{"id":6964,"date":"2026-11-06T08:50:14","date_gmt":"2026-11-06T08:50:14","guid":{"rendered":"https:\/\/i10xnews.kinsta.cloud\/?p=6964"},"modified":"2026-11-06T08:50:14","modified_gmt":"2026-11-06T08:50:14","slug":"amazon-prompt-injection-task-tampering-study","status":"publish","type":"post","link":"https:\/\/i10x.ai\/news\/amazon-prompt-injection-task-tampering-study","title":{"rendered":"Amazon Study: Prompt Injection Defenses Miss Task Tampering"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">\u26a1 Quick Take<\/h2>\n\n\n<ul class=\"wp-block-list\"><li><strong>The finding:<\/strong> Amazon Responsible AI&#8217;s new benchmark shows that indirect prompt injection is not only &#8220;ignore previous instructions.&#8221; Across 90 task-tampering cases, attacks that rewrite decision rules, available actions or world state beat classic objective overrides on undefended agents (mean ASR 21.2%, 19.0% and 18.6% vs 15.0%).<\/li><li><strong>Defense blind spot:<\/strong> A strong detection-and-removal defense (DRIFT-isolation) cut objective attacks to 2.4% success but left observation- and state-targeting attacks at 9.5% and 12.1%.<\/li><li><strong>Tool policies barely help:<\/strong> Progent-style tool allowlists still allowed 15.4% attack success, near the 17.0% undefended mean, because tampering usually keeps the tools the benign task already needs.<\/li><\/ul>\n\n\n<p class=\"wp-block-paragraph\">LLM agents in enterprise workflows read third-party email, tickets, PRs and dispute evidence, then call tools with side effects. Most indirect prompt-injection (IPI) benchmarks plant attacker instructions that <em>redirect<\/em> the agent to a new task. A preprint from Amazon Responsible AI, &#8220;Beyond Instruction Override: Benchmarking Indirect Prompt Injection with Task-Tampering Attacks,&#8221; argues that real attackers can instead corrupt the outcome of the task already underway\u2014for example, inflating a refund while the agent still &#8220;resolves the dispute.&#8221;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\ud83d\udd2c What the study shows<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The authors redefine IPI by <strong>authority<\/strong>, not wording: planted content is an attack when it tries to decide something its source is not authorized to decide. They build 90 validated cases across Productivity, DevOps and Marketplace environments (28\/31\/31 cases; 1,343 single-primitive attacks plus 90 compound attacks) and score whether a predefined harmful deviation occurs.<\/p>\n\n\n<ul class=\"wp-block-list\"><li><strong>Six influence primitives:<\/strong> Each case holds the harmful outcome fixed and varies which belief the planted content targets\u2014objective b(U), decision rules b(\u03c0), consequences b(T), available actions b(A), observation interpretation b(O), or world state b(s).<\/li><li><strong>Undefended mean ASR is 17.0%:<\/strong> Across DeepSeek V3.1, Kimi K2.5, Claude Sonnet 4, Claude Sonnet 4.5 and GLM-5 (Amazon Bedrock, temperature 0), model ASRs range from 11.1% (Sonnet 4.5) to 23.2% (DeepSeek). Benign task success without injection averages 95.3%.<\/li><li><strong>Non-objective attacks win more often:<\/strong> Without defenses, mean ASR is 21.2% for rules, 19.0% for action space and 18.6% for state, versus 15.0% for objective overrides (Table 3).<\/li><li><strong>Detection defenses overfit to instruction-like attacks:<\/strong> DRIFT-isolation reaches 6.6% mean ASR with high utility (98.0% \/ 93.3% benign \/ attacked TSR) but drops b(U) to 2.4% while leaving b(O) at 9.5% and b(s) at 12.1%. The isolator fully strips 52.7\u201359.5% of carriers overall, yet 78.2\u201385.1% of b(U) attacks versus only 26.2\u201334.3% of b(O)\/b(s).<\/li><li><strong>Tool-gate defenses miss value tampering:<\/strong> Progent stays near undefended ASR (15.4% vs 17.0%) while cutting benign TSR to 74.9%. Emitted attacked calls are blocked only 0\u20139.7% of the time. CaMeL reaches 1.3% ASR but collapses utility to 13.3% benign TSR.<\/li><\/ul>\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1344\" height=\"768\" src=\"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/11\/chart-task-tampering-asr-defenses.webp\" alt=\"Horizontal bar chart of mean attack success rates: no defense 17.0%, rules 21.2%, objective 15.0%, DRIFT-iso 6.6% overall with state 12.1%, observation 9.5%, objective 2.4%, Progent 15.4%, CaMeL 1.3%.