Bottom line: Controlled tests with AI-Infra-Guard show attack success rates of up to 25.5 percent for indirect prompt injection via file channels such as hidden Unicode text on DeepSeek Harness.
A study using the test framework AI-Infra-Guard (A.I.G) shows that DeepSeek Harness (DSH) can be manipulated to a measurable extent via indirect prompt injection. For CISOs deploying agent frameworks with tool access, the work provides concrete attack surfaces and success rates.
Researchers used the tool AI-Infra-Guard (A.I.G) to conduct a total of 14,560 controlled test runs against DeepSeek Harness (DSH). The tests covered 16 indirect content channels, two transmission modes (text and file), 35 payload targets, an unmodified baseline, and 12 attack methods. DSH’s agent loop, tool registry, model adapter, and session event path remained unchanged throughout; source tools and sensitive sinks were simulated as local fixtures, so that attempted actions were logged but executed without external effects.
Evaluation was carried out using two assessment methods: a deterministic rule-based judge (RuleJudge) and a semantic, LLM-based judge (LLMJudge). The highest observed attack success rates were 17.0 percent for a fake-completion attack in text mode (RuleJudge), 25.5 percent for hidden Unicode text in file mode (RuleJudge), and 16.0 percent for the skills channel in file mode (RuleJudge). The LLMJudge also assessed only partial rule compliance considerably more often than the RuleJudge (7.3 percent versus 2.0 percent).
For security leaders operating DeepSeek-based or comparable agent frameworks with tool access in production, the study highlights a real attack surface: even seemingly harmless channels such as file contents, hidden Unicode characters, or tool outputs can be used to induce an agent to take unwanted actions, without needing to manipulate a direct prompt. The authors attribute the observed weaknesses to how DSH handles tool outputs, additional contexts, and the tool-call policy hooks.
The study derives control points that should be placed between untrusted content and security-relevant actions, for example at the interface between tool output and execution decision. The associated code is publicly available in the Tencent AI-Infra-Guard repository, enabling organizations to conduct their own follow-up tests in their respective enterprise context.
Source: arxiv.org · Published August 17, 2026
Lumi AI News — AI-assisted curation pursuant to Art. 50 EU AI Act. Paraphrasing and classification by Lumi News Pipeline v1.8.3.