The window is in the reasoning: when agents decide to follow an injection
A 16 Oct 2026 arXiv study replays agent runs from the moment an injection is read and shows that, for thinking models, the outcome is often still undecided at read time.
What is this?
Runtime monitors and single-run benchmarks for prompt injection often assume that whether an agent follows an injected instruction is settled the moment it reads the untrusted content. On 16 October 2026, Haoxuan Jia and colleagues published “The Window Is in the Reasoning” (arXiv:2610.24048), which tests that assumption directly. The paper is a measurement study of defensive monitoring; it introduces no new attack.
How it works
The authors use branching rollouts. They replay an agent episode up to the point where it reads an injection, then resample the rest of the episode many times. Comparing the branches splits the variance in the outcome into a part fixed at read time and a part decided later. Experiments run on four AgentDojo suites (AgentDojo, June 2024, is a public benchmark of 97 tasks and 629 security test cases).
Reported results:
- A Qwen3 agent without thinking had about 0.91 of its outcome variance fixed at read time. With thinking enabled that share fell to about 0.62, consistently across three attack templates and two success labels.
- The effect depends on the model: thinking lowered Qwen3’s attack success rate but raised it for two other models.
- Resampling from reasoning prefixes shows the decision to follow an injection builds up gradually during reasoning.
- Zero-shot chain-of-thought monitors built on cheaper models missed much of what the prefix had already determined. Stronger monitors, and a lookahead monitor that evaluates simulated next actions, came much closer.
- For thinking agents, single-run labels disagreed with a rerun in up to 35% of cases.
Why it matters
A check performed only when untrusted content enters the context can miss a decision that has not yet been made, and a cheap monitor may not see it forming. Benchmarks with one run per task can also over- or under-state an agent’s real robustness. A separate paper from 2 October 2026 (arXiv:2610.03448) adds a related caution: detector rankings transferred poorly between benchmarks, and the best BIPIA detector caught about 2% of AgentDojo injections at a 1% false-positive rate.
Defenses
- Do not rely on a one-time read-time check. Monitor the agent’s reasoning and proposed actions as they develop, and gate every consequential tool call.
- Use a monitor at least as capable as the agent, or one that evaluates simulated next actions (lookahead), rather than a cheap zero-shot monitor.
- Enforce least-privilege tools and approval for sensitive actions, so a late decision to follow an injection cannot cause serious harm.
- Evaluate with repeated runs per task and report variance, not single-run pass/fail.
- Test detectors on your own agent’s tool outputs and report detection at a low false-positive rate, as the second paper recommends.
- Treat all retrieved and tool-returned content as untrusted and log decisions for audit.
Status
| Item | Detail |
|---|---|
| Source type | Academic measurement study (arXiv, cs.CL / cs.AI / cs.CR) |
| Published | 16 October 2026 (arXiv:2610.24048 v1) |
| Related work | 2 October 2026 (arXiv:2610.03448); AgentDojo, 19 June 2024 |
| Models named | Qwen3 (thinking and non-thinking); two others not named in the summary reviewed |
| Vulnerability / CVE | None; this is evaluation research, not a product bug |