Where you inject matters: agents trust some parts of their environment more than others
An October 28, 2026 arXiv paper holds injected text constant and varies only its location: README and TODO files steer coding agents far more often than code or data files.
What is this?
On October 28, 2026, a team including Chengquan Guo, Bo Li and Jianfeng Gao posted “Where You Inject Matters: The Trust Region Effect in LLM Agents” (arXiv:2610.38867, cs.AI with cs.CR and cs.LG cross-listing). Most indirect prompt injection research asks what the malicious text says. This paper holds the text fixed and varies only where in the agent’s environment it appears. Susceptibility changes substantially with placement. The authors call this the trust region effect: agents implicitly trust different parts of their environment to different degrees.
The headline coding result: with GPT-5.4, an unsafe instruction placed in a repository documentation file (a README or TODO) was followed about 2.6 times more often on average than the same instruction in a code or data file. This is a measurement study of a defensive blind spot, not an exploit.
How it works
The authors built three agentic testbeds: coding (built on Terminal-Bench-2), tool use (built on AgentDojo) and daily workflow (built on DecodingTrust-Agent). Together they include 30 benign tasks, 24 injection risks and 36 environmental surfaces. Each injection is placed at a coarse level (which surface: a file type, an email, a Slack message, a review) and a fine level (start, middle or end of the content). Success is judged by deterministic script-based verifiers rather than an LLM judge, and the metric counts only injections the agent actually read.
Reported patterns (figures as stated in the paper, which tests several vendors’ models):
- Surface matters. In the coding testbed with GPT-5.4, one reconnaissance-style risk succeeded 86% of the time from a README and 61% from a TODO file, versus 19% from code files and 30% from data files. In the workflow testbed, a phishing-style risk reached 23% via GitHub content, 17% via Slack, 9% via Confluence and 0% via Jira.
- Position matters less, but consistently. Content at the end of a document was the most effective position in all three domains.
- Models differ widely. Overall conditional success rates in the coding domain ranged from near zero for some frontier models to 67.0% for Gemini-3.1-Pro, with GPT-5.4 at 12.2%.
- Attackers can learn placement. A small trained attacker that optimizes content and placement jointly reached 59.1% success versus 37.0% for content-only optimization, and transferred to a different victim model where template baselines scored 0%.
No payloads are reproduced here. The takeaway is structural: an agent’s trust is uneven and learnable.
Why it matters
Projects commonly treat documentation as inert. The paper shows that for agents, documentation files are among the most influential inputs, which aligns with practical research published days earlier. On October 22, 2026, Forever Security described how a web page can silently drop an AGENTS.md or CLAUDE.md into a user’s Downloads folder; a coding agent later launched in that folder treats it as trusted project instructions. The authors say this relies on the agent’s trust in its working folder, not on a product bug. See also AGENTS.md supply-chain injection and the instruction hierarchy.
Limits matter too. The paper describes behavior, not internal mechanism; it covers three testbeds and indirect injection only; and its attacker was trained against one victim model. Treat percentages as indicative of relative risk, not as production rates.
Defenses
The paper proposes no specific defense; it argues defenses should account for placement when limiting untrusted content’s influence. Practical steps that follow:
- Treat documentation as untrusted input. README, TODO, CONTRIBUTING and agent instruction files from repositories or folders you did not author should not carry operator-level authority.
- Do not run agents in web-writable folders such as Downloads, and review instruction files you did not write before an agent loads them.
- Protect agent configuration. Alert on unexpected changes to MCP server entries, API base URLs and proxy settings, and require approval for edits to the agent’s own config.
- Weight trust by surface. Where your framework allows, mark provenance per source and limit what actions text from low-integrity surfaces can trigger.
- Test with placement variation. When red-teaming your own agents, vary injection location and position, not only wording; a single placement can understate risk.
- Keep approvals and sandboxing on, and apply least privilege to tools and credentials.
Status
| Item | Reference | Date | Notes |
|---|---|---|---|
| Trust region paper | arXiv:2610.38867 | 2026-10-28 | Three testbeds, multiple vendors’ models |
| Downloads-folder instruction file research | Forever Security | 2026-10-22 | Codex and Claude Code tested; authors report no vendor statement |
| Digest listing both | Adversa AI | 2026-11-02 | Secondary roundup |
| Patch status | n/a | n/a | Behavioral finding; no single patch |