When Security Agents Meet Deceptive Environments

AI agents that handle security tasks do not operate in clean, trustworthy environments. They browse web pages, parse source code, read log files, and inspect configuration output. Every one of these artifacts can be shaped by an attacker. The existing threat model for this problem is prompt injection: malicious instructions embedded in external content that override the agent's task. But there is a broader class of attacks that never issue a single instruction. A fake log entry that says "vulnerability remediated," a decoy endpoint that looks like a real admin panel, a misleading hint embedded in a comment tag, or a fabricated flag-format string can all change what an agent believes without ever telling it what to do. The agent arrives at the wrong conclusion on its own.

This is what Matteo Golinelli, Idilio Drago, Matteo Boffa, Francesco Bergadano, and Bruno Crispo from the Universities of Trento, Turin, and Politecnico di Torino call adversarial task contamination. The paper presents AgentLSD, a controlled framework for measuring how deceptive artifacts embedded in task environments change the behavior of security agents. The evaluation uses Capture the Flag (CTF) challenges as a testbed: the framework injects traps into working challenges while keeping the intended vulnerability, solution path, and flag unchanged. This lets researchers isolate the effect of deception from the effect of task difficulty.

The paper is to be published at the 19th ACM Workshop on Artificial Intelligence and Security (AISec 2026) co-located with CCS 2026, and the framework, trap specifications, and raw traces are released as open source.

Why Prompt Injection Is Not the Whole Story

Prompt injection works by injecting instructions that compete with the agent's own task prompt. The agent obeys the injected instruction instead of the original task. But not all adversarial content is instructional. A fake validation message that says "Status: Remediated" does not tell the agent to stop investigating. It changes what the agent believes about the state of the system. A decoy endpoint in a robots.txt file does not issue a command. It draws the agent's exploration toward a path that wastes time. A misleading comment in an HTML page does not contain an imperative. It biases the agent toward an incorrect hypothesis.

The distinction matters because defenses against prompt injection (separating instructions from data, marking trust boundaries) do not address these non-instructional deceptions. The agent is not tricked into following a command. It is tricked into forming a wrong belief, pursuing a decoy path, or wasting its budget on irrelevant exploration. The failure mode is misprioritization, not disobedience.

AgentLSD formalizes this as a distinct threat: an adversary controls part of the environment an agent inspects, adds deceptive artifacts to it, and holds the underlying task constant. The agent must still find the same vulnerability, but it encounters misleading evidence along the way. The research question is not whether agents can solve challenges, but how much additional effort deception imposes and how often it causes outright failure.

The Trap Taxonomy: Five Families of Environmental Deception

AgentLSD organizes traps into five families based on what part of the agent loop they target. Each family has a distinct mechanism, an expected behavioral effect, and a measurable primary outcome.

Goal hijack uses authoritative-looking cues to redirect the solver toward a decoy objective. A hidden div might say "Admin console available at /admin/console/login." The agent treats this as the intended next step and shifts its search policy toward the decoy route. The primary outcome is a major diversion or complete solve-path replacement.

False authority presents a hint or interface cue with an unwarranted appearance of authority, such as through metadata or visual labeling. An HTML comment might say "Hint: the flag is in the backup database." The agent elevates the cue over direct evidence and reprioritizes its investigation, leading to incorrect trust or exploration diversion.

False validation uses a message, badge, or flag-format cue to make a decoy artifact appear validated or successful. A visible element might display "FLAG{fake_flag_value}" or a "Verified" badge next to a decoy endpoint. The agent accepts the confirmation and records or submits an incorrect result.

Exploration bait advertises a tempting route, endpoint, file, or other decoy artifact that appears worth enumerating. A robots.txt entry might list "/backup/config.yml.bak" as disallowed. The agent visits, opens, or repeatedly probes the decoy despite limited evidence that it matters, wasting its action budget.

Time sink induces low-value additional work by pointing toward irrelevant endpoints or embedding honeytoken-bearing decoys. The agent continues investigating without obtaining evidence that advances the true solution, resulting in minor or major delay and a measurable exposure signal through honeytoken interactions.

These families are independent of the delivery surface. The same trap family can appear through a visible text node, a hidden div, an HTML comment, a meta tag, or an accessibility label. Separating intent, surface, and object as independent labels allows the framework to ask whether a trap is effective because of what it says, where it appears, or both.

How AgentLSD Injects Traps Without Changing the Task

The framework works through a pipeline of four stages. First, each trap is specified as a reusable YAML primitive containing the deception category, perception channel, surface, target object, payload template, placement, and randomization parameters. Second, an instance generator resolves template variables (fake routes, fake endpoints, paraphrased authority cues, shuffled tokens) into concrete artifacts. Generation is deterministic: per-instance random seeds are derived from the global seed, primitive identifier, instance index, and retry attempt, producing byte-identical outputs across runs with the same seed. The generator also enforces challenge-preservation constraints, checking that decoy routes do not collide with real solution paths.