\" class=\"wp-image-6963\" srcset=\"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/chart-task-tampering-asr-defenses.webp 1344w, https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/chart-task-tampering-asr-defenses-300x171.webp 300w, https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/chart-task-tampering-asr-defenses-1024x585.webp 1024w, https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/chart-task-tampering-asr-defenses-768x439.webp 768w\" sizes=\"auto, (max-width: 1344px) 100vw, 1344px\" \/><figcaption class=\"wp-element-caption\">i10X chart based on data from Zhang et al. (2026), arXiv:2611.07640, Table 3.<\/figcaption><\/figure>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Defense<\/th><th>Mean ASR %<\/th><th>Benign TSR %<\/th><th>Note<\/th><\/tr><\/thead><tbody><tr><td>None<\/td><td>17.0<\/td><td>95.3<\/td><td>b(\u03c0)\/b(A)\/b(s) beat b(U)<\/td><\/tr><tr><td>DRIFT-isolation<\/td><td>6.6<\/td><td>98.0<\/td><td>b(U) 2.4; b(O) 9.5; b(s) 12.1<\/td><\/tr><tr><td>Sandwich<\/td><td>10.4<\/td><td>98.5<\/td><td>Prompt defense<\/td><\/tr><tr><td>Progent<\/td><td>15.4<\/td><td>74.9<\/td><td>Near undefended ASR<\/td><\/tr><tr><td>CaMeL<\/td><td>1.3<\/td><td>13.3<\/td><td>Strong security, poor utility<\/td><\/tr><\/tbody><\/table><figcaption class=\"wp-element-caption\">Selected rows from Zhang et al. (2026), arXiv:2611.07640, Table 3 (unweighted means across five models).<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Human case validation reached 91.9% overall agreement on the three validity conditions. Trajectory labels (Claude Opus 4.6) show Sonnet 4.5 resists planted content more often than GLM-5 (44.3% vs 25.1%) and flags manipulation especially on objective attacks.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\u2705 Why it matters: IPI evals that only redirect the task flatter defenses<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The benchmark keeps the benign task, attacker role and harmful outcome fixed while swapping the influence channel. That isolates whether a defense actually covers authority abuse, or merely catches instruction-shaped text. The gap under DRIFT after detection-optimized rewrites shows the blind spot is structural, not a wording quirk.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\ud83e\uddea Method in brief<\/h2>\n\n\n<ul class=\"wp-block-list\"><li><strong>Environments:<\/strong> Company productivity assistant, open-source maintainer bot, marketplace dispute agent\u2014each with explicit trust hierarchies (internal records outrank party claims, and so on).<\/li><li><strong>Models:<\/strong> DeepSeek V3.1, Kimi K2.5, Claude Sonnet 4, Claude Sonnet 4.5, GLM-5 as ReAct agents on MCP tool servers.<\/li><li><strong>Defenses:<\/strong> Spotlighting, Sandwich, DRIFT-iso, DRIFT-full, Progent, CaMeL, ARGUS.<\/li><li><strong>Metrics:<\/strong> ASR (harmful deviation under attack) and TSR (task success with\/without injection).<\/li><li><strong>Artifacts:<\/strong> Code and data at amazon-science\/task-tampering-prompt-injection (CC BY-NC 4.0).<\/li><\/ul>\n\n\n<h2 class=\"wp-block-heading\">\u2753 What remains open<\/h2>\n\n\n<ul class=\"wp-block-list\"><li><strong>Simulated only:<\/strong> Fictional orgs and tools; attacks do not transfer to production without redesign.<\/li><li><strong>Utility tradeoffs:<\/strong> The strongest provenance defense (CaMeL) is currently too restrictive for many workflows.<\/li><li><strong>Model set:<\/strong> No GPT-family agent in the main five; Claude results may not generalize to every stack.<\/li><li><strong>Dual use:<\/strong> The paper catalogues attack forms; authors argue passive, environment-specific cases mainly help defenders enumerate surface area.<\/li><li><strong>AI-assisted construction:<\/strong> Claude Code helped draft cases and code; humans reviewed validity and all reported numbers are scripted from run records.<\/li><\/ul>\n\n\n<h2 class=\"wp-block-heading\">\ud83e\udded Context: From AgentDojo redirects to authority abuse<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">OWASP ranks prompt injection a top LLM risk. Benchmarks such as AgentDojo largely stress instruction-bearing redirects. This Amazon work sits beside that line by insisting on task <em>tampering<\/em>: the agent still pursues the user&#8217;s job while an unauthorized source rewrites amounts, policies or state. That is closer to how fraud and insider content look in customer support and DevOps. Related i10X coverage includes <a href=\"\/news\/pretraining-poisoning-agentic-backdoors-study\">pretraining poisoning of agents<\/a> and <a href=\"\/news\/claude-mythos-glasswing-cyber-defense-study\">Claude Mythos cyber-defense field results<\/a>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\ud83d\udee0\ufe0f What it means for agent builders and security teams<\/h2>\n\n\n<ul class=\"wp-block-list\"><li><strong>Screen for authority, not just jailbreak phrasing:<\/strong> Ask whether a source may set the contested field (refund amount, merge decision, recipient).