Quick Injection: Slided into a README, a malicious directive is followed 2.6 times more often than in a code file

With identical content, the location of an injection changes everything: AI agents implicitly give more confidence to certain areas of their environment.

Studies on indirect prompt injection focus mainly on the content of malicious instructions. This work focuses on their location. The researchers built three test benches for AI agents, covering tool use, programming and everyday office tasks, with many surfaces to hide an injection.

For strictly identical text, the vulnerability varies depending on where the instruction is placed. An agent based on GPT-5.4 obeys on average 2.6 times more often a dangerous instruction inserted in a documentation file, such as a README or a TODO list, than in a code or data file. The authors speak of the "confidence zone effect": the agent implicitly prioritizes the credibility of the different parts of its environment.

To measure the scope of the phenomenon, the team trained attackers who choose both the text of the injection and its location, which strengthens the attacks. According to them, defenses will now have to take this unequal trust into account.