Research · curated 16 Sep 2026
Will the User Ever Know? Covert Indirect Prompt Injection Attacks on Tool-Using LLM Agents
First reported arxiv.org
Coverage timeline
Single-source research — first reported, latest, and curated coincide.
Why it matters
ICoA demonstrates that indirect prompt injections can be engineered to leave no trace in an agent's final response, meaning users may never notice malicious tool actions and undermining response-based detection as a defense.
A paper titled "Will the User Ever Know? Covert Indirect Prompt Injection Attacks on Tool-Using LLM Agents" decomposes attack success rate into Covert Success Rate (CSR) and Overt Success Rate (OSR) to measure whether an injected action leaves a trace in the agent's final response. The authors show covert successes hand control back to the user task before ending (exploiting the ReAct format) and propose ICoA (Induced Covert Attack), which steers the agent back to the user task after executing the injection, achieving the highest CSR on AgentDojo across four target models with gains of 3.79-12.01 points over the strongest baseline.