Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
How Often Do AI Agents Follow Injected Instructions?
Instructions hidden in images got browser-use agents to follow them in up to 100% of tests, and poisoned tool descriptions worked nearly every time. Attacks tuned to each defense got past most of 12 published defenses, and only 1 of 16 AI agent products publishes an injection rate at all.
Often, and most effectively through what the agent sees. Across 16 studies and vendor reports, instructions hidden in images got browser-use agents to follow them in up to 100% of tests on some platforms (Cao et al., 2026), and poisoned tool descriptions worked nearly every time in six high-risk scenarios (Liu et al., 2026). Defenses lower the rate on the tests they were built for. When researchers tuned their attacks to each defense, they got past most of 12 published defenses more than 90% of the time (Nasr et al., 2025). A buyer usually cannot check any of this for the agent in front of them: of 16 AI agent products reviewed, only one publishes an injection rate for itself.
Key findings
- Instructions hidden in images reached up to 100% success on some browser-use agent platforms, and adversarial images averaged 91.9% across 2,250 web tasks (Cao et al., 2026).
- Poisoned MCP tool descriptions succeeded nearly 100% of the time in six high-risk scenarios (Liu et al., 2026).
- Attacks tuned to each defense got past most of 12 published defenses more than 90% of the time, including defenses that had reported near-zero rates on their own tests (Nasr et al., 2025).
- Of 16 AI agent products reviewed, only Claude in Chrome publishes an injection rate, measured on Anthropic's own tests, and Anthropic says the risk is not zero (Anthropic, Using, 2026).
- Agents with no defense, the starting point for an agent a team builds itself, followed injected instructions in 17.4% to 100% of 17 measurements (Evtimov et al., 2025).
Which attacks get through what the agent sees?
The most effective attacks in the studies do not arrive as text a filter can read. They arrive in what the agent sees. Researchers hid instructions inside images on a page, and browser-use agents followed them in up to 100% of tests on some platforms (Cao et al., 2026). Adversarial images averaged 91.9% across 2,250 web tasks and stayed effective against three agent-level defenses (Han et al., 2026). Hidden page elements built to steal a user's personal data worked in up to 70% of tests (Liao et al., 2025).
Tools carry the same risk. When an agent read poisoned descriptions of the tools it was given, the attack worked nearly every time in six high-risk scenarios (Liu et al., 2026). In each case the instruction rides in on content the agent reads as part of its work: a screen, an image, a tool's own documentation. A filter that inspects the prompt a user typed never sees it, which is why the place to limit the damage is what the model can see on the screen.
What did each study measure?
| Study | What was tested | Without a defense | With a defense |
|---|---|---|---|
| Alizadeh et al. (2025, preprint) | Agents asked by injected text to leak personal data seen during a task | 20% average | Not tested |
| Cao et al. (2026, peer-reviewed) | Visual prompt injection on computer-use and browser-use agents | Up to 51% and up to 100% | Not tested |
| Evtimov et al. (2025, peer-reviewed) | Web agents on the WASP benchmark | Up to 86% followed the injection | Not tested |
| Liao et al. (2025, peer-reviewed) | Web agents meeting hidden page elements built to steal personal data | Up to 70% | Not tested |
| Liu et al. (2025, preprint) | Agentic coding editors induced to run malicious commands | Up to 84% | Not tested |
| Liu et al. (2026, preprint) | One agent using poisoned MCP tool descriptions | Nearly 100% in six high-risk scenarios | Not tested |
| Zhan et al. (2026, preprint) | Computer-use agents, single-step and multi-step attacks | 31.3% to 36.9% across five agents; 41.7% to 72.9% for one model | Not tested |
| Han et al. (2026, preprint) | Web agents shown adversarial images | 91.9% average; 17.4% for the strongest earlier attack | Not tested |
| Milani et al. (2026, peer-reviewed) | Language models summarizing and ranking documents | Above 90% | Not tested |
| Pai (2026, workshop) | Enterprise document agents across five professional domains | 25.4% | 15.6% |
| Anthropic (August 2025, vendor) | Claude in Chrome, 123 test cases across 29 attack scenarios | 23.6%; 35.7% on browser-specific attacks | 11.2%; 0% on browser-specific attacks |
| Anthropic (November 2025, vendor) | Claude browser extension against an internal adaptive attacker | Not reported | 1% |
| Nasr et al. (2025, preprint) | 12 published defenses against adaptive attacks | Not applicable | Above 90% for most |
| Zverev et al. (2026, preprint) | Browser agents with information-flow control in a closed 28-site environment | Not reported | 0% by design |
| He et al. (2026, peer-reviewed) | Agents protected by AttriGuard, static attacks | Not reported | 0% |
| Saban (2026, preprint) | Two frontier computer-use agents on one browser benchmark | Not reported | 0 of 140 multi-step attacks |
The studies test different agents, tasks and attacks, so the table is a map of what has been measured rather than a ranking. Where a paper reports a maximum over systems or scenarios, the table says "up to". The pattern holds across very different setups: without a defense, a meaningful share of injected instructions get followed, and in several tests nearly all of them do.
