Skip to main content
LLM Security Database
Skip to research details
Back to research findings
LMVD-ID: f0174a73
Paper published July 21, 2026
Entry analyzed September 9, 2026
Paper-reported evidence
Confidence: Source-linked

The LMVD-ID is an internal research identifier, not an official CVE identifier.

Prompt injection across agent privilege boundaries

Untrusted issue descriptions and tool responses can redirect privileged coding and tool agents. Twin Agent separates exploration from execution and restricts the information exchanged between them.

Application layer
Prompt layer
Injection
AI agents
Coding agents
Chains & workflows
Integrity
Safety
Read primary paperBibTeX citation

Paper-evaluated models(3)

  • GPT-5.2
  • Gemini 2.5 Flash
  • Gemini 3.5 Flash

Description

Untrusted issue descriptions and tool responses can redirect privileged coding and tool agents. Twin Agent separates exploration from execution and restricts the information exchanged between them.

Examples

See the primary evaluation (opens in a new tab); this entry omits attack payloads.

Impact

The authors report GPT-5.2 attack success falling from 97.0% to 0.0% on static SWE-bench-injected cases, with utility increasing from 61.2% to 62.5%. Adaptive evaluation still succeeds in 11/232 cases (4.7%). These benchmark results provide no formal guarantee.

Affected Systems

  • SWE-agent, AgentDojo and DecodingTrust-Agent configurations evaluated in the paper.

Mitigation Steps

  • Separate untrusted-content processing from privileged execution.
  • Bound and screen messages crossing that boundary.
  • Check consequential actions against trusted intent; evaluate adaptive attacks and benign utility together.

Evidence

Research context and confidence

Evidence and verification
Paper-reported; independent reproduction is not documented.
Primary source plus a dedicated evidence section.
Severity
Not rated by this catalog.
Source and publication type
arXiv · Research preprint.
Peer-review status is not provided by this source.
Author and publication status
Author metadata is not stored; see the primary paper.
Threat model and attacker access
Ability to influence untrusted model inputs or connected content.
Related deployment categories
Agent workflows; Coding agents
Taxonomy labels only; paper-specific deployment prerequisites are not inferred.
Affected systems
SWE-agent, AgentDojo and DecodingTrust-Agent configurations evaluated in the paper.

Research Paper

Twin Agent: Context Residual Compression for Privilege Separated Agents

Primary source: arXiv. Findings are reported by the cited research and have not been independently verified.

View Paper

Related research