Prompt injection gets worse when attackers can search harder
A successful prompt injection may depend less on a victim’s fixed weakness than on how much compute the attacker gets to hunt for one. This paper frames attacks as test-time search across the environment, user task, and injection surface, then gives an agentic attacker a reconnaissance and evaluation harness. More attacker compute improved discovery and exploitation, making attack budgets a necessary part of agent security benchmarks.