Why do defenses that test near zero still fail?
Every zero in the table comes from a fixed test. AttriGuard reached 0% against static attacks (He et al., 2026). SPIDES reached 0% by design inside a closed environment of 28 interlinked sites (Zverev et al., 2026). Two frontier agents resisted all 140 multi-step attacks in one browser benchmark (Saban, 2026). A fixed test measures how a defense holds against attacks its builders could see in advance.
Attackers do not stay fixed. When researchers tuned their attacks to each defense, most of 12 published defenses were bypassed more than 90% of the time, including several that had reported near-zero rates (Nasr et al., 2025). A rate a vendor measures on its own test set describes that test set. It does not describe the next attacker.
Which agents publish an injection rate?
One. Of 16 AI agent products reviewed, only Anthropic publishes a rate, for Claude in Chrome, and every figure it publishes comes from its own test sets: 23.6% before mitigations and 11.2% after them in August 2025 (Anthropic, Piloting, 2025), and a lower rate against its own adaptive attacker since. Anthropic's guidance for users still says the risk is not zero (Anthropic, Using, 2026). For the other 15, no rate is described in the launch, security, safety or documentation pages read.
| Product | Vendor | Publishes a prompt injection rate? | Pages read |
|---|---|---|---|
| Claude in Chrome | Anthropic | Yes, on Anthropic's own test sets | Launch article; research post |
| Claude Code | Anthropic | Not described in public documentation | Launch post; security docs |
| Claude Computer Use | Anthropic | Not described in public documentation | Launch post |
| Codex | OpenAI | Not described in public documentation | Launch post; security docs |
| OpenAI Dots | OpenAI | Not described in public documentation | Launch post |
| ChatGPT Atlas (discontinued by OpenAI in 2026) | OpenAI | Not described in public documentation | Launch post; safety post |
| Gemini in Chrome | Not described in public documentation | Launch post; security post | |
| Meta Muse | Meta | Not described in public documentation | Launch post; safety post |
| Grok Bot | xAI | Not described in public documentation | Launch post |
| Cursor browser agent | Cursor | Not described in public documentation | Changelog; security page; security docs |
| Devin | Cognition | Not described in public documentation | Launch post; security page |
| Comet | Perplexity | Not described in public documentation | Launch post; security page; two security posts |
| Dia | The Browser Company | Not described in public documentation | Release notes; security page |
| Opera Neon | Opera | Not described in public documentation | Press release; FAQ; security page |
| Manus | Manus | Not described in public documentation | Blog; security page |
| Browser Use | Browser Use | Not described in public documentation | Release notes; docs |
Two pages could not be read because the sites refused automated requests: the xAI safety page and the OpenAI release notes. A product with no rate in this table may publish one somewhere not searched.
Agents a company builds itself start further back. A team assembling an agent from an open-source framework does not inherit a vendor's defenses, and the 17 measurements of agents with no defense ran from 17.4% to 100%, with a median of 51% (Evtimov et al., 2025). A buyer cannot set policy on a rate nobody publishes, so the control has to hold without knowing the rate.
