- user comments, page text, file contents -- at the end of a tool response is the worst available layout, and the ordering inside your own tool wrappers is a security decision you are currently making by accident. The finding that free-form output is more vulnerable than JSON or YAML points the same way: structure gives the model a frame in which untrusted text is visibly a value rather than a directive. Neither is a fix. Both are free.
The paper also produces defensive training data, not just attacks. Alignment data generated by ToolHazard improved measured security on both its own benchmark and on AgentDojo, an independent agent-security benchmark, while preserving task utility on Qwen3-4B and Qwen3-8B -- the important half of that claim, since a model that refuses everything is trivially secure and useless. Guardrail training that survives contact with the actual task is the harder result.
The honest caveats are real. These are synthetic environments built by the same team that attacks them, and attack success rates measured this way are a property of the harness and the judge as much as of the models. Two small Qwen models are a narrow base for the alignment result. And a benchmark whose attacker is itself an agent will find the injection points that agent is good at finding, which is not the same set a determined human would find.
None of that undercuts the direction. Read alongside environment-evolution red teaming that broke agents 85 percent of the time and the growing argument that agent safety belongs in the runtime rather than the weights, the field is converging on one uncomfortable conclusion: the model is not the attack surface. The environment is, and every tool you connect is another door -- which is why per-agent sandboxing has moved from good practice to baseline, and why giving each coding agent its own microVM stopped looking like overkill.
Originally published on Ground Truth, where every claim is checked against the primary source.
