What surrounds an injection decides whether it works: context and channel effects in tool-metadata attacks on seven production LLM agents. Data and code

Abstract

A data and code for a study of indirect prompt injection in tool-using large language model agents. I performed 1,334 controlled trials across seven production models. In every comparison the injected instruction is held byte-identical and only its surroundings vary, so any difference in outcome is attributable to where the text arrived or what surrounded it, not to what it said. Two effects govern whether an attack succeeds. Delivery channel: Claude Haiku 4.5 obeyed an identical instruction in 37 of 38 trials as tool metadata and 0 of 30 as tool output. Surrounding context: Claude Sonnet 4.6 complies in 4 of 38 trials when the request arrives bare, and in 86.7% to 100% once any benign task framing is present, including a system prompt that mentions nothing about tools; a placement control moving the identical text into the user turn is indistinguishable. The two effects dissociate, since the context that removes the metadata-side resistance leaves the tool-output defence at 0 of 30. A separate methodological result is distinguishing whether the agent made the attacker's tool call from whether data actually left makes the two diverge by more than five to one, because the attack template's ordering clause fires before the data even exists. The archive I uploaded contains all 1,334 raw run directories including every model response, per-run results as CSV, every injected payload and context string, the harness and drivers as they ran, and a statistics script that recomputes every proportion and p-value in exact rational arithmetic and cross-checks each against scipy. No API key is required to reproduce any published figure. Attack templates are reproduced from MCPTox (Wang et al., AAAI 2026) with the target retargeted. No real system was attacked, the file tool returns synthetic text, the email tool sends nothing, and the attacker address uses the RFC 2606 reserved .example domain.