PromptArmor 研究称开放权重模型遭间接提示词注入攻击的易感率高 88%

We evaluated open-weight and proprietary models to test their susceptibility; we found that open-weight models exhibit 88% higher susceptibility to real-world indirect prompt injection cyber attack chains.

In this evaluation, we tested the most recent flagship model and the most recent cost-effective variant across the providers used most in an enterprise setting.

Open-weight models were 88% more susceptible to indirect prompt injection cyberattack chains. Below is a sample of some of the attacks that exhibited notable discrepancies in susceptibility between open-weight and proprietary models.

What we measure

Our research team identifies vulnerabilities in real-world agentic systems (e.g., Claude, ChatGPT, Atlassian Rovo, etc.) and develops end-to-end indirect prompt injection attack chains with cyber-attack impacts (for example, data exfiltration or remote code execution). Our published research has been cited in various industry frameworks and publications (e.g., OWASP Top 10 for LLMs and MITRE ATLAS, OpenAI's research on data exfiltration in agents and agent adversarial robustness).

We wanted to answer: How susceptible are open-weight models to real-world indirect prompt injection cyber attacks?

Existing cyber/alignment benchmarks do not cover these attack chains and methodologies:

• They do not cover the cyber attack chains that are used to exploit agentic systems in the real world.

• They do not cover the complexities and domains (e.g., legal, healthcare, finance, etc.) of real-world use cases that agents see today, such as always-on agents and long-horizon tasks.

• Their payload design techniques and methodology are ineffective against the current generation models and are out of date, resulting in underrepresentation of model susceptibility.

This gap led us to develop our own evaluation benchmark to more accurately measure the susceptibility of models to indirect prompt injection cyberattacks that real-world agentic systems are exposed to.

Our Methodology

Real agentic systems are complex; systems vary in threat model and attack surface, and evaluation environments need to reflect that. For example, you cannot rely on model refusal to measure attack success: in real-world attacks, models don't understand the actions they're taking. This leads models to misrepresent whether they fell for an attack (see Sonnet 5 falsely claiming it didn't run malware) or even fall for attacks they've already identified; example below:

Here are some examples of the types of real-world indirect prompt injection cyberattacks we assess: 

System Manipulation

System manipulation occurs in an agentic system when an agent is manipulated by an untrusted data source to take an action using its tools that has a cyberattack consequence for the user (e.g., forwarding a sensitive email to an attacker or running an unauthorized workflow). 

For example, in an attack chain we found in Elastic's Agentic Security Operations Center, the agent is tasked with triaging phishing email reports, but the content of one of the alerts manipulates the agent into executing attacker workflows. The workflows take malicious actions, including disabling alert routing rules, minting and exfiltrating API keys, and editing data in the tenant.

Data Exfiltration

In an agentic system, data exfiltration occurs when an agent is manipulated by an untrusted data source to produce an output that results in data from the user's workspace being exfiltrated to an attacker.

Our team identified a data exfiltration indirect prompt injection cyberattack chain in Atlassian Rovo. In this attack, Rovo is charged with organizing Jira tickets in accordance with a guide the user found online. The guide conceals an instruction that manipulates the agent to append all of the Jira tickets to the end of an attacker URL and request the URL it built through its website retrieval tool. The attacker then logs all the requests they got, including the victim's data appended to the requested URL.

Phishing

Phishing in an agentic system occurs when an untrusted data source manipulates the model to produce an output that phishes the user, or individuals that are working with content the agent has created.

Some examples include a model generating malicious links, directives to contact untrusted parties via phone or email, or even a model executing code that creates fake login displays.

Our team identified a phishing attack chain in ChatGPT for Google Sheets. In this attack, an imported sheet manipulates ChatGPT into running an attacker-controlled script, which opens a phishing login pop-up.

These examples demonstrate a small subset of the types of attacks and variants of attack chains we measure in our benchmark for AI systems.

Evaluating model susceptibility requires more than realistic environments that reflect real-world tasks, tools, and capabilities. It also requires continuously testing against the latest attack techniques as adversaries evolve their methods.

Further Findings: Flagship vs. cost-effective models

Model providers generally offer flagship model lines and cost-effective lines. OpenAI and Anthropic released their cost-effective models after their flagships, yet those newer models were much more susceptible to indirect prompt injection cyberattacks. In contrast, for Qwen and DeepSeek, newer cost-effective models were more robust against attacks than the flagships that preceded them.

We also observed that the gap in susceptibility between cost-effective models and flagships was much greater for proprietary providers than for open-weight providers.

For proprietary providers, cost-effective models were 169% more susceptible than flagships, while for open-weight providers, cost-effective models were 5% less susceptible than their flagships.

The models tested in this analysis were:

• Flagship: DeepSeek V4-Pro, Kimi K3, GLM-5.3, Qwen3.8-2.4T, Claude Fable 5.1, GPT-6 Astra, Gemini 3.1 Pro

• Cost-effective: DeepSeek V4.1-Flash, Kimi K2.6, GLM-5.3-Flash, Qwen3.8-Flash-Next, Claude Haiku 5.5, GPT-6 Luna, Gemini 3.8 Flash

Note: Moonshot does not offer a cost-effective line, so we substituted a prior flagship. Additionally, we did not test closed-weight models offered by open-weight providers.

Benchmarking

Are you interested in measuring model susceptibility to cyberattacks via indirect prompt injection in real-world environments? If you would like an evaluation of a model you use or are developing, contact us below.