← Back to Library

QueryIPI: Query-agnostic Indirect Prompt Injection on Coding Agents

Authors: Yuchong Xie, Zesen Liu, Mingyu Luo, Zhixiang Zhang, Kaikai Zhang, Yuanyuan Yuan, Zongjie Li, Ping Chen, Shuai Wang, Dongdong She

Published: 2025-10-27

arXiv ID: 2510.23675v3

Added to Library: 2026-01-15 03:01 UTC

Red Teaming

📄 Abstract

Modern coding agents integrated into IDEs orchestrate powerful tools and high-privilege system access, creating a high-stakes attack surface. Prior work on Indirect Prompt Injection (IPI) is mainly query-specific, requiring particular user queries as triggers and leading to poor generalizability. We propose query-agnostic IPI, a new attack paradigm that reliably executes malicious payloads under arbitrary user queries. Our key insight is that malicious payloads should leverage the invariant prompt context (i.e., system prompt and tool descriptions) rather than variant user queries. We present QueryIPI, an automated framework that uses tool descriptions as optimizable payloads and refines them via iterative, prompt-based blackbox optimization. QueryIPI leverages system invariants for initial seed generation aligned with agent conventions, and iterative reflection to resolve instruction-following failures and safety refusals. Experiments on five simulated agents show that QueryIPI achieves up to 87% success rate, outperforming the best baseline (50%). Crucially, generated malicious descriptions transfer to real-world coding agents, highlighting a practical security risk.

🔍 Key Points

  • Introduction of Query-agnostic Indirect Prompt Injection (IPI) as a more universal attack method on coding agents, overcoming the limitations of existing query-specific methods.
  • Development of QueryIPI, an automated framework that leverages system prompts and tool descriptions to create effective malicious payloads under arbitrary user queries.
  • Empirical evidence showing that QueryIPI achieves an average success rate of 87% across simulated coding agents, significantly outperforming existing baseline methods.
  • Demonstration of the transferability of the attack from simulated environments to real-world coding agents, indicating a practical security risk.
  • Identification of internal prompts as system invariants that guide the generation of malicious payloads, highlighting the importance of understanding the underlying structure of coding agent prompts.

💡 Why This Paper Matters

The paper presents a significant advancement in the security landscape of coding agents by introducing QueryIPI, a method that can launch effective attacks regardless of user queries. This not only underscores vulnerabilities in AI systems but also paves the way for necessitated security measures focusing on prompt design and agent behavior robustness.

🎯 Why It's Interesting for AI Security Researchers

This paper is crucial for AI security researchers as it reveals a novel and effective attack technique that exploits existing vulnerabilities in coding agents, emphasizing the need for improved defenses against indirect prompt injection attacks. Furthermore, it sheds light on the significance of internal prompts in shaping agent behavior and security, thus providing insights into areas requiring further research and mitigation strategies.

📚 Read the Full Paper