DeepMind paper says agent swarm breached the tested models

1. 17:01
   X@themerklehash· Discussion

   🚨 DeepMind’s agent swarm hijacks Kimi K3, GLM-5.3 & DeepSeek in ~99% of prompt injection tests. Full story read : http…(opens the original post in a new tab)
2. 16:57
   The MerkleSelected

   DeepMind paper: agent cluster breaks about 99% of scenarios for Kimi K3 and two other models under the full budget

   A Google DeepMind paper dated November 9 proposes a multi-agent attacker called Agentic Optimizer, which uses 8 two-person squads collaborating through a shared whiteboard to search for injection payloads, causing Kimi K3, GLM-5.3 and DeepSeek V4.1 Flash to block only 1% of attacks under a 320-query budget. The test includes 100 synthetic scenarios and 249 tools; the attack goal is to make the agent execute a tool call unrelated to the user's task but harmless in itself, and it counts as a success only if the tool name, parameter keys and values match exactly. The strongest defender, Gemini 4 Argon, blocked 87% when the attacker had 150 queries, dropping to 66% when the budget rose to 320; Gemini 3.8 Flash dropped from 34% to 10%. Under 80 AgentDojo scenarios and a 25-query budget, the cluster broke 6, compared with 2 for the previous best open-source attacker, Prompt Siren.

1. 09:14
   X@neuralloot· Discussion

   Paper: "Scaling Adaptive Prompt Injection Attacks with Agent Swarms" by Alexey Kurakin, Vishal Karande, Alex Bie, Chong…(opens the original post in a new tab)
2. 09:14
   X@neuralloot· Discussion

   Gemini 4 Argon, the toughest model in a new Google DeepMind test, still got tricked on 34 of 100 tasks when a swarm of…(opens the original post in a new tab)

1. 12:34
   arXiv: Jailbreaks, Prompt Injection, Poisoning & Defenses

   Scaling adaptive prompt injection attacks with agent collectives

   Researchers propose scaling adaptive prompt injection attacks with agent swarms; their new evaluation shows that more capable agent attackers can reliably induce models to follow instructions in tool outputs, including models considered robust on public prompt injection benchmarks such as GraySwan Arena. The paper designs a synthetic evaluation dataset using random non-malicious actions as adversarial targets, measuring prompt injection robustness as a model's ability to follow the instruction hierarchy and distinguishing it from the model's knowledge of security practices. The paper notes that earlier research targeting simple tool-calling agents and static attack payloads has become saturated since mid-2025, and that human red teaming may also approach saturation by fall 2026, especially on Gemini-series models. The authors accordingly argue that prompt injection attacks remain feasible and that current frontier defenses may require proactive automated red teaming to cope with increasingly capable attackers.

Current attention 45·Peak in the comparable period 47 (Nov 12 19:00)·Change over the comparable past 24 hours +25%