Third, a Flask-based deception middleware is added to each challenge. At request time, the middleware creates a request-scoped deception context and injects traps into eligible HTML responses after the challenge handler produces them. It modifies only normal HTTP responses: HTML text, comments, attributes, or metadata are inserted. The agent sees these artifacts in the output of whatever HTTP client or browser it uses during ordinary exploration. No tool output is mocked, no special adversarial message is sent, and the agent is never told that traps exist.

Fourth, AgentLSD verifies that each trap reaches its intended channel using a DOM verifier, and records structured telemetry of all interactions with instrumented decoys, honeytoken routes, rabbit-hole transitions, and fake-goal endpoints. This telemetry shows when an agent takes the bait without requiring it to succeed or fail.

The Experimental Setup: Six Models, Eleven Challenges, Thousands of Trials

The corpus contains 11 purpose-built Flask-based web CTF challenges spanning seven vulnerability classes: command injection, path traversal, race conditions, SQL injection, SSRF, template injection, and XXE. These are not public CTF challenges. They were built for this study and not released before the trials, so models cannot recall a challenge-specific write-up or its freshly generated flag.

Six models are evaluated: five on-premises (Gemma-4 31B, DeepSeek-V4 Flash, GPT-OSS 120B, Qwen3-Coder-Next, Mistral Small 4) plus one hosted (GPT-5). All on-premises models run inside the same agent scaffold (OpenCode) with the same system prompt, temperature 0, and the same tool set (bash, file read/write/edit, glob, grep; web search and fetch disabled). Each trial runs in a fresh container on a per-trial private network with a freshly generated flag. The agent must recover the flag by solving the challenge, and a dedicated flag-checking service is the sole authority on correctness.

The evaluation runs in two phases. In the baseline phase, every model attempts each clean challenge with 5 trials per cell, for 605 total baseline trials. In the trap phase, only the challenges that models solve reliably are re-run with 14 DOM trap instances (covering all five families), for 2,940 on-premises trap trials plus 121 trials for GPT-5 on the five most damaging traps. Every comparison is paired: a trap-augmented challenge differs from its clean counterpart only by the activated artifact.

Clean Capability: The Corpus Is Not Saturated

Across 330 default-prompt baseline trials, agents capture 136 flags, a 41% solve rate. GPT-5 achieves the highest aggregate solve rate (32/55), closely followed by Gemma-4 31B (28/55). DeepSeek-V4 Flash and GPT-OSS 120B form a middle group (24/55 and 23/55), while Qwen3-Coder-Next and Mistral Small 4 are weakest (15/55 and 14/55).

No model solves every challenge. The blind command-injection challenge yields zero clean successes across all six models. The medium SQL-injection and race-condition challenges yield at most one success each. The corpus spans the full range from challenges solved in nearly every trial (basic SQL injection) to challenges solved at most sporadically. This unsaturated baseline is a prerequisite for measuring trap effects: a challenge that no model solves in its clean form carries no signal about deception.

The clean condition also reveals a sharp split in effort. Successful solves are cheap and consistent, clustering around 10 to 30 interaction turns and 1 to 3k reasoning tokens. Failures are both far more expensive and far more variable: median effort rises to roughly 55 to 80 turns and 5 to 15k reasoning tokens, with individual runs reaching 200 turns and 30k tokens before the budget stops them. This cost asymmetry means that even when traps do not change the final outcome, they can dramatically increase the resources an agent spends.

How Traps Change Behavior: Effort Tax, Not Just Solve-Rate Loss

The most consistent effect of traps is on effort, not outcome. Among trap conditions that still recover the flag, interaction turns and reasoning tokens increase for every model. The median overhead is approximately 20 additional turns and 2,000 additional reasoning tokens relative to the clean condition, with long positive tails reaching much higher. This effort tax applies even to Gemma-4 31B, which keeps almost all of its solves under traps.

Solve-rate effects are more heterogeneous. Flag capture drops for every model except Gemma-4 31B, and the magnitude ranges from negligible to severe. GPT-OSS 120B loses roughly half to two-thirds of its clean solves under goal-hijack and exploration-bait traps. GPT-5 is also affected, even though its trap evaluation covered only a subset of the most damaging instances. The robustness gradient runs from Gemma (almost unaffected on solve rate) through DeepSeek (intermediate) to GPT-OSS (heavily degraded).

The practical implication is that clean CTF performance understates vulnerability. A model that scores 5/5 on every clean challenge might still lose half its solves when the environment is contaminated. Even when it keeps its solves, it pays a substantial resource tax that would matter in production settings with bounded budgets.

Which Traps Actually Matter

The redirective families dominate. Goal hijack (4 instances) and exploration bait (3 instances) cause the largest flag-capture losses, removing roughly half to two-thirds of clean solves on GPT-OSS 120B with median changes near negative 50 to 65%. False validation (3 instances) is intermediate. Time sink (3 instances) and false authority (1 instance) barely move the outcome, though the false-authority result is based on a single instance and should be read with caution.

Effort follows a different pattern. Turns and reasoning tokens rise for every family, including those that leave the solve rate intact. Even false validation and false authority, which rarely change the outcome, push effort well above the clean baseline. The metric matters: redirective traps dominate when measuring success, while effort is degraded broadly across all families.

