Researchers beat AI prompt-injection defenses with fake quote marks

A new technique hides fake quote marks and dollar signs inside data an AI agent already trusts, hijacking its behavior, per a Seoul National University, UIUC, and Largosoft paper.

That's a problem for anyone shipping agents that read text they don't fully control, like emails or scraped web pages. The technique succeeded 31 to 43 percent of the time on structured data and beat purpose-built prompt-injection defenses up to half the time.

The technique is called probabilistic delimiter injection. Attackers hide escaped quotes, curly quotes, and dollar signs inside fields an agent already trusts, like sender names or button IDs. The model reads those characters as structural syntax, the way it would read real formatting. A strict parser would just see plain text.

On webpage data, success rates ran as high as 100 percent, per the paper. Classic injection attempts, the obvious ones, got caught almost every time. This technique reads as ordinary data instead.

Two defenses actually worked, per the paper. Assigning unguessable random IDs to page elements cut success from about 49 percent to 29 percent, a real reduction but not a fix. Full data-source lineage verification, tracking where each piece of input came from, eliminated every tested attack.

A related benchmark on agent security found single-turn attacks mostly fail, while attacks that adapt across many rounds succeed far more often. Delimiter injection looks like a single-turn version of that same pattern, dressed up as a formatting quirk instead of an attack.