A new fine-tuning method drops the success rate of adaptive prompt injection attacks on AI agents from 94% to 9%.
Researchers built Secure On-Policy Distillation (SecOPD), a defensive training technique that scores individual output tokens rather than judging an entire response as good or bad. Prior methods like DPO and GRPO grade whole outputs, which blurs which specific tokens actually caused a security failure. SecOPD instead feeds an injected prompt to the model, then scores its response token-by-token against what the same model would have produced on the clean, uninjected version. Applied to Qwen3.6-27B, this brought the attack success rate against the PISmith adaptive injection benchmark down to 9.0%, compared to 94.0% for Meta-SecAlign, the previous best defense. The security held up even in agentic tool-calling scenarios never seen during training, where SecOPD hit a 4.7% attack success rate versus 5.5% for Meta-SecAlign.
Prompt injection remains the top-ranked threat to AI agents precisely because it does not require breaching any system. An attacker just needs an agent to read a poisoned webpage, file, or email. A defense that drops success rates by an order of magnitude, and holds up on unfamiliar tasks, is a meaningfully different result than the incremental patches this field has produced so far.
The code and model are open-source, which means the claims are checkable rather than just asserted. Given how many "secure" agent releases have folded the moment someone tried harder, that's the test that matters.