Per-instance analysis reveals sharp heterogeneity within families. On Gemma-4 31B, the visible false-validation error page turns a clean SQL-injection solve (about 10 turns, 0.8k reasoning tokens) into one costing an additional 39 turns and 5.5k tokens, roughly four times the interaction and seven times the reasoning, while still solving all 5/5 trials. The same trap on DeepSeek-V4 adds 42 turns and 10.7k tokens on a clean baseline of 15 turns and 2.3k tokens. A trap that costs Gemma effort but no solves costs DeepSeek both. The effect depends on the specific trap-challenge combination, not just the trap family.

Taking the Bait Is Common. Disengaging Is What Matters.

Honeytoken telemetry shows that agents frequently interact with decoy routes: 39 to 57% of trapped runs take the bait. But bait-taking does not track fragility in the way you might expect. DeepSeek-V4 is baited most (57% of runs) yet barely loses solves (87% solve rate with bait versus 85% without). Gemma-4 31B is baited least (39%) but pays a moderate price (70% with bait versus 92% without). GPT-OSS 120B is baited at an intermediate rate (47%) but collapses: 65% solve rate when it avoids the decoy, 28% when it engages it.

The difference is in what happens after contact. DeepSeek probes a decoy, recognizes that it has followed one, spends additional reasoning effort, and moves on. Gemma does the same but pays a moderate cost in both turns and tokens. GPT-OSS gets stuck. It spends a median of about 14 distinct steps on decoy routes, compared to roughly 4 for the other two models. Its reasoning-token usage does not spike at contact but instead stays elevated across many steps. The fragility is not about avoiding contact with traps. It is about disengaging from them once encountered.

Manual inspection of session transcripts suggests that agents guided by Gemma and DeepSeek often recognized the deception and moved on, while GPT-OSS persisted. Quantifying this "belief" signal automatically is left to future work, but the telemetry data already provides strong evidence that the ability to abandon a decoy path is a more reliable indicator of robustness than the ability to avoid it in the first place.

Generalization Beyond CTF and Practical Mitigations

The authors are explicit that CTF results should not be extrapolated directly to production. CTF challenges are simplified and gamified, flags are artificial, and solution paths are shorter than real-world security workflows. But the underlying mechanism generalizes wherever an agent must infer task state from partially attacker-controlled evidence. Forged "resolved" events in security logs can cause premature closure of an investigation. Comments and filenames can redirect code review. Decoy credentials or resources can divert cloud investigation. The delivery and consequences differ across settings, but the vulnerability to non-instructional deception is the same.

The paper discusses several design-level mitigations without evaluating them. Agents could preserve provenance and trust labels across tool boundaries, distinguishing between agent-generated content and environment content. They could require independent evidence before accepting success or changing goals. They could validate final results against a trusted service (as the flag checker already does in CTF, though it cannot prevent budget waste). They could bound exploration of hypotheses that repeatedly fail to produce corroborating evidence. Recovery mechanisms that checkpoint the original objective and trigger backtracking after unproductive decoy interactions would complement instruction and data separation.

The key insight is that task contamination requires defenses beyond prompt injection countermeasures. Separating instructions from data does not help when the attack is a fake result, not an injected command. The agent needs mechanisms to evaluate the reliability of evidence it encounters, not just to distinguish instructions from non-instruction content.

Limitations and What Comes Next

The trap set is narrow. All 14 traps are delivered through the DOM channel, one at a time, and are static with no adaptation to the agent's actions. The challenge corpus is 11 web CTF problems over seven vulnerability classes with short to moderate solution paths. Extending to other delivery channels (network responses, file contents, command output), combining multiple traps simultaneously, and building adaptive traps that react to agent behavior would all strengthen the evaluation.

The measurement has practical constraints. Five trials per cell is coarse, and the paper reports statistics without significance tests. The hosted model evaluation (GPT-5) covers only a subset of traps for cost reasons, so its robustness profile is incompletely characterized. There is no benign-injection control to quantify the effect of traps increasing page size, though the authors anticipate this effect is small given the size of the tested traps.

The agents are tested without information about the presence of adversaries. Providing instructions on how to identify and escape from traps would likely reduce the impact of deceptions. The paper also notes that an adaptive attacker that observes and reacts to the agent's behavior in real time would shift the results significantly, and that scenario is left to future work.

AgentLSD provides a reproducible, open-source foundation for this line of research. The framework, trap specifications, experimental configurations, and raw traces are released at github.com/Golim/agent-lsd. The framework's modularity, with reusable YAML primitives, deterministic instance generation, and paired clean-trap evaluation, makes it straightforward to extend the trap catalog, add new challenge types, and run controlled experiments on new models as they become available.

The core finding is both simple and important: clean performance on security benchmarks does not tell you how an agent behaves when its environment is contaminated with deceptive evidence. An agent that solves every clean challenge might fail half the time when the environment contains fake flags, misleading hints, and decoy endpoints. Even when it succeeds, it spends substantially more time and computation. Measuring this gap is the first step toward building agents that can resist it.

Read the paper on arXiv