How do adversarial environments mislead AI agents?

Researchers formalize the scenario in which tool outputs are tampered with to deceive AI agents as adversarial environment injection (AEI), and use the MCP-compatible POTEMKIN framework for plug-and-play robustness testing. The framework sets up two types of attack surfaces: Illusion, which contaminates retrieval results so that agents form false beliefs, and Maze, which uses structural traps to drive policies into infinite loops. The study completed more than 11,000 runs on five frontier agents and found that increased resistance to one type of attack is often accompanied by increased vulnerability to the other, on which basis the authors argue that cognitive robustness and navigational robustness are distinct capabilities.