One incorrect risk review controls AI agents in 60.4% of tests

Researchers name the attack “voluntary servitude”. It is an attack on an AI agent, software that uses tools and web content to do tasks for a person. The attacker writes one incorrect risk warning as a usual review. The agent then removes the correct alternatives and selects the attacker target by its logic, with no command in the text.

How it works

The usual attack, instruction injection, puts a command in content that the agent reads. Defenses are made to find the syntax of a command. This attack has no command, and the injection detectors find no problem in it.

The numbers

• Control rate: 60.4% for the new attack and 66.0% for instruction injection.
• Behind a detector, the new attack gives 1.7 to 4.4 times more success.
• A rule to find one more source removes about 95% of the exposure.

The tests used 6 models and 10 consumer service fields. The authors tell that it also works on browser agents in production.

What is not known

The 95% result is against an attacker who does not adapt. The source gives no result against an attacker who does adapt. With the rule, the agent reads the incorrect warning but does not use it to select.

Insight: Rules that look for commands miss this attack

In October 2026, 3 US agencies (NIST, the NSA and CISA) gave a definition of a control incident. It covers behavior that no person told the agent to do, and not prompt injection. This paper shows that an attacker can control an agent with no command. It reads as a gap: detectors and incident rules look for commands, but this attack uses the risk checks of the agent.