A code agent may read a repository README, a TODO note or a task-specific instruction document in a different order or context. The study tests attacker control over placement as well as text, showing that success is not solely a property of the payload words. The findings suggest that source position, retrieval timing and perceived instruction authority…
Inspect the ClaimsCase · DiggingBeagle record
Prompt-injection success changed with the placement of attacker text in agent files
The trust-region study reports that placing the same adversarial instruction in different repository or workflow locations changes how often a tested AI agent follows it.
Scope
Controlled testbeds, selected agents and payloads; no field incident rates or guarantees that the same placement works in other deployments.
Assessment profile
Assessment method- Setting
- evaluation
- Exploitation
- demonstrated
- Evidence
- Grade C
- Remediation
- mitigation available
- AI role
- AGAINST AI
Basis and provenance
Controlled repository-agent experiments attribute different injection outcomes to the position of otherwise comparable adversarial text. This supports a retrieval/trust placement effect, not a field attack estimate. Impact remains unrated because the evidence does not supply a calibrated scale for this Case.
Assessed Nov 1, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-2026-NOV01-PROMPT-PLACEMENT-TRUST-1 · Where You Inject Matters: prompt-injection location and success
At a glance
Assess the reported tool or model action separately from the side effect actually observed.
Read the implicationsControlled testbeds, selected agents and payloads; no field incident rates or guarantees that the same placement works in other deployments.
Limits and uncertaintyFull account
A code agent may read a repository README, a TODO note or a task-specific instruction document in a different order or context. The study tests attacker control over placement as well as text, showing that success is not solely a property of the payload words. The findings suggest that source position, retrieval timing and perceived instruction authority influence the agent, but the reported effect is confined to experimental agents and workloads.
Mechanism and trust boundary
- 01
Step
Claims & evidence
CLM-2026-NOV01-PROMPT-PLACEMENT-TRUST-1The trust-region study reports that placing the same adversarial instruction in different repository or workflow locations changes how often a tested AI agent follows it.supported
Basis: reported finding
- supportsWhere You Inject Matters: prompt-injection location and successprimary disclosure
arXiv 2610.38867, Abstract, Multi-Surface Agentic Testbeds, placement experiments and limitations
Implications
Assess the reported tool or model action separately from the side effect actually observed.
Controls and mitigations
- Use source-based trust boundaries independent of file path or formatting; treat repository comments and task notes as data when they originate outside the authorized instruction owner.
Unknowns and contradictions
- Controlled testbeds, selected agents and payloads; no field incident rates or guarantees that the same placement works in other deployments.
Sources and citation
Material revision history
- Nov 1, 2026 · Canonical change recorded · new in release · revision 211