Ignored, Not Refused: The Truth Behind Low Injection Success Rates in Small Tool Agents

Introduction: Low Attack Success Rate ≠ Safe

In AI safety, a common metric for measuring how well tool-using agents resist indirect prompt injection (IPI) attacks is attack success rate (ASR). However, a recent study audited 33,000 trajectories from 11 open-weight agents (2–14B parameters) on the InjecAgent and AgentDojo benchmarks and found that most failed attacks were ignored by the agents rather than refused. This means a low ASR may mask real security risks in agents.

The study also reveals that merely changing the system prompt can cause InjecAgent's ASR to jump from 0.2% to 43%, and that in 21.7% of AgentDojo tasks the agents remained safe but did not complete the user's task. These findings challenge the reliability of ASR as a safety metric and call for more fine-grained evaluation methods.

Indirect Prompt Injection (IPI) is an attack targeting large language model agents: instead of feeding malicious instructions directly to the model, the attacker hides them in external content the agent may retrieve or access (e.g., web pages, documents, tool return results). When the agent reads this content while processing a task, the malicious instructions may be treated as legitimate input and executed. Compared with traditional direct prompt injection, IPI is stealthier because the attack surface comes from the agent's interaction chain with the external environment rather than from user input itself. In tool-calling agent scenarios, IPI can cause the agent to invoke sensitive tools, leak data, or perform unintended actions, making it one of the core threat models for evaluating agent safety.

Attack Success Rate (ASR) is one of the most commonly used quantitative metrics in AI safety evaluation, typically defined as the proportion of attack samples in which the attacker achieves their goal out of the total attack samples. In prompt injection evaluation, a lower ASR is generally regarded as indicating a safer agent. However, ASR is an aggregate metric: it only cares whether an attack "succeeds" and does not distinguish why it failed. The agent may have actively recognized and refused the malicious instruction, or it may simply not have understood or executed the injected content. This distinction is crucial for understanding an agent's true safety capabilities, because "ignored" failures may mean the agent has developed no defensive awareness at all and is more easily compromised when attack methods change.

Audit Methodology: 33,000 Trajectories and Label-Blind Judging

To investigate the nature of failed attacks, the researchers collected 33,000 trajectories from InjecAgent and AgentDojo, covering 11 open-source agents of different scales. They used a label-blind LLM judge to classify failed attacks, determining whether the agent "ignored" the injected instruction or "refused" to execute it.

The results show that 76–80% of failed attacks were ignored, with only 17–18% being explicit refusals. This indicates that agents often did not realize an injection was present and simply failed to execute the malicious instruction; such passive safety may break down under more complex attacks.

Label-blind LLM judge is an evaluation method that uses a large language model to classify and annotate agent behavior. "Label-blind" means the judge model does not know the experimental group, attack type, or expected outcome when making judgments, to avoid bias introduced by label information. In this study, the judge needed to determine from the trajectories whether a failed attack was "ignored" or "refused." The advantage of this approach is scalability—it can process tens of thousands of trajectories—but it also raises reliability concerns, such as the judge model's own judgment biases and sensitivity to borderline cases. Researchers typically validate judge consistency against a manually annotated subset and release the judge prompts to enhance reproducibility.

The Power of System Prompts: ASR from 0.2% to 43%

With identical model weights, merely modifying the system prompt can cause dramatic changes in InjecAgent's ASR. Under one set of system prompts, ASR was as low as 0.2%, while under another it reached 43%. This highlights the critical role of system prompts in shaping agent safety behavior and implies that ASR is highly dependent on prompt engineering and may not reflect a model's inherent safety.

This finding has cautionary implications for real-world deployment: developers need to design system prompts carefully and recognize that a low ASR may be an illusion created by the prompt.

The ATOM Matrix: Safe but Failing the Task

The study introduces the Attack-Task Outcome Matrix (ATOM), which combines attack outcomes with task completion analysis. In 21.7% of AgentDojo episodes, the agent remained safe (did not execute the injected instruction) but also failed to complete the user's requested task. This "safe but ineffective" state is overlooked in traditional ASR evaluation but directly affects user experience.

The ATOM matrix provides a more comprehensive perspective, helping identify the trade-off between safety and utility in agents.

Task Completion Rate measures whether an agent successfully satisfies the user's original request and is a core metric for evaluating agent utility. In safety evaluation, task completion rate and attack success rate often exist in tension: an agent may achieve a very low ASR by refusing to perform any suspicious operation, but it also refuses legitimate tasks, leading to reduced utility. The ATOM matrix crosses attack outcomes (safe/unsafe) with task outcomes (completed/not completed) to form a four-quadrant analysis, thereby revealing the "safe but ineffective" state that traditional ASR masks. This two-dimensional evaluation framework helps distinguish whether an agent truly possesses robust safety capabilities or is merely "accidentally safe" due to excessive conservatism or insufficient capability.

Implications for Evaluation Practice

Based on these findings, the researchers recommend that evaluations report the specific manner of attack failure (ignored or refused) and whether the user task was completed, rather than just ASR. They released the annotated corpus, judge prompts, and analysis code to promote more transparent safety evaluation.

For the AI safety community, this study underscores the importance of fine-grained evaluation, especially as small-scale agents become increasingly widespread. Only by fully understanding agent behavior can we design systems that are both safe and effective.

One-line Summary

A low attack success rate may mask the safety risk that agents ignore rather than refuse injected instructions.

Paragraph Summary

An audit of 33,000 trajectories from 11 open-weight agents on the InjecAgent and AgentDojo benchmarks found that most failed indirect prompt injection attacks were ignored by agents (76–80%) rather than refused, with only 17–18% being explicit refusals. The study also shows that merely changing the system prompt can cause InjecAgent's ASR to jump from 0.2% to 43%, indicating that ASR is highly dependent on prompt engineering. Furthermore, in 21.7% of AgentDojo tasks, agents remained safe but did not complete the user's task. The researchers propose the ATOM matrix and recommend that evaluations report both the manner of attack failure and task completion, and they released the annotated corpus, judge prompts, and analysis code.