@inproceedings{wang-etal-2026-adaptools,
title = "{A}dap{T}ools: Adaptive Tool-based Indirect Prompt Injection Attacks on Agentic {LLM}s",
author = "Wang, Che and
Zhang, Jiaming and
Zhang, Ziqi and
Wang, Zijie and
Wang, Yinggui and
Gao, Jianbo and
Wei, Tao and
Chen, Zhong and
Lim, Wei Yang Bryan",
editor = "Lee, Hung-Yi and
Dev, Sunipa and
Li, Jessy and
Elliott, Desmond",
booktitle = "Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing",
month = oct,
year = "2026",
address = "Budapest, Hungary",
publisher = "Association for Computational Linguistics",
url = "https://aclanthology.org/2026.emnlp-main.2055/",
pages = "46795--46816",
ISBN = "979-8-89176-459-0",
abstract = "As open-source large language models (LLMs) become increasingly powerful, they are rapidly evolving into Agentic LLMs capable of automating complex daily tasks. However, this paradigm shift entails severe security risks, as the agents' necessary integration with external real-time data sources creates a direct pathway for indirect prompt injection (IPI) attacks. Existing attack methods are limited by their reliance on static patterns and evaluation on simple language models, failing to address the fast-evolving nature of modern Agentic LLMs. We introduce AdapTools, a novel adaptive IPI attack framework that selects stealthier attack tools and generates adaptive attack prompts to create a rigorous security evaluation environment. Our approach comprises two key components: (1) Adaptive Attack Strategy Construction, which develops transferable adversarial strategies for prompt optimization, and (2) Attack Enhancement, which identifies stealthy tools capable of circumventing task-relevance defenses. Comprehensive experiments on both open-source and commercial agentic LLMs show that AdapTools achieves a per-model average improvement of 2.08{\texttimes} in attack success rate over the strongest baseline under state-of-the-art defenses (MELON, Pi-Detector), with gains reaching up to 3.06{\texttimes} on the most resistant reasoning agents. The framework further transfers to black-box commercial agents (GPT, Qwen, Gemini), with ASR ranging from 4.2 to 20.3 (peak on the in-family Qwen-MAX), exposing systematic vulnerabilities in modern Agentic LLMs."
}<?xml version="1.0" encoding="UTF-8"?>
<modsCollection xmlns="http://www.loc.gov/mods/v3">
<mods ID="wang-etal-2026-adaptools">
<titleInfo>
<title>AdapTools: Adaptive Tool-based Indirect Prompt Injection Attacks on Agentic LLMs</title>
</titleInfo>
<name type="personal">
<namePart type="given">Che</namePart>
<namePart type="family">Wang</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Jiaming</namePart>
<namePart type="family">Zhang</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Ziqi</namePart>
<namePart type="family">Zhang</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Zijie</namePart>
<namePart type="family">Wang</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Yinggui</namePart>
<namePart type="family">Wang</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Jianbo</namePart>
<namePart type="family">Gao</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Tao</namePart>
<namePart type="family">Wei</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Zhong</namePart>
<namePart type="family">Chen</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Wei</namePart>
<namePart type="given">Yang</namePart>
<namePart type="given">Bryan</namePart>
<namePart type="family">Lim</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<originInfo>
<dateIssued>2026-10</dateIssued>
</originInfo>
<typeOfResource>text</typeOfResource>
<relatedItem type="host">
<titleInfo>
<title>Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing</title>
</titleInfo>
<name type="personal">
<namePart type="given">Hung-Yi</namePart>
<namePart type="family">Lee</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Sunipa</namePart>
<namePart type="family">Dev</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Jessy</namePart>
<namePart type="family">Li</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Desmond</namePart>
<namePart type="family">Elliott</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<originInfo>
<publisher>Association for Computational Linguistics</publisher>
<place>
<placeTerm type="text">Budapest, Hungary</placeTerm>
</place>
</originInfo>
<genre authority="marcgt">conference publication</genre>
<identifier type="isbn">979-8-89176-459-0</identifier>
</relatedItem>
