A new study treats prompt injection attacks like a search problem - and the more compute you give the attacker, the more holes it finds.
Researchers built an agentic attacker with a dedicated search harness that scouts the target environment, reasons through possible attack strategies, and adjusts its approach based on feedback from the victim AI agent. Tested across a range of tasks, the attacker's success at finding and exploiting vulnerabilities climbed as it was given more test-time compute to search. Ablation tests showed that without explicit strategy management, the attacker wasted its budget repeating failed approaches instead of discovering new weaknesses, meaning raw compute alone was not enough - the search had to be organized.
The real point here is that how vulnerable an AI agent looks isn't fixed - it depends on how much computational effort an attacker is willing to spend probing it. That undercuts the common practice of testing a system once and declaring it secure, since a better-resourced adversary with a larger search budget can likely find exploits a quick test misses. For any team deploying agents that read untrusted text - emails, web pages, documents - this reframes prompt injection as an ongoing arms race rather than a bug to patch once.
Worth noting: the researchers built both the attacker and the yardstick for success, so how this maps to real-world attacker budgets and real-world defenses is still an open question.