The agent trusted the instruction because of where it appeared

The same sentence can be harmless when quoted in a document and consequential when a coding agent reads it as task guidance. That difference is not explained by the words alone. It depends on the source, timing, location and authority the host application assigns to the material. Recent studies separate several of these factors rather than treating all adversarial text as one kind of prompt injection.

An llms.txt-style website manifest is supposed to help a consumer find relevant material. The manifest-assisted retrieval study describes a reduced pilot where attacker-edited manifest material was supplied under different guard conditions. The raw adversarial condition contained 21 attacker-target adoptions in 24 responses, with another response unresolved; the guarded comparison contained no confirmed adoptions. The test did not involve live browsing or subsequent tool actions. A separate evidence audit found little support for widespread automatic llms.txt consumption, so this result measures susceptibility when the material is supplied, not how often real search products encounter it.

The Poisoned Skills paper inserted a jailbreak into a Markdown skill consumed during agent initialization. Across the tested open-weight models and 270 forbidden prompts, mean harmful completion increased from 0.5 percent in the benign setup to 45 percent with the injected skill. This measures model responses in a selected LangChain harness, not exfiltration, command execution or the real-world infection rate of skill repositories. It nonetheless exposes a particular trust transition: a file labeled as reusable capability guidance may be treated like a high-priority instruction even when its author is not the user.

Coding-agent memory files such as CLAUDE.md and task notes also influence execution. The memory-file research reports secure-completion differences ranging from eight percentage points worse to six points better under its tested settings, with no consistent pattern across agents. That mixed result still establishes that persistent project guidance can change a security outcome. A separate placement study found that putting adversarial text in different repository locations can change whether it is followed. Neither study justifies turning a result from one model, path or prompt into a general success probability. Their contribution is to isolate the influence of placement and perceived authority from the attacker's literal wording.

Another route arrives during the task, after the user has already asked a legitimate question. In a Mini-Agent issue, a manipulated weather MCP response prompted one locally tested Qwen model to invoke a shell tool and write a benign test file, while another tested model refused. Here the action was not an answer-contamination score: a tool result was promoted into permission for an operating-system effect. The host's lack of an independent execution gate mattered as much as the model's interpretation.

A defense that filters a manifest but loads arbitrary local skills misses one entry path. A scanner that labels repository text untrusted but permits the resulting agent to run shell commands without authorization misses a different boundary. Source provenance should travel with the content through retrieval and compaction, while effects such as host commands and writes require independent permission. That is a more meaningful acceptance test than averaging incompatible benchmark success rates.