<\/li><li><strong>Do not equate tool allowlists with IPI defense:<\/strong> If the malicious call uses an expected tool with a poisoned argument, allowlists will mostly wave it through.<\/li><li><strong>Test observation and state attacks:<\/strong> If your red team only plants &#8220;ignore previous instructions,&#8221; you will overestimate DRIFT-like isolators.<\/li><li><strong>Watch utility:<\/strong> Ultra-strict provenance (CaMeL-style) can crush benign completion; pick defenses that keep TSR near 90%+.<\/li><li>Teams shipping on <a href=\"\/news\/product\/claude\">Claude<\/a> or other Bedrock models should add task-tampering cases to release gates alongside classic IPI suites. More on our <a href=\"\/news\/category\/security-defense\">Security &amp; Defense<\/a> hub and <a href=\"\/news\/company\/anthropic\">Anthropic<\/a> coverage.<\/li><\/ul>\n\n\n<h2 class=\"wp-block-heading\">\u270d\ufe0f About the analysis<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">This article is based on the full text of Zhang, Bertran, Avula, Lee and Murdock (2026), arXiv:2611.07640v1 (cs.CR, submitted November 5, 2026), including Table 3 and the reproducibility statement. All numbers come from the paper; i10X did not rerun the benchmark. The preprint is CC BY 4.0; accompanying code\/data are CC BY-NC 4.0. The chart was redrawn by i10X from Table 3. AI tools assisted with research and drafting; selection, fact-checking and final editing were done by the i10X editorial team. See also <a href=\"\/news\/category\/studies\/safety-alignment\">Safety &amp; Alignment studies<\/a>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\ud83d\udd2d i10x Perspective<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Prompt injection is graduating from meme jailbreaks to quiet corruption of business decisions. If your agent can move money, merge code or change access, defenses that only hunt for &#8220;ignore the user&#8221; are solving yesterday&#8217;s demo. Authority-aware checks\u2014and evals that reward them\u2014are the next bar.<\/p>\n\n","protected":false},"excerpt":{"rendered":"<p>Amazon Responsible AI&#8217;s 90-case benchmark finds rule, action and state attacks beat classic instruction overrides, and detection defenses leave 9.5\u201312.1% residual ASR on observation and state.<\/p>\n","protected":false},"author":2,"featured_media":6962,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"paper_title":"Beyond Instruction Override: Benchmarking Indirect Prompt Injection with Task-Tampering Attacks","paper_url":"https:\/\/arxiv.org\/abs\/2611.07640","pdf_url":"https:\/\/arxiv.org\/pdf\/2611.07640v1","doi":"","arxiv_id":"2611.07640","authors":"Rongting Zhang, Martin Bertran, Sandeep Avula, Chia-Jung Lee, Vanessa Murdock","institutions":"Amazon Responsible AI","paper_date":"2026-11-05","venue":"Preprint (arXiv cs.CR, version 1)","peer_reviewed":false,"code_url":"https:\/\/github.com\/amazon-science\/task-tampering-prompt-injection","data_url":"https:\/\/github.com\/amazon-science\/task-tampering-prompt-injection","funding_coi":"Amazon Responsible AI authors. AI use statement: Claude Code assisted dataset\/code\/drafting; authors reviewed and take responsibility. Ethics: simulated environments only.","figure_license":"Own chart redrawn from Table 3 (paper CC BY 4.0; do not reuse paper figures under NC code license concerns)","paper_license":"CC BY 4.0 (paper); code\/data CC BY-NC 4.0","replication":"yes","study_models":"DeepSeek V3.1, Kimi K2.5, Claude Sonnet 4, Claude Sonnet 4.5, GLM-5 (Amazon Bedrock); Claude Opus 4.6 for trajectory annotation","study_sample":"90 validated cases across 3 environments; 1,343 single-primitive + 90 compound attacks; 7 defenses","footnotes":"","_yoast_wpseo_primary_category":""},"categories":[54,28,52],"tags":[],"companies":[39,46],"products":[51],"class_list":["post-6964","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-safety-alignment","category-security-defense","category-studies","company-anthropic","company-deepseek","product-claude"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.7 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Amazon: Prompt Injection Defenses Miss Task Tampering - i10X News<\/title>\n<meta name=\"description\" content=\"Amazon&#039;s 90-case IPI benchmark: rule\/state attacks beat instruction overrides; DRIFT cuts objective ASR to 2.4% but leaves 9.5\u201312.1% residual.