Planting fake flags in CTF challenges costs a solving agent 20 turns and 2k reasoning tokens even when it wins.

AgentLSD separates adversarial task contamination from prompt injection: injection needs attacker-supplied instructions, contamination works through non-instructional evidence like fake results and decoy endpoints planted in pages, logs, configs and command output. Six models, 11 web CTF challenges, deterministic trap generation with delivery verification. Agents captured 41% of flags clean, no model solved every challenge, and traps added roughly 20 turns and 2k reasoning tokens even on successful runs. Damage was heterogeneous: some pairs unaffected, others followed decoys or submitted wrong flags. Clean benchmark scores understate real adversarial surfaces, and the token overhead is a budget line.