An Exploration of Attacks on AI Agent Systems

Evidence record

Read the original source ↗

Claim-level citations (5)

• supportsRepetition and safety framing bypassed secret and file restrictions in local agent tests: In the ADK hierarchy, the direct secret-disclosure request succeeded in zero of five runs; repeating it up to 15 times succeeded in three of five. These were secret-key disclosures, not the PALChain file-read experiment.

  Sections III-B2 and IV-B2, Table IV, trials 1 and 1.5.

• supportsRepetition and safety framing bypassed secret and file restrictions in local agent tests: In the separate PALChain experiment, safety-framed Query 3 was classified SAFE and read /app/.env in four of five trials. The explicit read-and-send Query 4 was classified INJECTION and succeeded in zero of five.

  Sections III-A4 and IV-A4, Table II, queries 3 and 4.

• supportsAgent Card descriptions biased service selection in A2A experiments: In a 106-task booking simulation the researchers report agent selection shifting sharply when candidate Agent Card descriptions were repeated or made more positive.

  Agent discovery / Agent Card selection experiments and 106 booking tasks.

• supportsAgent Card descriptions biased service selection in A2A experiments: These outcomes reflect selected two-agent experimental setups, not a demonstrated compromise of authenticated production agent registries.

  Experiment design and A2A discovery setting.

• supportsAgent Card descriptions biased service selection in A2A experiments: Section III-B3 describes 106 booking tasks generated with GPT-o3 and an extracted A2A-MCP selection routine. In Section IV-B3, repeated descriptions were preferred on average 89.6% of the time, whereas lengthening the agent name did not have the same effect: the shorter name was preferred 96.70% of the time.

  Sections III-B3 and IV-B3, trials 1 and 2.