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/i10xnews.kinsta.cloud\/amazon-prompt-injection-task-tampering-study\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Amazon: Prompt Injection Defenses Miss Task Tampering - i10X News\" \/>\n<meta property=\"og:description\" content=\"Amazon&#039;s 90-case IPI benchmark: rule\/state attacks beat instruction overrides; DRIFT cuts objective ASR to 2.4% but leaves 9.5\u201312.1% residual.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/i10xnews.kinsta.cloud\/amazon-prompt-injection-task-tampering-study\" \/>\n<meta property=\"og:site_name\" content=\"i10X News\" \/>\n<meta property=\"article:published_time\" content=\"2026-11-06T08:50:14+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/11\/amazon-prompt-injection-task-tampering-study-title.webp\" \/>\n\t<meta property=\"og:image:width\" content=\"1344\" \/>\n\t<meta property=\"og:image:height\" content=\"768\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/webp\" \/>\n<meta name=\"author\" content=\"Christopher Ort\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@i10x_ai\" \/>\n<meta name=\"twitter:site\" content=\"@i10x_ai\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Christopher Ort\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"NewsArticle\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/amazon-prompt-injection-task-tampering-study#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/amazon-prompt-injection-task-tampering-study\"},\"author\":{\"name\":\"Christopher Ort\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/person\\\/d410bb7ee72febefca2c9c369939219a\"},\"headline\":\"Amazon Study: Prompt Injection Defenses Miss Task Tampering\",\"datePublished\":\"2026-11-06T08:50:14+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/amazon-prompt-injection-task-tampering-study\"},\"wordCount\":1060,\"publisher\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/amazon-prompt-injection-task-tampering-study#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/amazon-prompt-injection-task-tampering-study-title.webp\",\"articleSection\":[\"Safety &amp; Alignment\",\"Security &amp; Defense\",\"Studies\"],\"inLanguage\":\"en-US\",\"dateModified\":\"2026-11-06T08:50:14+00:00\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/amazon-prompt-injection-task-tampering-study\",\"url\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/amazon-prompt-injection-task-tampering-study\",\"name\":\"Amazon: Prompt Injection Defenses Miss Task Tampering - i10X News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/amazon-prompt-injection-task-tampering-study#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/amazon-prompt-injection-task-tampering-study#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/amazon-prompt-injection-task-tampering-study-title.webp\",\"datePublished\":\"2026-11-06T08:50:14+00:00\",\"description\":\"Amazon's 90-case IPI benchmark: rule\\\/state attacks beat instruction overrides; DRIFT cuts objective ASR to 2.4% but leaves 9.5\u201312.1% residual.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/amazon-prompt-injection-task-tampering-study#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/amazon-prompt-injection-task-tampering-study\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/amazon-prompt-injection-task-tampering-study#primaryimage\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/amazon-prompt-injection-task-tampering-study-title.webp\",\"contentUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/amazon-prompt-injection-task-tampering-study-title.webp\",\"width\":1344,\"height\":768,\"caption\":\"Illustration: i10X\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/amazon-prompt-injection-task-tampering-study#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/i10x.ai\\\/news\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Amazon Study: Prompt Injection Defenses Miss Task Tampering\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#website\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\",\"name\":\"i10X News\",\"description\":\"Stay updated with the latest news and announcements from i10X.\",\"publisher\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/i10x.ai\\\/news?