MetaPI 把智能体基准测试改造成提示注入攻击任务
写智能体的朋友注意：这个叫 MetaPI 的方法能直接在你现有的 AppWorld 或 Terminal-Bench 环境里自动生成注入攻击测试，不用另搭评估。数据也很扎眼，gpt-5.6-luna 这类闭源模型攻击成功率还在 20% 以上，做 agent 安全评估的团队应该跑一遍。
MetaPI 是一套自动生成提示注入攻击的流水线：它复用现有基准环境，定位可注入文本的位置，生成攻击目标，优化自适应载荷，并在真实环境中逐条验证攻击效果。研究团队在 AppWorld、VitaBench 和 Terminal-Bench 三个基准上运行了这套方法。
结果显示，gpt-5.6-luna 和 claude-sonnet-5 等闭源模型表现最稳健，但攻击成功率仍超过 20%。防御方面，CaMeL 能大幅降低攻击成功，但代价是严重的功能损失；DataSentinel 保持了模型效用，攻击削减幅度却有限。
这项工作的实际价值在于复用性：如果你已经用某个效用基准评估智能体，可以直接在同一环境内补充注入攻击测试，无需另建评估体系。
Nice paper on turning agent benchmarks into injection tasks.
MetaPI takes an existing benchmark, finds plausible places to inject text, generates attack goals, optimizes adaptive payloads, and checks each attack in the real environment. They applied it to AppWorld, VitaBench, and Terminal-Bench.
Closed models such as gpt-5.6-luna and claude-sonnet-5 were the most robust victims, but still had attack success rates above 20%. DataSentinel kept utility but reduced attacks less, while CaMeL reduced attacks at a large utility cost.
If you already evaluate your agent on a utility benchmark, it's worth running injection attacks inside that same environment.
https://t.co/lOpAfpiLfC
Chat with Paper: https://t.co/pryJi9kLed
This report is categorized under AITOP's "Papers" desk, focusing on US frontier AI labs and Silicon Valley technology leaders. Within our cross-regional analytical framework, it directly maps to AI developer toolchains, coding agents, and engineering workflows and US-China foundation model benchmarks and commercialization comparison. Key entities and technical topics under continuous tracking include MetaPI, prompt injection, agents, AppWorld.
Source attribution: curated from DAIR.AI (@dair_ai).
