arXiv 2603.15714: Largest Public Prompt Injection Red Team Competition — 464 Participants, 240K+ Attacks, Universal Transfer Strategies Identified Across 13 Models

arXiv·high signalXBlueskyLinkedInCopy link

Three-week, $40K-prize red team competition evaluated indirect prompt injection across tool-calling, coding, and computer-use agent settings. 464 participants submitted 240K+ attack attempts with 8K+ successes. Overall attack success rate ranged 0.5–8.5% across 13 models. Critical finding: universal attack strategies transferred across 21 of 41 behaviors and multiple model families. Gemini 2.5 Pro showed both high capability AND high vulnerability — capability and robustness are weakly correlated. Competition environment open-sourced for evals.