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\",\"name\":\"i10X\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/i10x-logo-180.png\",\"contentUrl\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/i10x-logo-180.png\",\"width\":180,\"height\":180,\"caption\":\"i10X\"},\"image\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/i10x_ai\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/i10x-ai\",\"https:\\\/\\\/instagram.com\\\/i10x.ai\",\"https:\\\/\\\/www.youtube.com\\\/@i10X_ai_official\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/person\\\/d410bb7ee72febefca2c9c369939219a\",\"name\":\"Christopher Ort\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/christopher-ort-192.webp\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/christopher-ort-192.webp\",\"contentUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/christopher-ort-192.webp\",\"caption\":\"Christopher Ort\"},\"description\":\"Christopher Ort handles SEO, AI agent workflows and PR & partnerships at i10x.ai, the all-in-one AI workspace built by i10X Global Pte. Ltd. in Singapore. He is a graduate of Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU). He is the author of \u201cThe Style Penalty\u201d, a study published on SSRN that analyses 1,576 evaluation decisions by four frontier AI models to show how AI-written CVs fare in automated hiring screens; the research has been covered by heise online and t3n.\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/author\\\/christopher-ort\",\"sameAs\":[\"https:\\\/\\\/i10x.ai\\\/blog\\\/author\\\/christopher-ort\"],\"worksFor\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\"},\"alumniOf\":{\"@type\":\"EducationalOrganization\",\"name\":\"Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU)\",\"url\":\"https:\\\/\\\/www.fau.eu\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Amazon: Prompt Injection Defenses Miss Task Tampering - i10X News","description":"Amazon's 90-case IPI benchmark: rule\/state attacks beat instruction overrides; DRIFT cuts objective ASR to 2.4% but leaves 9.5\u201312.1% residual.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/i10xnews.kinsta.cloud\/amazon-prompt-injection-task-tampering-study","og_locale":"en_US","og_type":"article","og_title":"Amazon: Prompt Injection Defenses Miss Task Tampering - i10X News","og_description":"Amazon's 90-case IPI benchmark: rule\/state attacks beat instruction overrides; DRIFT cuts objective ASR to 2.4% but leaves 9.5\u201312.1% residual.","og_url":"https:\/\/i10xnews.kinsta.cloud\/amazon-prompt-injection-task-tampering-study","og_site_name":"i10X News","article_published_time":"2026-11-06T08:50:14+00:00","og_image":[{"width":1344,"height":768,"url":"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/11\/amazon-prompt-injection-task-tampering-study-title.webp","type":"image\/webp"}],"author":"Christopher Ort","twitter_card":"summary_large_image","twitter_creator":"@i10x_ai","twitter_site":"@i10x_ai","twitter_misc":{"Written by":"Christopher Ort","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"NewsArticle","@id":"https:\/\/i10xnews.kinsta.cloud\/amazon-prompt-injection-task-tampering-study#article","isPartOf":{"@id":"https:\/\/i10xnews.kinsta.cloud\/amazon-prompt-injection-task-tampering-study"},"author":{"name":"Christopher Ort","@id":"https:\/\/i10x.ai\/news\/#\/schema\/person\/d410bb7ee72febefca2c9c369939219a"},"headline":"Amazon Study: Prompt Injection Defenses Miss Task Tampering","datePublished":"2026-11-06T08:50:14+00:00","mainEntityOfPage":{"@id":"https:\/\/i10xnews.kinsta.cloud\/amazon-prompt-injection-task-tampering-study"},"wordCount":1060,"publisher":{"@id":"https:\/\/i10x.ai\/news\/#organization"},"image":{"@id":"https:\/\/i10xnews.kinsta.cloud\/amazon-prompt-injection-task-tampering-study#primaryimage"},"thumbnailUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/amazon-prompt-injection-task-tampering-study-title.webp","articleSection":["Safety &amp; Alignment","Security &amp; Defense","Studies"],"inLanguage":"en-US","dateModified":"2026-11-06T08:50:14+00:00"},{"@type":"WebPage","@id":"https:\/\/i10xnews.kinsta.cloud\/amazon-prompt-injection-task-tampering-study","url":"https:\/\/i10xnews.kinsta.cloud\/amazon-prompt-injection-task-tampering-study","name":"Amazon: Prompt Injection Defenses Miss Task Tampering - i10X