[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-ai-agents-can-reassemble-injection-attacks-from-fragments":10,"sections":41},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":30,"tags":31,"sources":36,"feedback":40,"feedback_at":22,"cost_usd":40,"total_tokens":40},8477,"ai-agents-can-reassemble-injection-attacks-from-fragments","AI Agents Can Reassemble Injection Attacks From Fragments","A preprint details AdaLCPI, an attack that hides prompt injections in scattered fragments AI agents piece back together, boosting success rates to 61.4%.","AI agents can be fooled into piecing together an attack they were never shown in full.\n\nA preprint titled \"Divide and Inject: Can Agents Reconstruct an Indirect Prompt Injection from Fragments?\" (arXiv:2609.36576) describes a technique called AdaLCPI, short for adaptive long-context prompt injection. Instead of hiding one complete malicious instruction in a document an agent might retrieve, the method splits the instruction into incomplete pieces, scatters them across the content an agent pulls in through its tools, and adds a cue that nudges the agent to stitch the pieces back into a working command. The fragments and cue are then refined automatically using a tool called OpenEvolve, which scores attempts and folds in feedback from how the target agent actually responds. In tests, the authors report the method succeeded 61.4 percent of the time on average, well ahead of two existing attack methods that scored 32.8 percent and 30.0 percent.\n\nThat gap matters because most defenses against prompt injection look for one suspicious instruction sitting in retrieved text. An attack that never puts the full instruction in one place slips past that kind of filter, and it works precisely because agents are good at synthesizing scattered information, the same skill that makes them useful in the first place.\n\nThe paper is a preprint and has not been peer reviewed, and its numbers come from the authors' own test setup rather than an independent audit, so how well this holds up against production agents with layered defenses is still an open question.","[\"prompt-injection\",\"ai-agents\",\"ai-security\",\"llm-safety\"]","2026-09-30T04:00:00.000Z","2026-09-30T06:09:42.921Z","2026-09-30T06:09:49.577Z","published",null,[24],{"id":25,"reviewer":26,"round":27,"reason":28,"status":29},"editor-r1","editor",1,"Attribute the findings to the specific paper — add the arXiv identifier\u002Ftitle ('Divide and Inject: Can Agents Reconstruct an Indirect Prompt Injection from Fragments?', arXiv:2609.36576) and note it's a preprint, since 'researchers' alone isn't enough for readers to verify the claims.","resolved","security",[32,33,34,35],"prompt-injection","ai-agents","ai-security","llm-safety",[37],{"name":38,"url":39},"arXiv cs.AI","https:\u002F\u002Farxiv.org\u002Fabs\u002F2609.36576",0,{"sections":42},[43,47,50,54,59,64,69,74,79,84,89,94,99,104],{"name":44,"slug":45,"count":46,"latest_published_at":18},"AI","ai",5028,{"name":48,"slug":30,"count":49,"latest_published_at":18},"Security",780,{"name":51,"slug":52,"count":53,"latest_published_at":18},"Policy","policy",417,{"name":55,"slug":56,"count":57,"latest_published_at":58},"Deals","deals",284,"2026-09-29T21:00:00.000Z",{"name":60,"slug":61,"count":62,"latest_published_at":63},"Hardware","hardware",194,"2026-09-29T13:16:04.000Z",{"name":65,"slug":66,"count":67,"latest_published_at":68},"Science","science",154,"2026-09-28T13:19:18.000Z",{"name":70,"slug":71,"count":72,"latest_published_at":73},"Consumer Tech","consumer-tech",142,"2026-09-29T18:38:03.000Z",{"name":75,"slug":76,"count":77,"latest_published_at":78},"Software","software",91,"2026-09-25T20:55:00.000Z",{"name":80,"slug":81,"count":82,"latest_published_at":83},"Dev Tools","dev-tools",89,"2026-09-29T17:15:00.000Z",{"name":85,"slug":86,"count":87,"latest_published_at":88},"Startups","startups",83,"2026-09-29T21:51:36.000Z",{"name":90,"slug":91,"count":92,"latest_published_at":93},"General","general",49,"2026-09-28T16:44:57.000Z",{"name":95,"slug":96,"count":97,"latest_published_at":98},"Gaming","gaming",48,"2026-09-25T18:35:21.000Z",{"name":100,"slug":101,"count":102,"latest_published_at":103},"Reviews","reviews",31,"2026-09-28T14:31:34.000Z",{"name":105,"slug":106,"count":107,"latest_published_at":108},"How-To","how-to",6,"2026-06-16T09:00:00.000Z"]