Attacks That Score, Attacks That Transfer: Guardrail Asymmetry, the Confused Deputy, and Hidden-Evaluator Reconstruction in a Multi-Step Tool-Agent Security Benchmark by Uchechukwu Ajuzieogu :: SSRN

A monograph by Uchechukwu Ajuzieogu forensically reconstructs the 2026 Kaggle AI Agent Security — Multi-Step Tool Attacks competition, where 4,252 teams built multi-step prompt-injection attacks against a tool-using LLM agent. It documents four attack predicates (data exfiltration, destructive write, unauthorized-to-allowed, confused deputy), reverse-engineers both public and hidden guardrails, and shows that attack transfer to the private evaluator was a property of attack family — confused-deputy attacks transferred near 1:1 while marker-carrying exfiltration attacks were reliably blocked by a persistent-provenance policy.