Prompt injection success scales with the attacker's compute budget.

A paper reframing indirect prompt injection as test-time search builds an agentic attacker doing environment reconnaissance, structured strategy reasoning and adaptive evaluation against victim feedback (arXiv 2609.04495). More attacker compute consistently improves both vulnerability discovery and exploitation, and ablations show explicit strategy management is what stops redundant search from eating the larger budget. The consequence for anyone reading red-team reports: a resistance number published without an attacker compute budget tells you nothing, and your measured resistance falls as budgets rise.