AI Agents May Always Fall for Prompt Injections

Key findings

• Framing injection as a contextual-integrity problem yields an impossibility result: an adversary can always construct a context in which a blocked flow looks legitimate - Defences that suppress engagement with external content can also suppress reporting of suspicious content

Sources

• arxiv.orghttps://arxiv.org/abs/2605.17634