Voluntary Servitude: a fake safety warning steers agents past injection filters
Voluntary Servitude is an injection with no commands in it, so prompt-injection filters pass it and the agent narrows its own options.
· Technion · Research by Ilan Zendel, Matan Levy, Stav Cohen (Technion and Zenity), Avi Mendelson, Amit LeVi
Voluntary Servitude is an injection that carries no instructions: a fabricated safety warning in content an agent reads makes the agent rule out the safe option on its own. Two detectors scored the payloads benign, the authors report.
01What happened
Researchers at the Technion and Zenity published Voluntary Servitude on arXiv on November 3, 2026, and the paper's comments state it is accepted at NeurIPS 2026's main track. Ilan Zendel, Matan Levy, Stav Cohen, Avi Mendelson and Amit LeVi measured the technique across six models, ten consumer-service domains and four production browser agents.
02How it works
The payload is a fabricated hazard warning planted in content the agent retrieves, such as an ordinary-looking review that claims one option is unsafe. Because the text issues no instruction, it reads as information rather than a command, and the agent's own harm-avoidance then rules out the legitimate option and leaves the attacker's target standing. The authors call this steering: the attacker never tells the agent what to do, so there is no imperative for a filter to match.
03Who is affected
Four production browser agents were tested on a live page, 20 trials each, with success rates listed below. Any agent that reads attacker-controlled text and then picks between options is in scope, including retrieval pipelines, where the authors measured end-to-end success from 1.0% to 57.0% depending on the retriever.
04What to do
Require an agent to corroborate a hazard claim against a second source before acting on it: the authors report that this one instruction change removed roughly 95% of the exposure without retraining. Do not rely on a prompt-injection classifier to catch these payloads, because both detectors tested passed most of them.
Measured results
Safety-warning payload success, production browser agents
Higher is worse for defenders; 20 trials per agent
| Result | Score |
|---|---|
| Microsoft Edge with Copilot | 100% |
| Perplexity Comet | 60% |
| Brave assistant | 100% |
| OpenAI Codex browser | 20% |
Scale 0 to 100% · Source: arxiv.org, as published
Questions people ask
- Does a prompt injection filter stop Voluntary Servitude attacks?
- Prompt-injection filters largely do not stop Voluntary Servitude payloads. The authors report that ProtectAI's DeBERTa-v3 classifier passed 100% of the safety-warning payloads and Lakera Guard passed 78%, against 54% and 16% for ordinary instruction injection. Because the payload contains no command, detectors that look for command-like text score it as benign, which makes the attack more effective behind a filter than in front of one.
- Which browser agents did the Voluntary Servitude paper test?
- The paper tested four production browser agents on a live web page, with 20 trials each. Microsoft Edge with Copilot and Brave's assistant followed the fabricated safety warning in all 20 trials. Perplexity Comet followed it in 60% of trials, and the OpenAI Codex browser in 20%. On three of the four agents, the safety payload beat ordinary instruction injection.
- How can defenders reduce exposure to safety-warning steering?
- Adding a corroboration requirement to the agent's instructions is the mitigation the authors measured: the agent must confirm a hazard claim against a second source before acting. Pooled attack success fell from 68.4% to 3.6% against a non-adaptive attacker, with no retraining. Gemini 3.1 Flash Lite stayed weakest at 8.7% after the change, so the authors do not present corroboration as a complete fix.
Sources 2 links, all fetched
- 1arxiv.orgarXiv Paper
- 2arxiv.orgFull Text (HTML)