Large language model (LLM) agents that interact with external tools are increasingly susceptible to indirect prompt injection attacks, where malicious instructions are embedded in environmental states. However, existing security research has been limited by manually constructed environments, stochastic tool simulations, and predefined injection points, hindering large-scale evaluation across diverse domains.
To address this, researchers propose ToolHazard, a scalable framework for synthesizing adversarial environments. It comprises three components: an Environment Simulator that generates executable stateful environments, an Attacker Agent that discovers viable injection points and crafts environment-specific payloads, and a User Simulator that constructs state-grounded long-horizon tasks. This design reduces human engineering effort and allows expansion with additional seed domains and compute.
Based on ToolHazard, the team built ToolHazard-Bench, a benchmark for stress-testing agents under complex workflows and diverse environmental attacks. Experiments reveal substantial agent vulnerabilities, with attack effectiveness significantly influenced by injection timing and placement.
Furthermore, alignment data generated by ToolHazard improves security on both ToolHazard-Bench and the existing AgentDojo benchmark, while preserving benign task utility. This suggests that scalable adversarial environment synthesis can be a powerful tool for both evaluating and hardening LLM agents.