Research · curated 7 Sep 2026
The Framing Gap: Indirect Prompt-Injection Exfiltration Defeats Surface-Level Defenses in Tool-Using Agents
First reported arxiv.org
Coverage timeline
Single-source research — first reported, latest, and curated coincide.
Why it matters
The Framing Gap research demonstrates that surface-level and alignment-based defenses against indirect prompt injection in agents are brittle, and only architectural controls (destination allow-lists, capability isolation) reliably prevent secret exfiltration.
A study titled 'The Framing Gap' shows that tool-using LLM agents holding a secret refuse overt indirect prompt-injection exfiltration attempts (gpt-4o 0%) but leak the secret up to 100% when the same request is reframed as a mandatory integrity signature, config field, or trusted look-alike host. Across six models the authors find the reusable attack asset is the template rather than the mechanism, and that robustness comes from payload-blind defenses (destination allow-lists, capability-isolating planner/reader splits) rather than the acting model recognizing the attack; fine-tuning defenses like SecAlign, channel separation, and output-normalizing guards all fail.