New research: agents don't 'decide' to obey a prompt injection all at once — the choice unfolds as they reason
A new study questions the common belief that whether an AI agent falls for a prompt injection is settled the moment it reads the malicious text. The researchers built a branching-rollout technique on AgentDojo benchmarks: they replayed an agent's run up to the point it encounters an injected instruction, then let the rest of the episode play out many different ways to measure how much of the final outcome was already locked in versus still open. For a Qwen3 agent running without extended reasoning, 91% of the outcome was already determined at that moment; switching on reasoning ('thinking') cut that figure to 62%, showing the agent's compliance decision often keeps forming well after it first sees the attack. Enabling reasoning also cut Qwen3's susceptibility to successful attacks, but made two other tested models more vulnerable, and benchmark scores for reasoning agents flipped on a rerun as often as 35% of the time.