{
  "$schema": "https://themachinepress.com/schemas/story-v1.schema.json",
  "schema_version": "1.0.0",
  "document_type": "machine_press_story",
  "story": {
    "story_id": "mp-2026-11-10-010",
    "source_story_id": "tmp-story-agent-swarm-prompt-injection",
    "edition_id": "mp-2026-11-10-morning-0123",
    "edition_url": "https://themachinepress.com/edition/2026-11-10",
    "position": 10,
    "story_type": "dispatch",
    "section": "safety-security",
    "editorial_classification": "editorial",
    "headline": "The Prompt-Injection Attacker Becomes a Swarm",
    "slug": "the-prompt-injection-attacker-becomes-a-swarm",
    "dek": "Adaptive agentic red teams found tool-output attacks against models that appeared robust on public static benchmarks.",
    "summary": "Adaptive agentic red teams found tool-output attacks against models that appeared robust on public static benchmarks.",
    "body_text": "The study builds a synthetic evaluation in which random benign actions become adversarial goals, separating instruction-hierarchy failures from knowledge of familiar security scenarios. More capable attacker agents iteratively adapt injections placed in tool output. The authors report that these attackers reliably induced models to follow injected instructions even when the models had looked robust on GraySwan Arena. Exact cross-model rates are not stated in the abstract, and the work is an adversarial evaluation rather than evidence of exploitation in deployed systems, but it argues that static human red-team payloads can understate current risk.",
    "why_it_matters": "Adaptive agentic red teams found tool-output attacks against models that appeared robust on public static benchmarks.",
    "limitations": [
      "Exact cross-model rates are not stated in the abstract, and the work is an adversarial evaluation rather than evidence of exploitation in deployed systems, but it argues that static human red-team payloads can understate current risk."
    ],
    "importance": 9,
    "canonical_url": "https://themachinepress.com/story/mp-2026-11-10-010/the-prompt-injection-attacker-becomes-a-swarm",
    "json_url": "https://themachinepress.com/story/mp-2026-11-10-010.json",
    "first_published_at": "2026-11-10T09:00:00.000-05:00",
    "modified_at": "2026-11-10T09:00:00.000-05:00",
    "content_status": "new",
    "is_carryover": false,
    "carryover_reason": null,
    "key_claims": [
      {
        "claim_id": "claim-mp-2026-11-10-010-001",
        "text": "Adaptive agentic red teams found tool-output attacks against models that appeared robust on public static benchmarks.",
        "source_ids": [
          "source-2026-11-10-010"
        ],
        "qualification": "Exact cross-model rates are not stated in the abstract, and the work is an adversarial evaluation rather than evidence of exploitation in deployed systems, but it argues that static human red-team payloads can understate current risk."
      }
    ],
    "source_ids": [
      "source-2026-11-10-010"
    ],
    "tags": [
      "prompt injection",
      "red teaming",
      "agent swarms"
    ],
    "image_url": null,
    "corrections": []
  },
  "sources": [
    {
      "source_id": "source-2026-11-10-010",
      "title": "arXiv preprint 2611.11861, original v1",
      "publisher": "arXiv",
      "url": "https://arxiv.org/abs/2611.11861v1",
      "canonical_url": "https://arxiv.org/abs/2611.11861v1",
      "source_type": "primary_research",
      "is_primary_source": true,
      "published_at": null,
      "accessed_at": "2026-11-10T08:22:17.036-05:00",
      "supports_claim_ids": [
        "claim-mp-2026-11-10-010-001"
      ]
    }
  ],
  "corrections": [],
  "publisher": {
    "name": "The Machine Press",
    "url": "https://themachinepress.com",
    "description": "A daily newspaper for the age of artificial intelligence."
  },
  "cite_this_report": {
    "title": "The Prompt-Injection Attacker Becomes a Swarm",
    "publisher": "The Machine Press",
    "published_at": "2026-11-10T09:00:00.000-05:00",
    "canonical_url": "https://themachinepress.com/story/mp-2026-11-10-010/the-prompt-injection-attacker-becomes-a-swarm"
  }
}