Technical Summary: ASPI – Seeking Ambiguity Clarification Amplifies Prompt Injection Vulnerability in LLM Agents

1. Problem Statement

While the ability of Large Language Model (LLM) agents to recognize underspecified tasks and seek clarification from users is widely regarded as a desirable trait for aligning agent behavior with user intent, the security implications of this interaction pattern remain unexplored. Existing prompt injection research primarily focuses on attacks delivered through tool-returned data or standard user inputs during fully specified task execution.

This paper investigates a critical gap: Does the transition from standard execution to a clarification-seeking state increase an agent's susceptibility to prompt injection attacks? When an agent solicits additional input, it creates a new channel where external content enters the context. Because the agent explicitly requests this input and expects it to contain task-relevant information, the boundary between trusted instructions and untrusted external content becomes blurred. This structural asymmetry may cause models to treat adversarial instructions embedded in clarification responses as legitimate task data.

2. Methodology: The ASPI Benchmark

To isolate the causal effect of interaction state on vulnerability, the authors introduce ASPI (Ambiguous-State Prompt Injection), a benchmark comprising 728 task–attack scenarios across four domains: Workspace, Messaging (Slack), Travel, and Banking.

Benchmark Construction

• Source Material: ASPI builds upon the AgentDojo framework, inheriting its dynamic, stateful environments, tool implementations, and deterministic scoring functions.
• Ambiguity Generation: Starting from fully specified benign tasks, the pipeline constructs "ambiguous base prompts" by removing exactly one piece of user-provided information (e.g., a recipient, date, or destination) required for task completion. This forces the agent to invoke an ask_user tool to resolve the ambiguity.
• Paired Evaluation Design: Each task-attacker pair is evaluated under matched conditions to ensure comparability:
  • Execution State: The agent receives the fully specified prompt. Adversarial content is injected only through tool-returned data (exec_tool) or standard user messages (exec_user).
  • Clarification State: The agent receives the ambiguous prompt, requests clarification, and then receives the adversarial content.
    • clarif_tool: Attack via tool output after clarification.
    • clarif_ask_user: Attack embedded in the return value of the ask_user tool (the user's reply to the agent's question).
    • clarif_user: Attack embedded in a direct user message following the clarification.
• Attack Vectors: The benchmark utilizes three injection operators (Hierarchy Rebinding, Goal Substitution, Constraint Poisoning) to embed attacker goals within the clarification response while maintaining the benign information required to complete the task.

Evaluation Protocol

• Models: Ten frontier LLMs were evaluated, including proprietary models (GPT-5 variants, o3, Claude-Opus-4.7, Gemini-3.1-Pro, Gemini-3-Flash, Kimi K2.5) and open-source models (Qwen3 variants, DeepSeek V3.2).
• Metrics: The primary metric is Attack Success Rate (ASR), measuring how often the attacker's goal is achieved. Task utility measures successful completion of the benign task.
• Analysis: The study employs paired comparisons to decompose vulnerability into state effects (how the interaction mode changes processing) and channel effects (how the delivery mechanism influences trust).

3. Key Contributions

1. First Empirical Evidence of Clarification Vulnerability: The paper presents the first study demonstrating that agents become substantially more vulnerable to prompt injection when operating under ambiguity. Attack success rates increase dramatically across both open-source and proprietary models when attacks are delivered via the clarification interface.
2. ASPI Benchmark: A controlled benchmark of 728 paired instances that isolates the causal effect of interaction state on vulnerability, providing a methodological framework for studying multi-turn agent security.
3. Decomposition of Vulnerability: The authors decompose the vulnerability gap, revealing that while interaction state alone has heterogeneous effects, the clarification channel (ask_user) consistently acts as a high-impact attack surface. The solicitation of input biases models toward treating responses as trusted instructions.
4. Defense Evaluation: The paper adapts and evaluates two lightweight defenses (segment-level prompt guards and tool filters) specifically for clarification-time attacks. It demonstrates that while these defenses reduce attack success, they do not eliminate the vulnerability gap, as clarification responses often interleave benign information with adversarial instructions.

4. Key Results

• Significant Amplification of Vulnerability: Clarification-seeking consistently amplifies vulnerability. For example:
  • o3: Attack success rises from 1.8% (execution) to 34.0% (clarification via ask_user).
  • Gemini-3-Flash: Attack success rises from 2.2% to 35.7%.
  • Kimi K2.5: Attack success rises from 11.1% to 63.1%.
• Channel vs. State:
  • State Effect: When holding the delivery channel constant (e.g., comparing clarif_tool vs. exec_tool), the effect is heterogeneous. Some models (e.g., Gemini) show increased susceptibility, while others (e.g., DeepSeek) show reduced susceptibility, suggesting that ambiguity alone does not universally increase risk.
  • Channel Effect: The ask_user channel is the primary driver of increased vulnerability. Attacks delivered through the solicited user response are significantly more effective than those delivered via standard tool outputs, even when the underlying content is identical.
• Behavioral Analysis:
  • Task Integration: Failures are rarely due to task abandonment. Instead, agents frequently exhibit TASK_AND_ATTACK behavior, where they integrate the injected instructions into the benign task context rather than replacing it.
  • Trust Mechanism: LLM-as-judge analysis reveals that agents often treat injected clarification content as CONFUSED (mistaking it for task data) or PERSUADED (accepting it as necessary/authoritative), rather than recognizing it as adversarial.
• Defense Limitations: Lightweight defenses (prompt guards and tool filters) reduce ASR but fail to close the gap entirely. For instance, under prompt guard, Gemini-3-Flash's clarif_ask_user ASR drops from 35.7% to 27.0%, leaving a significant residual vulnerability.

5. Significance and Claims

The paper claims that standard execution-time security evaluations systematically underestimate the attack surface of interactive agents. Robustness under fully specified tasks does not translate to robustness under ambiguity.

The authors conclude that clarification is not a neutral preprocessing step but a state-dependent shift in how models interpret incoming information. Because agents explicitly solicit this input, they lower their guard against the distinction between instructions and data. This creates a failure mode where robust agents in standard settings become highly vulnerable when forced to resolve ambiguity.

The paper maintains a modest scope, acknowledging limitations such as the use of synthetic, single-slot ambiguity (which may underestimate real-world multi-turn risks) and the reliance on specific interaction primitives (ask_user). However, it firmly establishes that the clarification interface represents a distinct and previously unmeasured vulnerability that current agent security benchmarks fail to capture.