# Task tampering: injections that change a decision, not the task

> Prompt injection defenses tested only on task redirection miss attacks that quietly change a decision inside the task.

- **Severity:** Info: Research, tools, evals or lab claims with no direct exposure. Context, not an alert.
- **Category:** Research, Benchmark
- **Published by:** Amazon
- **Disclosed:** 2026-11-05
- **Affects:** Claude Sonnet 4, Claude Sonnet 4.5, DeepSeek V3.1, Kimi K2.5, GLM-5
- **Research by:** Rongting Zhang, Martin Bertran, Sandeep Avula, Chia-Jung Lee, Vanessa Murdock
- **Primary source:** https://arxiv.org/abs/2611.07640
- **Page:** https://theinjection.dev/items/amazon-task-tampering-prompt-injection/

Amazon researchers report that injections tampering with a decision inside the agent's own task still succeed 9.5% to 12.1% of the time against a defense that cuts task-redirection attacks to 2.4%.

## What happened

Amazon researchers released a benchmark on arXiv on November 5, 2026 for indirect prompt injections that tamper with a task instead of replacing it. Rongting Zhang and four colleagues built 90 validated cases across three tool-use environments, then ran them against five models through Amazon Bedrock. The code and data are published for academic reproducibility.

## How it works

A task-tampering injection plants content that influences a decision its source has no authority to make, such as a false refund policy in a document the agent reads, which then inflates the refund the agent approves. The agent still carries out the task it was asked to do, so a defense watching for a switch to a new objective sees nothing unusual. The authors sort attacks by which part of the agent's decision-making they target, including its objective, its observations and its state.

## Who is affected

Five models were evaluated at temperature 0 through Amazon Bedrock: Claude Sonnet 4, Claude Sonnet 4.5, DeepSeek V3.1, Kimi K2.5 and GLM-5. The three environments are named Productivity, DevOps and Marketplace. Teams running injection detection or tool-policy controls on agents that read untrusted documents are the practical audience.

## What to do

Test injection defenses against attacks that tamper with a decision inside the intended task, not only against attacks that redirect the agent to a new one. Treat a low score on a redirection-only benchmark as incomplete evidence that an agent is protected.

## Attack success rate under the DRIFT-isolation defense, by attack target

Higher is worse for defenders. A tool-policy defense allowed 15.4% overall, against 17.0% with no defense.

| Result | Score |
|---|---|
| Objective targeting | 2.4% |
| Observation targeting | 9.5% |
| State targeting | 12.1% |

Source: https://arxiv.org/html/2611.07640v1

## Quick facts

- **Benchmark size:** 90 validated cases, 1,343 single-primitive attacks plus 90 compound
- **Environments:** Productivity, DevOps, Marketplace
- **Models tested:** Claude Sonnet 4, Claude Sonnet 4.5, DeepSeek V3.1, Kimi K2.5, GLM-5
- **Published:** arXiv v1, November 5, 2026
- **Code:** Released by amazon-science under CC BY-NC 4.0

## Sources

1. [arXiv Paper](https://arxiv.org/abs/2611.07640)
2. [Full Text](https://arxiv.org/html/2611.07640v1)
3. [Benchmark Code](https://github.com/amazon-science/task-tampering-prompt-injection)