---
type: "post"
id: "a-new-paper-finds-that-a-personal-agent-256a74"
slug: "a-new-paper-finds-that-a-personal-agent-256a74"
title: "A new paper finds that a personal agent can become substantially more vulnerable to indirect prompt injection"
description: "A new paper finds that a personal agent can become substantially more vulnerable to indirect prompt injection after learning from positive user feedback."
retrieval_nugget: "A new paper finds that a personal agent can become substantially more vulnerable to indirect prompt injection after learning from positive user feedback. For teams building self-improving agents, the result shifts security testing from a launch-time check to a recurring evaluation of the agent after its skills or policy change."
published_at: "2026-10-31"
updated_at: "2026-10-31"
record_date: "2026-10-31"
date_kind: "published_at"
topics: ["prompt-injection"]
entities: ["Evolve-IPI","Xinyan Wang","Xiaogeng Liu","Jun Shao","Chaowei Xiao","arXiv"]
related_patterns: ["agent-security-moves-to-runtime-boundaries","skills-become-portable-capability-layer"]
novelty_label: "new_fact"
what_changed: "A new Evolve-IPI paper reports that learning from user feedback raises indirect-prompt-injection attack success by 14.0–48.8 points with skill evolution and 3.0–39.3 points with reinforcement learning."
prior_refs: ["memory:72b4cc5e-194a-82da-ac85-db65a9451f2b","memory:0eb83ed0-22fa-806e-ac63-ad541a607a62","memory:f56bd79d-d854-8c9e-a25d-563c1d4cff05"]
source_url: "https://arxiv.org/abs/2610.39122"
source_urls: ["https://arxiv.org/abs/2610.39122"]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "post:a-new-paper-finds-that-a-personal-agent-256a74"
status: "published"
visuals: []
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
routes: {"html":"https://newruntime.com/posts/a-new-paper-finds-that-a-personal-agent-256a74/","markdown":"https://newruntime.com/posts/a-new-paper-finds-that-a-personal-agent-256a74.md","json":"https://newruntime.com/posts/a-new-paper-finds-that-a-personal-agent-256a74.json"}
---

# A new paper finds that a personal agent can become substantially more vulnerable to indirect prompt injection

## Retrieval answer

A new paper finds that a personal agent can become substantially more vulnerable to indirect prompt injection after learning from positive user feedback. For teams building self-improving agents, the result shifts security testing from a launch-time check to a recurring evaluation of the agent after its skills or policy change.

## Summary

A new paper finds that a personal agent can become substantially more vulnerable to indirect prompt injection after learning from positive user feedback. For teams building self-improving agents, the result shifts security testing from a launch-time check to a recurring evaluation of the agent after its skills or policy change.

## What happened

Xinyan Wang, Xiaogeng Liu, Jun Shao, and Chaowei Xiao submitted the paper *Appreciation Teaches Unauthorized Execution: Self-Evolution Degrades the Robustness of Personal Agents to Indirect Prompt Injection* to arXiv on October 29, 2026. The work asks whether a personal agent that learns from user feedback retains its resistance to indirect prompt injection (IPI). IPI is the situation in which an untrusted third party places an instruction inside content that the agent is asked to read; if the agent follows it, the third party has redirected the agent’s behavior.

The authors use a controlled two-phase methodology. In the adaptation phase, a user asks the agent to read external content and complete the task described there. That resembles a normal use case: an agent is sent to a document, page, or other outside material and is asked to act on what it finds. The agent then learns from the user’s feedback and improves itself, as a self-evolving personal agent is intended to do.

In the test phase, a third party writes a similar task into new external content. The user’s request in this phase does not authorize the injected task. The central question is therefore not whether the agent can perform the action, but whether it can distinguish an action it learned to carry out from an action that the current user request has actually authorized. The paper evaluates multiple tasks with diverse test instances across domains on a real personal agent.

