Agent recon sharpens LLM prompt-injection attacks
New research formalises reconnaissance for pentesting AI agents and ships an automated framework, Know Your Agent (KYA). By profiling tasks, tools and guardrails, KYA tailors indirect prompt injections and beats static baselines, hitting up to 99.3% on benchmarks and breaching a real coding agent. Prompt-level defences help, but don’t close the gap.
Most automated “attacks” on Large Language Model (LLM) agents boil down to lobbing payloads and hoping something sticks. This work takes the old-school route: do recon first, then strike. The authors formalise what agent reconnaissance looks like and build a black-box pentester, Know Your Agent (KYA), that profiles targets and uses that profile to craft sharper prompt injections.
How it works
The paper defines knowledge assets: concrete operational details an attacker can extract from an agent. Think tool names and schemas, the wording of guardrails, the user’s task, permissions, and execution context. Those assets let you exploit two recurrent quirks in agent behaviour: surface-form trust, where specific strings or markers read as authoritative, and coherence-based legitimation, where actions that look on-task slide past caution.
KYA automates this in a loop. An orchestrator decides when to probe and when to attack. Recon probes surface assets and update a structured target profile. Exploitation then instantiates attack blueprints using what was learned, including delimiter spoofing, role-marker forgery, tool-call completion and framing instructions as coherent with the current task. It is all black-box: no model weights, no insider prompts.
Results
On benchmarks, recon pays. KYA lifted attack success rates by as much as 67 percentage points over static and iterative baselines, reaching 86.0% on AgentDojo and 99.3% on InjecAgent across models such as GPT-4.1, Llama 3.3-70B and Gemini 3 Flash. A simple “Important Instructions” baseline cratered to 8.1% on Gemini; KYA hit 89.2% under the same conditions.
Ablations show where the leverage comes from. Reconnaissance was the dominant contributor: 34% of breaches required it; adding tactics alone gave just 4%; combining both unlocked a further 31% uniquely. Single assets moved the needle a lot. Knowing the agent’s task took success from 12.4% to 61.9% without defences, and from 2.1% to 38.1% with prompt-based defences in place.
Common prompt-level mitigations dented but did not kill the approach. Data delimiting barely mattered. Repeating the user prompt cut success to 53.0%. A detector pushed KYA down to 30.4% while also lowering benign utility for some methods. In a real coding agent (OpenHands), KYA achieved 21.9% across tasks, with the best hit rate on actions that were harmful yet believable in context; implausible dangerous steps fared worse.
Commercially, this is not a headline-grabber so much as a method you will end up using. If you run or buy agentic systems, expect attackers to profile them first. If you test them, do the same. The open questions are scale, cost, and how far stronger provenance or runtime checks shift these numbers. For now, assume your agent leaks operational tells under pressure.
Additional analysis of the original ArXiv paper
📋 Original Paper Title and Abstract
Know Your Agent: Reconnaissance-Driven Pentesting of AI Agents
🔍 ShortSpan Analysis of the Paper
Problem
This paper studies how to evaluate and exploit vulnerabilities in agentic AI systems that use large language models to plan, call tools, and act on external state. Such agents consume data from web pages, files, repositories and tool outputs, creating opportunities for indirect prompt injection where attacker-controlled content is retrieved by the agent and treated as instructions. Existing automated testing largely applies one-shot payloads or payload‑centric iteration and therefore misses a core penetration‑testing element: reconnaissance. Without active target modelling and probing, attackers and testers cannot reliably discover tool schemas, guardrail wording, task context or other operational details that make indirect injections successful.
Approach
The authors formalise agent reconnaissance and the notion of knowledge assets: discrete pieces of operational information about an agent such as tool access and schemas, refusal boundaries, user tasks, permissions and execution context. They identify two recurrent weaknesses that assets exploit: surface‑form trust (textual patterns that the model treats as signals of authority) and coherence‑based legitimation (the model accepting actions that look coherent with the task). They implement Know Your Agent (KYA), a black‑box, autonomous pentesting framework that interleaves reconnaissance and exploitation. KYA maintains a structured target profile, a tactic library of attack blueprints, and three modules: an Orchestrator that decides whether to probe or attack, a Reconnaissance module that issues probes to surface assets, and an Exploitation module that instantiates tactics with discovered assets. The system was evaluated under a fixed interaction budget and across established benchmarks and a real coding agent.
Key Findings
- KYA substantially improves attack success rate (ASR) over static, generated and iterative baselines, reporting up to 67 percentage points improvement in ASR on benchmark tasks.
- On benchmarks, KYA reached 86.0% ASR on AgentDojo and 99.3% on InjecAgent; it outperformed baselines across multiple foundation models including GPT‑4.1, Llama 3.3‑70B and Gemini 3 Flash. For example, an Important Instructions baseline fell to 8.1% on Gemini while KYA reached 89.2%.
- Ablations show reconnaissance is the dominant contributor: 34% of successful breaches required reconnaissance, tactics alone added just 4%, and the full system uniquely solved a further 31% of cases. Single knowledge assets can be highly valuable: knowing the agent’s task raised ASR from 12.4% to 61.9% in undefended settings and from 2.1% to 38.1% under prompt‑based defences.
- KYA remains effective against common prompt‑level defences though they reduce success: data delimiting had almost no effect, repeat‑user‑prompt reduced ASR to 53.0%, and a detector reduced KYA to 30.4% while also lowering benign utility for some methods.
- In a real‑world coding agent case study (OpenHands) KYA achieved 21.9% ASR across tasks; success was highest for plausibly harmful but contextually believable actions (risk tier 35%), lower for benign or highly implausible dangerous actions.
Limitations
Evaluations were conducted under a black‑box model with a fixed interaction budget and in controlled environments; the OpenHands case used small repositories to focus on susceptibility rather than scale. KYA itself is implemented using high‑capability models for orchestration, which may differ from real attacker resources. The work is dual‑use and the authors note that released code will carry defensive licensing; results may not generalise to all deployments or to systems with stronger provenance or runtime authentication.
Implications
An attacker can systematically probe an agent to extract operational knowledge that materially increases the chance of successful indirect prompt injection. Reconnaissance enables specific offensive techniques such as delimiter spoofing, role‑marker forgery, tool‑call completion and coherence framing, by combining surface‑form mimicry with contextually plausible pretexts. Even modest disclosure of task context, tool names or guardrail wording can convert a generic payload into one that appears trusted and executable. Practically, this means adversaries can craft higher‑confidence, workflow‑aligned attacks that bypass many prompt‑level defences, so defenders should expect reconnaissance‑driven exploitation paths around knowledge leakage, prompt structure, tool usage and memory handling.
