Research
A web page talked our agent into leaking a stranger's data. Here's how we caught it. - Arize AI
First reported · Discovered arize.com
Page published
Earliest dated coverage: 26 Oct 2026 · First observed: 5 Nov 2026 · Latest dated coverage: 26 Oct 2026
Coverage timeline
Single-source research — one report is available.
Why it matters
Arize's experiment demonstrates why agents need code-enforced authorization at tool boundaries: model refusals alone did not prevent indirect prompt injections from triggering cross-account disclosures.
Arize tested a customer-support agent against 100 order pages containing indirect prompt injections, causing it to expose another customer's address and orders in 28 runs. Enforcing session-scoped authorization on customer tools blocked all unauthorized data returns in a follow-up 100-run test, despite 20 attempted cross-account lookups.