titleSecurity Assessment of DeepSeek Harness with A.I.G: Evaluating Resistance to Indirect Prompt Injection
authorsZonghao Ying, Xiangfan Wu, Huiyu Wu, Xing Zheng, Huangsheng Cheng, Xiaorong Shi, Jing Guo
date2026-08-18
venuearXiv (preprint, not peer reviewed)
idarXiv:2608.16393
affiliationTencent
upvotes7 (Hugging Face Daily Papers, 2026-11-01)
linksabs pdf hf
abstractWe assess indirect prompt injection in DeepSeek Harness (DSH), using AI-Infra-Guard (A.I.G) to construct tests, deliver controlled taint, execute DSH, collect traces, and judge outcomes. The study covers 14,560 controlled executions over 16 indirect-content channels, text and file carrier modes, 35 payload objectives, one unmodified baseline, and 12 attack methods. The experiment preserves DSH's agent loop, tool registry, model adapter, and session-event path; source tools and sensitive sinks are local fixtures, so attempted actions are recorded without external side effects. We evaluate each trace with a deterministic rule-based judge, (RuleJudge), and a semantic LLM-based judge, (LLMJudge). The strongest observed attack success rates are 17.0% under for fake-completion attack in text mode, 25.5% under for hidden Unicode in file mode, and 16.0% under for the skills channel in file mode. also assigns partial compliance more often than (7.3% versus 2.0%). We relate these results to DSH's treatment of tool results, additional contexts, and tool-call policy hooks, then identify controls that should sit between untrusted content and sensitive actions. Our code is available at https://github.com/Tencent/AI-Infra-Guard/tree/main/Research/deepseek-harness-security-assessment .

cite

@misc{ying2026security,
  title={Security Assessment of DeepSeek Harness with A.I.G: Evaluating Resistance to Indirect Prompt Injection},
  author={Zonghao Ying and Xiangfan Wu and Huiyu Wu and Xing Zheng and Huangsheng Cheng and Xiaorong Shi and Jing Guo},
  year={2026},
  eprint={2608.16393},
  archivePrefix={arXiv},
  url={https://arxiv.org/abs/2608.16393}
}