News","isPartOf":{"@id":"https:\/\/i10x.ai\/news\/#website"},"primaryImageOfPage":{"@id":"https:\/\/i10xnews.kinsta.cloud\/amazon-prompt-injection-task-tampering-study#primaryimage"},"image":{"@id":"https:\/\/i10xnews.kinsta.cloud\/amazon-prompt-injection-task-tampering-study#primaryimage"},"thumbnailUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/amazon-prompt-injection-task-tampering-study-title.webp","datePublished":"2026-11-06T08:50:14+00:00","description":"Amazon's 90-case IPI benchmark: rule\/state attacks beat instruction overrides; DRIFT cuts objective ASR to 2.4% but leaves 9.5\u201312.1% residual.","breadcrumb":{"@id":"https:\/\/i10xnews.kinsta.cloud\/amazon-prompt-injection-task-tampering-study#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/i10xnews.kinsta.cloud\/amazon-prompt-injection-task-tampering-study"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i10xnews.kinsta.cloud\/amazon-prompt-injection-task-tampering-study#primaryimage","url":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/amazon-prompt-injection-task-tampering-study-title.webp","contentUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/amazon-prompt-injection-task-tampering-study-title.webp","width":1344,"height":768,"caption":"Illustration: i10X"},{"@type":"BreadcrumbList","@id":"https:\/\/i10xnews.kinsta.cloud\/amazon-prompt-injection-task-tampering-study#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/i10x.ai\/news"},{"@type":"ListItem","position":2,"name":"Amazon Study: Prompt Injection Defenses Miss Task Tampering"}]},{"@type":"WebSite","@id":"https:\/\/i10x.ai\/news\/#website","url":"https:\/\/i10x.ai\/news","name":"i10X News","description":"Stay updated with the latest news and announcements from i10X.","publisher":{"@id":"https:\/\/i10x.ai\/news\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/i10x.ai\/news?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/i10x.ai\/news\/#organization","name":"i10X","url":"https:\/\/i10x.ai\/news\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i10x.ai\/news\/#\/schema\/logo\/image\/","url":"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/10\/i10x-logo-180.png","contentUrl":"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/10\/i10x-logo-180.png","width":180,"height":180,"caption":"i10X"},"image":{"@id":"https:\/\/i10x.ai\/news\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/i10x_ai","https:\/\/www.linkedin.com\/company\/i10x-ai","https:\/\/instagram.com\/i10x.ai","https:\/\/www.youtube.com\/@i10X_ai_official"]},{"@type":"Person","@id":"https:\/\/i10x.ai\/news\/#\/schema\/person\/d410bb7ee72febefca2c9c369939219a","name":"Christopher Ort","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/christopher-ort-192.webp","url":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/christopher-ort-192.webp","contentUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/christopher-ort-192.webp","caption":"Christopher Ort"},"description":"Christopher Ort handles SEO, AI agent workflows and PR & partnerships at i10x.ai, the all-in-one AI workspace built by i10X Global Pte. Ltd. in Singapore. He is a graduate of Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU). He is the author of \u201cThe Style Penalty\u201d, a study published on SSRN that analyses 1,576 evaluation decisions by four frontier AI models to show how AI-written CVs fare in automated hiring screens; the research has been covered by heise online and t3n.","url":"https:\/\/i10x.ai\/news\/author\/christopher-ort","sameAs":["https:\/\/i10x.ai\/blog\/author\/christopher-ort"],"worksFor":{"@id":"https:\/\/i10x.ai\/news\/#organization"},"alumniOf":{"@type":"EducationalOrganization","name":"Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU)","url":"https:\/\/www.fau.eu"}}]}},"_links":{"self":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts\/6964","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/comments?post=6964"}],"version-history":[{"count":1,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts\/6964\/revisions"}],"predecessor-version":[{"id":6966,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts\/6964\/revisions\/6966"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/media\/6962"}],"wp:attachment":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/media?parent=6964"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/categories?post=6964"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/tags?post=6964"},{"taxonomy":"company","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/companies?post=6964"},{"taxonomy":"product","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/products?post=6964"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}