One prompt injection makes an AI agent send 51 times more calls

The authors of a new paper give an attack the name Mobius Injection. One dangerous text in content that an agent reads makes the agent start its parts again and again. In tests, one agent made a maximum of 51.0 times more calls than usual. The authors say that many such agents can fill all capacity of one backend. No other group did a check of the result.

How it works

The attack uses indirect prompt injection, which is a dangerous text in content that an agent reads. The authors add a structure that they name Semantic Closure. It makes the parts of the agent start each other in a loop.

The authors say that the attacker must do only a small quantity of work. They say that the attack can go through volume monitors and input filters. It can point at one model provider.

The numbers

The researchers used 3 claw agents and 3 agents that write code in tests. They used 12 models.

• One agent made a maximum of 51.0 times more calls.
• Correct traffic had 23 to 24 times more delay.
• Many agents used all capacity, and users could not use it.

What is not known

All results come from tests by the authors. The abstract names no repair and gives no attack in use.

Insight: The attack makes your agent a weapon against a shared provider

Tests before this one showed that prompt injection works frequently. They showed that agent frameworks operate tool calls that a model writes. This paper has a different point: the attacker uses an agent to fill the capacity that many users use. This reads as a new move: the attacker uses your agent to attack the provider. Look for limits on calls for each agent.