DeepMind Paper Shows Prompt Injection Remains Unsolved Against AI Agent Swarms
A new Google DeepMind paper introduces Agentic Optimizer, a swarm of eight AI agent teams that share notes and build on each other's injection attempts, breaking the best-defended Gemini 4 Argon on 34% of 100 tool-use tasks. Open-weight models Kimi K3, GLM-5.3 and DeepSeek-V4.1-Flash resisted only 1% of tasks, showing that the near-failure of human red-teaming does not mean prompt injection is solved.
Related Entities
Full Report
Rohan Paul (@rohanpaul_ai) · 2026-11-13 14
New Google DeepMind paper shows prompt injection is not solved, since a swarm of strong AI attacker agents still tricks even the best-defended models.
Prompt injection means hiding instructions in data an AI agent reads, like a tool result, to make it act for the attacker. Human red-teaming attacks now almost never work on recent Gemini models, so the problem can look solved.
They built Agentic Optimizer, 8 teams of AI agents that test injections, share notes, and build on each other's best attempts. They tested it on 100 tool-use tasks where the attacker only wanted one random, harmless tool call.
With up to 320 tries, the strongest attacker beat Gemini 4 Argon, the most robust model, on 34% of tasks. Open-weight Kimi K3, GLM-5.3, and DeepSeek-V4.1-Flash resisted only 1% of tasks.
