Task tampering: injections that change a decision, not the task
Prompt injection defenses tested only on task redirection miss attacks that quietly change a decision inside the task.
· Amazon · Research by Rongting Zhang, Martin Bertran, Sandeep Avula, Chia-Jung Lee, Vanessa Murdock
Amazon researchers report that injections tampering with a decision inside the agent's own task still succeed 9.5% to 12.1% of the time against a defense that cuts task-redirection attacks to 2.4%.
01What happened
Amazon researchers released a benchmark on arXiv on November 5, 2026 for indirect prompt injections that tamper with a task instead of replacing it. Rongting Zhang and four colleagues built 90 validated cases across three tool-use environments, then ran them against five models through Amazon Bedrock. The code and data are published for academic reproducibility.
02How it works
A task-tampering injection plants content that influences a decision its source has no authority to make, such as a false refund policy in a document the agent reads, which then inflates the refund the agent approves. The agent still carries out the task it was asked to do, so a defense watching for a switch to a new objective sees nothing unusual. The authors sort attacks by which part of the agent's decision-making they target, including its objective, its observations and its state.
03Who is affected
Five models were evaluated at temperature 0 through Amazon Bedrock: Claude Sonnet 4, Claude Sonnet 4.5, DeepSeek V3.1, Kimi K2.5 and GLM-5. The three environments are named Productivity, DevOps and Marketplace. Teams running injection detection or tool-policy controls on agents that read untrusted documents are the practical audience.
04What to do
Test injection defenses against attacks that tamper with a decision inside the intended task, not only against attacks that redirect the agent to a new one. Treat a low score on a redirection-only benchmark as incomplete evidence that an agent is protected.
Measured results
Attack success rate under the DRIFT-isolation defense, by attack target
Higher is worse for defenders. A tool-policy defense allowed 15.4% overall, against 17.0% with no defense.
| Result | Score |
|---|---|
| Objective targeting | 2.4% |
| Observation targeting | 9.5% |
| State targeting | 12.1% |
Scale 0 to 100% · Source: arxiv.org, as published
Sources 3 links, all fetched
- 1arxiv.orgarXiv Paper
- 2arxiv.orgFull Text
- 3github.comBenchmark Code