腾讯用 A.I.G 把 DeepSeek Harness 翻来覆去测了 1.4 万多次，隐藏 Unicode 攻击成功率能到 25.5%。想自查提示注入的可以看看这个框架。
Tencent 发布论文，用 AI-Infra-Guard（A.I.G）对 DeepSeek Harness（DSH）进行间接提示注入评估。实验包含 14,560 次受控执行，覆盖 16 个间接内容渠道、35 个载荷目标和 12 种攻击方法。最强攻击成功率在文本模式下为 17.0%（伪造完成攻击，LLMJudge 判定），文件模式下隐藏 Unicode 攻击达 25.5%（RuleJudge 判定），技能渠道为 16.0%。研究还对比了 RuleJudge 与 LLMJudge 的判定差异，并给出了缓解建议。代码已开源。
Security Assessment of DeepSeek Harness with A.I.G: Evaluating Resistance to Indirect Prompt Injection
We assess indirect prompt injection in DeepSeek Harness (DSH), using AI-Infra-Guard (A.I.G) to construct tests, deliver controlled taint, execute DSH, collect traces, and judge outcomes. The study covers 14,560 controlled executions over 16 indirect-content channels, text and file carrier modes, 35 payload objectives, one unmodified baseline, and 12 attack methods. The experiment preserves DSH's agent loop, tool registry, model adapter, and session-event path; source tools and sensitive sinks are local fixtures, so attempted actions are recorded without external side effects. We evaluate each trace with a deterministic rule-based judge, \JudgeR{} (RuleJudge), and a semantic LLM-based judge, \JudgeL{} (LLMJudge). The strongest observed attack success rates are 17.0% under \JudgeL{} for fake-completion attack in text mode, 25.5% under \JudgeR{} for hidden Unicode in file mode, and 16.0% under \JudgeR{} for the skills channel in file mode. \JudgeL{} also assigns partial compliance more often than \JudgeR{} (7.3% versus 2.0%). We relate these results to DSH's treatment of tool results, additional contexts, and tool-call policy hooks, then identify controls that should sit between untrusted content and sensitive actions. Our code is available at https://github.com/Tencent/AI-Infra-Guard.