LLM agents are increasingly deployed in long‑horizon tasks that require interaction with diverse external environments. Despite their growing capabilities, they remain vulnerable to indirect prompt injection attacks, where an attacker embeds malicious instructions in the environment to steer the agent toward unsafe behavior. Prior risk assessments have focused mainly on the content of the injection, overlooking where the injection appears. To systematically evaluate the impact of injection placement, we built three testbeds covering tool use, code generation, and daily workflow domains, each exposing a variety of injection surfaces. With the injection content held constant, experiments reveal that susceptibility varies significantly across placements, a phenomenon we call the "trust region effect": agents implicitly assign different levels of trust to different regions of their environment. For instance, a GPT‑5.4‑powered agent follows an unsafe instruction placed in a repository README or TODO file 2.6 times more often than the same instruction placed in a code or data file. Leveraging this insight, we develop learning‑based attackers that jointly generate injection content and select optimal placement. Results show that both the location and the content of an injection jointly determine the strength of indirect prompt injection attacks. To our knowledge, this work provides the first systematic characterization of injection effectiveness across coarse‑grained environmental surfaces and fine‑grained positions, highlighting the uneven trust agents place across their environments and offering valuable guidance for future attack and defense designs.
Review