Bottom line: Controlled tests with AI-Infra-Guard show attack success rates of up to 25.5 percent against DeepSeek Harness for indirect prompt injection via file channels such as hidden Unicode text.
A study using the test framework AI-Infra-Guard (A.I.G) shows that DeepSeek Harness (DSH) can be manipulated to a measurable extent via indirect prompt injection. For CISOs deploying agent frameworks with tool access, the work provides concrete attack surfaces and success rates.
Researchers conducted a total of 14,560 controlled test runs against DeepSeek Harness (DSH) using the tool AI-Infra-Guard (A.I.G). The tests covered 16 indirect content channels, two transmission modes (text and file), 35 payload targets, an unmodified baseline, and 12 attack methods. DSH’s agent loop, tool registry, model adapter, and session event path remained unchanged throughout; source tools and sensitive sinks were simulated as local fixtures, so that attempted actions were logged but executed without external effects.
Evaluation was performed using two assessment methods: a deterministic rule-based judge (RuleJudge) and a semantic, LLM-based judge (LLMJudge). The highest observed attack success rates were 17.0 percent for a fake-completion attack in text mode (RuleJudge), 25.5 percent for hidden Unicode text in file mode (RuleJudge), and 16.0 percent for the skills channel in file mode (RuleJudge). The LLMJudge also rated only-partial rule compliance considerably more often than the RuleJudge (7.3 percent versus 2.0 percent).
For security leaders operating DeepSeek-based or comparable agent frameworks with tool access in production, the study marks a real attack surface: even seemingly harmless channels such as file contents, hidden Unicode characters, or tool results can prompt an agent into unwanted actions, without any need to manipulate a direct prompt. The authors attribute the observed weaknesses to how DSH handles tool results, additional contexts, and the tool-call policy hooks.
From this, the study derives control points that should be placed between untrusted content and security-relevant actions, for example at the interface between tool output and execution decision. The associated code is publicly available in Tencent’s AI-Infra-Guard repository, enabling organizations to conduct their own retesting in their respective enterprise context.
Source: arxiv.org · Published August 17, 2026
Lumi AI News — AI-assisted curation in accordance with Art. 50 EU AI Act. Paraphrasing and classification by Lumi News Pipeline v1.8.3.