Attack success rate hides the number that matters: whether the user can see the injection in the agent's final answer

arXiv·medium signalXBlueskyLinkedInCopy link

The authors split attack success rate into Covert Success Rate, injections that leave no trace in the final response, and Overt Success Rate, ones the user can spot. The split follows from the ReAct format, where the final response summarizes the most recent action, so a trace that hands control back to the user task before ending stays invisible. Their ICoA attack deliberately steers the agent back to the user task after firing the injection and posts the highest covert rate across four models on AgentDojo, 3.79 to 12.01 points over the strongest baseline. Anyone reporting ASR on a tool-using agent is measuring the wrong thing.