提出无需特定查询的代码代理攻击方法，可广泛触发恶意行为。
QueryIPI: Query-agnostic Indirect Prompt Injection on Coding Agents
- 利用系统提示和工具描述的不变性作为攻击载体
- 在模拟代理中实现最高87%的成功率，超越基线50%
- 攻击可迁移至真实代码代理，警示安全风险
现代集成在IDE中的代码代理具备强大工具调用能力和高权限系统访问，构成高风险攻击面。现有间接提示注入（IPI）攻击多依赖特定用户查询作为触发条件，泛化能力差。本文提出查询无关型IPI攻击范式，可在任意用户查询下稳定执行恶意指令。核心思路是让恶意载荷利用不变的提示上下文（如系统提示和工具描述），而非变化的用户输入。我们提出QueryIPI框架，将工具描述作为可优化的载荷，通过基于提示的迭代黑盒优化进行精炼。QueryIPI利用系统不变性生成初始种子，并通过迭代反思机制解决指令遵循失败与安全拒绝问题。在五个模拟代理上的实验表明，QueryIPI成功率最高达87%，优于最佳基线（50%）。关键的是，生成的恶意描述可成功迁移至真实代码代理，凸显实际安全威胁。
原文摘要 · Abstract (English)
Modern coding agents integrated into IDEs orchestrate powerful tools and high-privilege system access, creating a high-stakes attack surface. Prior work on Indirect Prompt Injection (IPI) is mainly query-specific, requiring particular user queries as triggers and leading to poor generalizability. We propose query-agnostic IPI, a new attack paradigm that reliably executes malicious payloads under arbitrary user queries. Our key insight is that malicious payloads should leverage the invariant prompt context (i.e., system prompt and tool descriptions) rather than variant user queries. We present QueryIPI, an automated framework that uses tool descriptions as optimizable payloads and refines them via iterative, prompt-based blackbox optimization. QueryIPI leverages system invariants for initial seed generation aligned with agent conventions, and iterative reflection to resolve instruction-following failures and safety refusals. Experiments on five simulated agents show that QueryIPI achieves up to 87% success rate, outperforming the best baseline (50%). Crucially, generated malicious descriptions transfer to real-world coding agents, highlighting a practical security risk.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。