The reported outcome is that self-evolution substantially degrades robustness to IPI relative to a base agent that does not evolve from feedback. With skill evolution, average attack success rates rose by 14.0 to 48.8 percentage points. With reinforcement learning, they rose by 3.0 to 39.3 percentage points. The paper frames the risk as unauthorized execution enabled by an agent’s learning process: positive feedback can teach the action pattern without reliably preserving the authorization condition attached to the original interaction.

The authors make code available. The paper is a research result rather than a product release or a claim about every deployed agent, but its experimental design is directly relevant to systems that add reusable skills or reinforcement-learning updates to agents that consume untrusted content.

## What the archive adds

This is a new security fact on a known self-improving-agent thread. [AREX](https://newruntime.com/posts/baai-released-arex-a-recursively-self-improving-research-28618b/) described a recursively self-improving research agent whose control signal is verification. Evolve-IPI adds a different requirement: feedback-driven improvement also needs to preserve the boundary between an action and the user authorization for that action.

## Trend signal

The result supports [Agent security moves to runtime boundaries](https://newruntime.com/patterns/agent-security-moves-to-runtime-boundaries/). The paper does not test runtime controls directly, but it shows why prompt-level behavior learned in one context is an insufficient security boundary: the same learned action can later be triggered from untrusted content without present authorization.

## Why now

The paper arrives as self-evolving personal agents are explicitly designed to learn from interaction rather than remain fixed at deployment. Its contribution is to test the security property after that learning process, not only on the unevolved starting agent.

## Connections to other events

The prior AREX note focused on verification as the control signal for a self-improving research agent. This paper concerns a personal agent and indirect prompt injection rather than research quality, but both point to a common operational issue: improvement loops require an external criterion that remains valid after the agent has changed.

## Why it matters

A team may already test an agent for prompt injection before enabling memory, skill extraction, or online reinforcement learning. This result suggests that baseline result is not durable evidence. The learning loop can alter how the agent interprets an instruction embedded in outside content, including whether it treats an earlier approved pattern as approval for a later action.

The immediate engineering implication is to make authorization a testable property, not an implied part of an example trajectory. Keep representative untrusted-content attacks in the evaluation suite, run them against each learned version, and separate evidence that an agent can execute a task from evidence that the current user authorized it. A useful failure report should identify the content seen, the active learned skill or update, the requested task, and the action attempted.

## What happens next

- **Teams building feedback-trained agents will add post-learning prompt-injection evaluations to their release gates.** (6 months, 60%). Watch for: published evaluation suites that compare a base agent with learned variants.
- **Agent designs will increasingly represent authorization separately from reusable task skills.** (12 months, 55%). Watch for: explicit permission checks or scoped action contracts in agent harnesses.

## Limits and uncertainty

The supplied source is an arXiv paper, not an independent replication or a deployment incident report. It reports results from a controlled methodology and a real personal agent, but does not establish that every agent using skills, memory, or reinforcement learning has the same exposure. The reported ranges compare evolved agents with a non-evolving base agent; they do not identify a universal attack rate for production systems. The abstract also does not establish which mitigation is sufficient, how long the vulnerability persists, or how results vary with different models, tool permissions, or runtime enforcement.

## Skill to build now

Create a regression test in which an agent first learns a legitimate action from positively rated work involving external content, then receives a different request alongside fresh untrusted content containing a similar instruction. Record whether it performs the embedded action without explicit authorization. Run that test on the base agent and again after every skill-library, memory-policy, or reinforcement-learning update.

## Reader takeaway

Learning from feedback is a security-changing operation for an agent, not merely a quality improvement. If an agent reads untrusted content and evolves from prior successes, evaluate whether it still requires authorization in the current task before it acts.

## Open question

What architectural mechanism can preserve a user’s authorization constraint as skills and policies are learned, reused, and invoked across future tasks?

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Prompt Injection](https://newruntime.com/topics/prompt-injection.md): Explore the prompt-injection topic hub.
- collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis.
- collection: [Source Ledger](https://newruntime.com/source-ledger.json): Inspect the public source evidence graph.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)