On 25 June 2026, Narisetty and co-authors posted arXiv:2606.26479, an adaptive evaluation of out-of-band defenses against prompt injection in LLM agents. It builds on an October 2025 paper, "The Attacker Moves Second," whose authors bypassed 12 recent in-band defenses with attack success above 90% for most of them, even though most had reported near-zero success originally. Read together, they give a usable rule: defenses that live inside the model's text tend to fail under pressure, and defenses that live outside it in code have a better record, with caveats.
What's affected
Any LLM feature that reads untrusted text and can act: agents with tools, assistants that read email or tickets, coding agents that read repositories.
In-band defenses try to persuade or detect: stronger system prompts, input classifiers, instruction hierarchies, training the model to refuse. The 2025 paper tested them against gradient descent, reinforcement learning, random search and human-guided exploration, and most gave way.
Out-of-band defenses enforce rules outside the model with deterministic policy: capabilities, information-flow labels and reference monitors. The 2026 paper names CaMeL, FIDES, Progent, RTBAS and FORGE, several of which report nearly eliminating attacks on the AgentDojo benchmark.
What to do now
- Stop counting on a better prompt. Keep the instruction, but do not rely on it for anything that matters.
- Enforce tool policy in code. Allow only the tools a task needs, check arguments against a schema, and block calls that move data to new destinations.
- Separate untrusted content from authority. Text from a web page or email should never be able to add a tool, widen a scope or change a recipient.
- Add approvals for irreversible actions. A human prompt sits outside the model.
- Test with adaptive attacks, not only a fixed list of known strings. Static benchmarks are the method that made in-band defenses look good.
- Treat the new results as promising and not proven. In the independent reproduction, Progent cut mean attack success from 25.8% to 4.2% on an open-weight Qwen2.5-7B model, and a hand-crafted adaptive attack left it at 2.6%. The authors say this is small scale, used a weak model and one attack template, and did not test a stronger optimized white-box attack.
A fair summary for your own risk acceptance: policy enforcement outside the model shrinks what a successful injection can do, and no current defense removes the injection itself.
Quick check
Why do static benchmarks overstate a defense?
They use fixed attack strings or weak optimizers not designed against the defense. Adaptive attackers who tune against it can reach success rates above 90%, as the 2025 study showed for 12 defenses.
