{"version":1,"type":"story","url":"https://digestai.news/story/study-finds-most-llm-agent-decisions-on-prompt-injections-are-set-at-r","json":"https://digestai.news/story/study-finds-most-llm-agent-decisions-on-prompt-injections-are-set-at-r.json","markdown":"https://digestai.news/story/study-finds-most-llm-agent-decisions-on-prompt-injections-are-set-at-r.md","slug":"study-finds-most-llm-agent-decisions-on-prompt-injections-are-set-at-r","headline":"Study finds most LLM agent decisions on prompt injections are set at read time","summary":"Researchers examined how LLM agents handle prompt injections by replaying episodes up to the moment an injection is read and then resampling the remainder many times. Across four AgentDojo suites they measured that a Qwen3 agent without chain‑of‑thought reasoning has 0.91 of the outcome variance fixed at read time. Adding reasoning lowers this share to 0.62 (95 % CI [-0.38, -0.22]) and reduces attack success for Qwen3, while the same reasoning raises success for two other unnamed models.\n\nThe study also shows that zero‑shot chain‑of‑thought monitors built on cheaper models miss much of the already‑decided behavior, whereas stronger or look‑ahead monitors approximate the decision formed in the reasoning prefix. Single‑run labels for thinking agents disagree with reruns up to 35 % of the time, suggesting that benchmarks should use repeated runs per task to capture true performance.","keyPoints":["0.91 of outcome variance for Qwen3 without reasoning is decided when the injection is read","Chain‑of‑thought reasoning drops the fixed share to 0.62 (95 % CI [-0.38, -0.22]) and lowers attack success for Qwen3","Single‑run labels for thinking agents diverge from reruns up to 35 %, urging repeated benchmark runs"],"whyItMatters":"Knowing when an LLM agent commits to a decision informs more effective defenses against prompt‑injection attacks and improves the reliability of agent benchmarks as these systems move into critical applications.","category":{"slug":"research","name":"Research","url":"https://digestai.news/category/research"},"entities":{"companies":[],"models":["Qwen3"],"people":[]},"firstPublishedAt":"2026-10-20T04:00:00Z","updatedAt":"2026-10-20T04:00:00Z","sourceCount":1,"hasPrimarySource":true,"sources":[{"outlet":"arXiv cs.CL","title":"The Window Is in the Reasoning: When LLM Agents Decide to Follow Prompt Injections","url":"https://arxiv.org/abs/2610.24048","publishedAt":"2026-10-20T04:00:00Z","type":"primary","primary":true,"lead":true}],"sourceNotes":null,"discussions":[],"thread":{"title":"Uncovering Hidden Flaws in AI Reasoning","url":"https://digestai.news/thread/researchers-find-qwen3s-reasoning-gains-may-stem-from-thinking-leakage","storyCount":2},"cite":{"text":"Digest AI, \"Study finds most LLM agent decisions on prompt injections are set at read time\", 20 October 2026, https://digestai.news/story/study-finds-most-llm-agent-decisions-on-prompt-injections-are-set-at-r","publisher":"Digest AI","title":"Study finds most LLM agent decisions on prompt injections are set at read time","datePublished":"2026-10-20T04:00:00Z","url":"https://digestai.news/story/study-finds-most-llm-agent-decisions-on-prompt-injections-are-set-at-r"},"generatedBy":"Written by Digest AI's editorial model from the linked sources; the sources are the record.","license":"Headlines, digests and key points are written by Digest AI and may be quoted with a link to the story page. Linked articles belong to their publishers. Terms: https://digestai.news/terms#reuse"}