{
  "$schema": "https://themachinepress.com/schemas/story-v1.schema.json",
  "schema_version": "1.0.0",
  "document_type": "machine_press_story",
  "story": {
    "story_id": "mp-2026-09-07-026",
    "source_story_id": "tmp-story-indirect-prompt-injection-search",
    "edition_id": "mp-2026-09-07-morning-0060",
    "edition_url": "https://themachinepress.com/edition/2026-09-07",
    "position": 15,
    "story_type": "dispatch",
    "section": "safety-security",
    "editorial_classification": "editorial",
    "headline": "The Attacker Spent More Compute Searching the Environment",
    "slug": "the-attacker-spent-more-compute-searching-the-environment",
    "dek": "An agentic red-team harness treats indirect prompt injection as adaptive test-time search over the user task, environment and attack goal.",
    "summary": "An agentic red-team harness treats indirect prompt injection as adaptive test-time search over the user task, environment and attack goal.",
    "body_text": "The attacker first reconnoiters the environment, manages candidate strategies and uses victim-agent feedback to refine attempts. Across heterogeneous tasks, more test-time compute improved vulnerability discovery and exploitation, while removing explicit strategy management increased redundant search and weakened gains at higher budgets. The paper argues that evaluations should report attacker search procedure and compute budget instead of treating success as a fixed property of the victim. The evidence measures the tested harnesses and tasks, not every tool-using agent.",
    "why_it_matters": "An agentic red-team harness treats indirect prompt injection as adaptive test-time search over the user task, environment and attack goal.",
    "limitations": [
      "The evidence measures the tested harnesses and tasks, not every tool-using agent."
    ],
    "importance": 8,
    "canonical_url": "https://themachinepress.com/story/mp-2026-09-07-026/the-attacker-spent-more-compute-searching-the-environment",
    "json_url": "https://themachinepress.com/story/mp-2026-09-07-026.json",
    "first_published_at": "2026-09-07T09:00:00.000-04:00",
    "modified_at": "2026-09-07T09:00:00.000-04:00",
    "content_status": "new",
    "is_carryover": false,
    "carryover_reason": null,
    "key_claims": [
      {
        "claim_id": "claim-mp-2026-09-07-026-001",
        "text": "An agentic red-team harness treats indirect prompt injection as adaptive test-time search over the user task, environment and attack goal.",
        "source_ids": [
          "source-2026-09-07-015"
        ],
        "qualification": "The evidence measures the tested harnesses and tasks, not every tool-using agent."
      }
    ],
    "source_ids": [
      "source-2026-09-07-015"
    ],
    "tags": [
      "prompt injection",
      "agent security",
      "red teaming"
    ],
    "image_url": null,
    "corrections": []
  },
  "sources": [
    {
      "source_id": "source-2026-09-07-015",
      "title": "arXiv preprint 2609.04495",
      "publisher": "arXiv",
      "url": "https://arxiv.org/abs/2609.04495",
      "canonical_url": "https://arxiv.org/abs/2609.04495",
      "source_type": "primary_research",
      "is_primary_source": true,
      "published_at": "2026-09-03T17:28:37.000-04:00",
      "accessed_at": "2026-09-07T08:20:00.000-04:00",
      "supports_claim_ids": [
        "claim-mp-2026-09-07-026-001"
      ]
    }
  ],
  "corrections": [],
  "publisher": {
    "name": "The Machine Press",
    "url": "https://themachinepress.com",
    "description": "A daily newspaper for the age of artificial intelligence."
  },
  "cite_this_report": {
    "title": "The Attacker Spent More Compute Searching the Environment",
    "publisher": "The Machine Press",
    "published_at": "2026-09-07T09:00:00.000-04:00",
    "canonical_url": "https://themachinepress.com/story/mp-2026-09-07-026/the-attacker-spent-more-compute-searching-the-environment"
  }
}