Prompt Injection Breaks the Transcript Assumption | The Agentic Stack

Indirect prompt injection is being stress-tested from three directions at once, and the shared assumption underneath current agent security practice is what's under pressure. Three papers published within nine days of each other reframe the problem: ECLIPSE describes a self-evolving attack built for long-horizon agentic sessions, a second paper recasts injection payloads as something found by test-time search rather than authored by hand, and a third evaluates multimodal injections against agentic frameworks instead of isolated models. A practitioner piece from the same week describes these injections as hidden from human overview. This episode names the failing assumption rather than cataloguing attacks: detection placed at the transcript level, output scanning and human review, is the layer all three are aimed past. We cover what actually changed, one practical shift for builders — move enforcement to the action layer and treat retrieved content as attacker-controlled input by default — and one limitation worth saying out loud, which is that none of this names a specific vulnerable framework. 

**Keywords:** indirect prompt injection, agentic AI security, long-horizon agents, multimodal prompt injection, test-time search attack, agent framework security, tool-using agents, AI agent guardrails, prompt injection benchmarks, agent orchestration security, ECLIPSE attack, LLM agent security