Alexey Kurakin

After prompt injection attacks neared saturation on public benchmarks, an optimizer that runs a swarm of collaborating agents to search for attack payloads pushed success back up. The study built 100 synthetic tool-use scenarios whose attack goal is a random tool call unrelated to the user task; against the strongest attacker, Gemini 4 Argon, the most robust defender, Gemini 4 Argon, resisted only 66% of attacks at the full query budget and 87% at 150 queries.

After prompt injection attacks neared saturation on public benchmarks, an optimizer that runs a swarm of collaborating agents to search for attack payloads pushed success back up. The study built 100 synthetic tool-use scenarios whose attack goal is a random tool call unrelated to the user task; against the strongest attacker, Gemini 4 Argon, the most robust defender, Gemini 4 Argon, resisted only 66% of attacks at the full query budget and 87% at 150 queries.