Who Is Your Agent Serving? Provider-Side Indirect Prompt Injection in Proactive Agents

Excerpt

arXiv:2610.05266v1 Announce Type: cross Abstract: Proactive personal agents increasingly decide what to recommend, how to personalize advice, and what follow-up assistance to offer, creating a new user-decision attack surface for provider-side indirect prompt injection. We show that an external provider need not access private user context, compromise the agent, or gain additional permissions: by controlling only content associated with its own target, it can redirect an otherwise benign agent t