As open-source large language models (LLMs) become increasingly powerful, they are rapidly evolving into Agentic LLMs capable of automating complex daily tasks. However, this paradigm shift entails severe security risks, as the agents’ necessary integration with external real-time data sources creates a direct pathway for indirect prompt injection (IPI) attacks. Existing attack methods are limited by their reliance on static patterns and evaluation on simple language models, failing to address the fast-evolving nature of modern Agentic LLMs. We introduce AdapTools, a novel adaptive IPI attack framework that selects stealthier attack tools and generates adaptive attack prompts to create a rigorous security evaluation environment. Our approach comprises two key components: (1) Adaptive Attack Strategy Construction, which develops transferable adversarial strategies for prompt optimization, and (2) Attack Enhancement, which identifies stealthy tools capable of circumventing task-relevance defenses. Comprehensive experiments on both open-source and commercial agentic LLMs show that AdapTools achieves a per-model average improvement of 2.08× in attack success rate over the strongest baseline under state-of-the-art defenses (MELON, Pi-Detector), with gains reaching up to 3.06× on the most resistant reasoning agents. The framework further transfers to black-box commercial agents (GPT, Qwen, Gemini), with ASR ranging from 4.2 to 20.3 (peak on the in-family Qwen-MAX), exposing systematic vulnerabilities in modern Agentic LLMs.

Recent advances in Knowledge Distillation (KD) aim to mitigate the high computational demands of Large Language Models (LLMs) by transferring knowledge from a large ”teacher” to a smaller ”student” model. However, students may inherit the teacher’s privacy when the teacher is trained on private data. In this work, we systematically characterize and investigate membership privacy risks inherent in six LLM KD techniques.Using instruction-tuning settings that span seven NLP tasks, together with three teacher model families (GPT-2, LLAMA-2, and OPT), and various size student models, we demonstrate that all existing LLM KD approaches carry membership and memorization privacy risks from the teacher to its students. However, the extent of privacy risks varies across different KD techniques. We systematically analyse how key LLM KD components (KD objective functions, student training data and NLP tasks) impact such privacy risks. We also demonstrate a significant disagreement between memorization and membership privacy risks of LLM KD techniques. Finally, we characterize per-block privacy risk and demonstrate that the privacy risk varies across different blocks by a large margin.