<abstract>As open-source large language models (LLMs) become increasingly powerful, they are rapidly evolving into Agentic LLMs capable of automating complex daily tasks. However, this paradigm shift entails severe security risks, as the agents’ necessary integration with external real-time data sources creates a direct pathway for indirect prompt injection (IPI) attacks. Existing attack methods are limited by their reliance on static patterns and evaluation on simple language models, failing to address the fast-evolving nature of modern Agentic LLMs. We introduce AdapTools, a novel adaptive IPI attack framework that selects stealthier attack tools and generates adaptive attack prompts to create a rigorous security evaluation environment. Our approach comprises two key components: (1) Adaptive Attack Strategy Construction, which develops transferable adversarial strategies for prompt optimization, and (2) Attack Enhancement, which identifies stealthy tools capable of circumventing task-relevance defenses. Comprehensive experiments on both open-source and commercial agentic LLMs show that AdapTools achieves a per-model average improvement of 2.08× in attack success rate over the strongest baseline under state-of-the-art defenses (MELON, Pi-Detector), with gains reaching up to 3.06× on the most resistant reasoning agents. The framework further transfers to black-box commercial agents (GPT, Qwen, Gemini), with ASR ranging from 4.2 to 20.3 (peak on the in-family Qwen-MAX), exposing systematic vulnerabilities in modern Agentic LLMs.</abstract>
<identifier type="citekey">wang-etal-2026-adaptools</identifier>
<location>
<url>https://aclanthology.org/2026.emnlp-main.2055/</url>
</location>
<part>
<date>2026-10</date>
<extent unit="page">
<start>46795</start>
<end>46816</end>
</extent>
</part>
</mods>
</modsCollection>
%0 Conference Proceedings
%T AdapTools: Adaptive Tool-based Indirect Prompt Injection Attacks on Agentic LLMs
%A Wang, Che
%A Zhang, Jiaming
%A Zhang, Ziqi
%A Wang, Zijie
%A Wang, Yinggui
%A Gao, Jianbo
%A Wei, Tao
%A Chen, Zhong
%A Lim, Wei Yang Bryan
%Y Lee, Hung-Yi
%Y Dev, Sunipa
%Y Li, Jessy
%Y Elliott, Desmond
%S Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing
%D 2026
%8 October
%I Association for Computational Linguistics
%C Budapest, Hungary
%@ 979-8-89176-459-0
%F wang-etal-2026-adaptools
%X As open-source large language models (LLMs) become increasingly powerful, they are rapidly evolving into Agentic LLMs capable of automating complex daily tasks. However, this paradigm shift entails severe security risks, as the agents’ necessary integration with external real-time data sources creates a direct pathway for indirect prompt injection (IPI) attacks. Existing attack methods are limited by their reliance on static patterns and evaluation on simple language models, failing to address the fast-evolving nature of modern Agentic LLMs. We introduce AdapTools, a novel adaptive IPI attack framework that selects stealthier attack tools and generates adaptive attack prompts to create a rigorous security evaluation environment. Our approach comprises two key components: (1) Adaptive Attack Strategy Construction, which develops transferable adversarial strategies for prompt optimization, and (2) Attack Enhancement, which identifies stealthy tools capable of circumventing task-relevance defenses. Comprehensive experiments on both open-source and commercial agentic LLMs show that AdapTools achieves a per-model average improvement of 2.08× in attack success rate over the strongest baseline under state-of-the-art defenses (MELON, Pi-Detector), with gains reaching up to 3.06× on the most resistant reasoning agents. The framework further transfers to black-box commercial agents (GPT, Qwen, Gemini), with ASR ranging from 4.2 to 20.3 (peak on the in-family Qwen-MAX), exposing systematic vulnerabilities in modern Agentic LLMs.
%U https://aclanthology.org/2026.emnlp-main.2055/
%P 46795-46816
Markdown (Informal)
[AdapTools: Adaptive Tool-based Indirect Prompt Injection Attacks on Agentic LLMs](https://aclanthology.org/2026.emnlp-main.2055/) (Wang et al., EMNLP 2026)
ACL
- Che Wang, Jiaming Zhang, Ziqi Zhang, Zijie Wang, Yinggui Wang, Jianbo Gao, Tao Wei, Zhong Chen, and Wei Yang Bryan Lim. 2026. AdapTools: Adaptive Tool-based Indirect Prompt Injection Attacks on Agentic LLMs. In Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing, pages 46795–46816, Budapest, Hungary. Association for Computational Linguistics.