What does this mean for teams running AI agents?
Plan for the injection that succeeds. The most effective attacks come through what an agent reads, adaptive attackers get past most published defenses, and most agents give the buyer no rate to plan against. The useful design question is what an agent can reach when an injected instruction is followed: which sensitive values its model can see on the screen, and whether a named person approves each action that moves money, data or access. If the model never held the real account number, an instruction to send it has nothing to send.
Methodology and limitations
Rates were taken from every fact line reporting an attack success rate in RedactSure's external source review, read as of October 27, 2026, with each paper's wording checked, and from Anthropic's published reports. Twenty-nine rows were found in the review and 25 are used, from 16 studies and vendor reports. Four rows were left out because they measure something else: a click rate on pop-ups, a probability of data leaving one model, an agent attacking its own monitor, and covert exfiltration through a fetch tool. Rows reported as "above 90%" are counted as 90%, so the true maximum is higher.
For the product count, the launch post and the security, safety or documentation pages of 16 AI agent products were read on October 27, 2026: Claude in Chrome, Claude Code and Claude Computer Use (Anthropic); Codex, OpenAI Dots and ChatGPT Atlas (OpenAI); Gemini in Chrome (Google); Meta Muse (Meta); Grok Bot (xAI); the Cursor browser agent (Cursor); Devin (Cognition); Comet (Perplexity); Dia (The Browser Company); Opera Neon (Opera); Manus; and Browser Use. 35 pages were opened and two could not be read. The 16 studies and reports are Alizadeh et al. (2025), Cao et al. (2026), Evtimov et al. (2025), Liao et al. (2025), Liu et al. (2025), Liu et al. (2026), Zhan et al. (2026), Han et al. (2026), Milani et al. (2026), Pai (2026), Nasr et al. (2025), Zverev et al. (2026), He et al. (2026), Saban (2026) and Anthropic's two reports on Claude in Chrome (2025). Of the 16 studies and reports, five are peer-reviewed papers, one is a workshop paper, eight are preprints and two are vendor reports. Vendor figures are self-reported and not independently replicated. The studies are not directly comparable, so the table maps what has been measured rather than ranking agents.
Frequently asked questions
What is visual prompt injection?
It is an attack that hides instructions inside an image on a page or screen rather than in text. An AI agent that reads the screen, or a screenshot of it, can follow those instructions. Filters that inspect typed prompts or page text do not see them. In published tests, visual injection reached up to 100% success on some browser-use agent platforms.
Do prompt injection defenses work?
They lower the rate, and some reach zero in a fixed test. The evidence turns on adaptive attacks: when researchers tuned attacks to each defense, most of 12 published defenses were bypassed more than 90% of the time. A defense is a layer that reduces risk, not a guarantee, so the agent's access needs limits of its own.
Which AI agent vendors publish a prompt injection rate?
Of the 16 agent products reviewed for this report, only Anthropic publishes a rate for its own product, Claude in Chrome, measured on its own test sets, and it says the risk is not zero. The other 15 did not publish a rate on the pages searched, so a buyer has no number to plan against for most agents.
How RedactSure Plans for the Injection That Gets Through
The attacks that work best arrive through what an agent sees, and attackers adapt to whatever defense is in place. What decides the damage is what the model could see and do when an instruction slips through.
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before: an agent reconciling invoices reads the supplier's bank account on the screen, meets an instruction hidden in an attached document, and pastes the account into an outside form. Inside the governed environment: render-layer tokenization shows the model ACCT_001 instead of the account number, so the injected instruction has only a token to send, and a named person approves every payment or submission under Supervised Delegation. Every screen as tokens, every action and every approval lands in the AI Control Record.
RedactSure is deploying now with enterprise and government customers.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
The measured rates say some injected instructions will get through, so the safer design limits what they can reach. Bring one workflow your agents run and see, with test values, which values the model holds on each screen and who signs off before anything moves. Book a demo