Covert vs overt: why attack success rate hides the injections that matter

What is this?

On 31 August 2026 (revised 1 September), Yunseok Lee, Yunji Kim and Woojin Lee published “Will the User Ever Know? Covert Indirect Prompt Injection Attacks on Tool-Using LLM Agents” (arXiv 2608.30362), accepted at the EMNLP 2026 main conference. The paper does not announce a new vulnerability class. It argues that the industry’s standard metric for indirect prompt injection — Attack Success Rate (ASR) — measures the wrong thing, and it demonstrates the gap empirically on AgentDojo.

The claim is narrow and useful: ASR counts whether the injected action was executed. It says nothing about whether the user reading the agent’s final response would ever find out.

How it works

Reading successful injection traces, the authors observe two distinct endings.

In the first, the agent performs the injected action, then goes back to finishing the user’s original request. The final response looks like an ordinary answer to an ordinary task. In the second, the agent performs the injected action and stops there, so the injected action is what the final response describes — and the user has a chance to notice.

The authors name these covert and overt successes, and decompose the usual metric accordingly:

ASR  =  CSR  +  OSR

CSR  (Covert Success Rate)  attack succeeded, no trace in the final response
OSR  (Overt Success Rate)   attack succeeded, user can detect it from the response

The mechanical explanation is the interesting part. In the ReAct loop — the reason/act pattern most tool-using agents follow — the final response is essentially a summary of the most recent action. So whether an injection ends up covert or overt is largely determined by what the agent does next, not by how the payload was written. An injection that terminates the trajectory becomes visible. An injection followed by more legitimate work gets buried.

From that observation the paper derives ICoA (Induced Covert Attack): rather than trying harder to make the injection succeed, it structures the injected text so the agent returns to the user’s task afterwards. Conceptually, the payload frames the injected instruction as a follow-up from the user and appends an anchor directing the agent back to the original request once it is done. Across four target models on AgentDojo, ICoA reports the highest CSR, improving on the strongest baseline by 3.79 to 12.01 percentage points.

No payload is reproduced here, and none is needed to understand the finding: the technique is a control-flow trick on the agent’s ordering of work, not a new way to defeat a guardrail.

Why it matters

Three consequences for anyone deploying agents.

Published robustness numbers are optimistic in the wrong direction. If a model’s reported ASR is 4%, that number silently mixes the injections a user would have caught with the ones they never could. The second group is the operationally dangerous one, and it is smaller than ASR but far more damaging per incident. Two models with identical ASR can have very different CSR.

The agent’s summary is not a log. A great deal of practical agent oversight — human-in-the-loop review, “check what it did before approving” — rests on the assumption that the natural-language response reflects the actions taken. This paper shows that assumption is cheap to break and, worse, that breaking it is a side effect of the agent behaving well. An agent that dutifully returns to the user’s task after an injection is an agent that hides the injection.

Attackers have an incentive to be less greedy. The optimisation target shifts from “maximise the chance the injection fires” to “maximise the chance it fires unnoticed” — and those are not the same payload. Defences tuned against the first do not automatically cover the second.

Defenses

1. Log actions independently of the model’s output. The only reliable record of what an agent did is the tool-call trace, captured outside the model. Never let the final response stand in as the audit trail. This is exactly the “inspectable, traceable and instrumentable” requirement in OWASP’s Agent Control Standard, donated to the GenAI Security Project and published on 1 September 2026.

2. Diff the trace against the summary. A cheap, model-agnostic detector: enumerate the tools actually invoked, enumerate the actions mentioned in the final response, and flag any tool call that is absent from the summary. Covert success is by construction a mismatch between those two sets.

3. Report CSR, not just ASR, in your own evaluations. If you red-team your agent stack, split results by user-visibility. A defence that converts covert successes into overt ones is a real improvement even when ASR is unchanged — and a “defence” that does the reverse is a regression your current metric will score as neutral.

4. Enforce controls at the orchestration layer. Runtime policy on which tools may be called, with what arguments, and which actions require approval, does not depend on the agent narrating honestly. The ACS’s model of declarative, framework-portable middleware hooks is one implementation route; capability scoping and allowlisted actions are the same idea by hand.

5. Alert on trajectory shape, not just content. The paper’s own finding is that ordering carries signal: an action that is neither requested by the user nor referenced in the response, sitting mid-trajectory, is a detectable pattern regardless of what the payload said.

Status

Item	Reference	Date	Notes
Covert/overt IPI paper (arXiv 2608.30362)	arXiv (cs.AI, cs.CL)	2026-08-31 (v2: 2026-09-01)	EMNLP 2026 Main Conference; evaluated on AgentDojo
ICoA result	same	2026-08-31	Highest CSR across four target models; +3.79 to +12.01 pp over strongest baseline
Agent Control Standard (ACS)	OWASP GenAI Security Project	2026-09-01	Middleware hooks + declarative runtime policy, portable across frameworks
ACS repository	GitHub (GenAI-Security-Project)	2026-09	Open specification

The takeaway is not that indirect prompt injection got worse. It is that the metric everyone quotes was never measuring user-detectability, and once you split it, the part that matters most for incident response is the part nobody was tracking. If your agent’s oversight story depends on reading what the agent says it did, you do not have an oversight story.