Skip to content
DSML.KZ
Publications

Article · Technologies · November 1, 2026

Evidence-Linked Measurement of Indirect Prompt Injection in Web Security Agents: Paired Trials and Application-Specific Evidence Audits

Yenlik Begimbayeva, Aida Mukazhanova, Gulzada Mussapirova, Azhar Analiyeva, Gulnar Mamatova, Нуржигит Смайлов

Nurzhamal Kashkimbayeva
Open via DOI

Abstract

Indirect prompt injection can redirect web security agents, yet an omitted check alone cannot establish attacker influence. We evaluate an application-specific contract integrating exposure chronology, HTTP evidence provenance, application-state verification, and report fidelity. Matched placebo comparisons and controlled analyses examine background failure, verification error, and stopping. Across 420 Qwen3/HarborDesk executions, two payloads yielded six-check placebo-minus-attack losses of 15.28 and 12.50 percentage points. Secondary three-target losses were 10.56, 16.67, and 6.11 points; target coverage under attack matched or exceeded untreated S0. Conditional goal analysis retained only 13 of 60 baseline blocks per payload, limiting precision and generalizability. A 560-session Gemini/GPT-OSS experiment yielded a mean loss of 1.32 points (95% block-bootstrap interval 0.97–1.67), entirely from 19 GPT-OSS/A2 pairs losing C4. After interface correction, 120 stable-tool sessions on independently developed OWASP crAPI confirmed every authorized action, giving zero observed differences across 60 pairs. Strong and simple evaluators agreed on unchanged traces; designed faults differentiated rejection behavior without establishing natural-trace accuracy superiority. The contribution is the operational integration and reproducible testing of this evidence chain using established outcome measures.

Web Application Security VulnerabilitiesNetwork Security and Intrusion DetectionInformation and Cyber Securityindirect prompt injectionprompt injectionLLM security

More by Nurzhamal Kashkimbayeva