{"id":7077,"date":"2026-11-10T08:06:10","date_gmt":"2026-11-10T08:06:10","guid":{"rendered":"https:\/\/i10xnews.kinsta.cloud\/?p=7077"},"modified":"2026-11-10T08:06:10","modified_gmt":"2026-11-10T08:06:10","slug":"deepmind-agent-swarm-prompt-injection-study","status":"publish","type":"post","link":"https:\/\/i10x.ai\/news\/deepmind-agent-swarm-prompt-injection-study","title":{"rendered":"Study: AI Agent Swarms Still Break Gemini&#8217;s Prompt Injection Defenses"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">\u26a1 Quick Take<\/h2>\n\n\n<ul class=\"wp-block-list\"><li><strong>The finding:<\/strong> A Google DeepMind attacker built from a swarm of 16 collaborating AI agents found working prompt injections against every model it tested. Even the most robust one, Gemini 4 Argon, resisted only 66% of scenarios at the full attack budget.<\/li><li><strong>Why it matters:<\/strong> Human red-teaming on the public GraySwan arena is close to saturation, with recent Gemini models scoring under 1% on its transfer attacks. This report argues the plateau is misleading: stronger automated attackers still get through.<\/li><li><strong>What it means:<\/strong> Attacks scale with attacker capability. Moving the attacker from Gemini 3.6 Flash to Gemini 4 Argon cut average defender resistance from 42.1% to 23.1%. The authors conclude defenses must not rely on model hardening alone.<\/li><\/ul>\n\n\n<p class=\"wp-block-paragraph\">Prompt injection is the attack where text hidden in a web page, email or tool result tells an AI agent to do something its user never asked for. By late 2026, frontier labs report that their newest models shrug off most known attacks. A technical report from Google DeepMind, &#8220;Scaling Adaptive Prompt Injection Attacks with Agent Swarms&#8221; by Alexey Kurakin and ten colleagues, tests that claim against a much stronger adversary: a team of AI agents that share notes while hunting for an injection that works. The answer is that prompt injection is &#8220;quite far from solved.&#8221;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\ud83d\udd2c What the study shows<\/h2>\n\n\n<ul class=\"wp-block-list\"><li><strong>No defender is fully robust:<\/strong> Against the strongest attacker (Gemini 4 Argon), Gemini 4 Argon as defender resisted 87% of scenarios within 150 queries and 66% at the full budget. Gemini 3.8 Flash resisted 10%, Gemini 3.7 Flash 6% and Gemini 3.6 Flash 1%.<\/li><li><strong>Open-weight models are easy targets:<\/strong> Kimi K3, GLM-5.3 and DeepSeek-V4.1-Flash each resisted just 1% of scenarios at the full budget, despite strong scores on standard capability benchmarks.<\/li><li><strong>Better attackers, weaker defenses:<\/strong> With Gemini 3.6 Flash as attacker, Gemini 4 Argon resisted 100% of attacks within 150 queries. With Gemini 4 Argon attacking itself, that fell to 87%. Mean resistance across all seven defenders dropped from 42.1% to 23.1%.<\/li><li><strong>Shared memory helps the attacker:<\/strong> When the strategy database was updated during the run, a Gemini 4 Argon attacker pushed Gemini 3.8 Flash&#8217;s resistance down to 5%, compared with 34% with a frozen database.<\/li><li><strong>Visible reasoning leaks:<\/strong> When the attacker could read the defender&#8217;s chain of thought, resistance fell, for example from 100% to 92% for Gemini 4 Argon and from 73% to 61% for Gemini 3.8 Flash.<\/li><li><strong>Beats the open baseline:<\/strong> On 80 AgentDojo scenarios against Gemini 3.6 Flash with Vertex AI&#8217;s built-in defenses on, the open-source Prompt Siren attack broke 2. The swarm approach, with GLM-5.3 as attacker, broke 6 within 25 queries.<\/li><\/ul>\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1344\" height=\"768\" src=\"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/11\/chart-prompt-injection-arr.webp\" alt=\"Bar chart: attack resistance within 150 queries for seven defender models against a Gemini 3.6 Flash attacker and a Gemini 4 Argon attacker. Gemini 4 Argon falls from 100% to 87%, Gemini 3.8 Flash from 76% to 34%, Gemini 3.7 Flash from 79% to 31%, and open-weight models to 1\u20135%.\" class=\"wp-image-7076\" srcset=\"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/chart-prompt-injection-arr.webp 1344w, https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/chart-prompt-injection-arr-300x171.webp 300w, https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/chart-prompt-injection-arr-1024x585.webp 1024w, https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/chart-prompt-injection-arr-768x439.webp 768w\" sizes=\"auto, (max-width: 1344px) 100vw, 1344px\" \/><figcaption class=\"wp-element-caption\">i10X chart based on data from Kurakin et al. (2026), Google DeepMind, arXiv:2611.11861, Table 2.<\/figcaption><\/figure>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Defender<\/th><th>Resisted within 150 queries<\/th><th>Resisted at full budget<\/th><\/tr><\/thead><tbody><tr><td>Gemini 4 Argon<\/td><td>87%<\/td><td>66%<\/td><\/tr><tr><td>Gemini 3.8 Flash<\/td><td>34%<\/td><td>10%<\/td><\/tr><tr><td>Gemini 3.7 Flash<\/td><td>31%<\/td><td>6%<\/td><\/tr><tr><td>Gemini 3.6 Flash<\/td><td>3%<\/td><td>1%<\/td><\/tr><tr><td>Kimi K3<\/td><td>5%<\/td><td>1%<\/td><\/tr><tr><td>GLM-5.3<\/td><td>1%<\/td><td>1%<\/td><\/tr><tr><td>DeepSeek-V4.1-Flash<\/td><td>1%<\/td><td>1%<\/td><\/tr><\/tbody><\/table><figcaption class=\"wp-element-caption\">Attack resistance rate (ARR) against the strongest attacker, Gemini 4 Argon, with defender reasoning hidden. From Kurakin et al. (2026), arXiv:2611.11861, Table 1.<\/figcaption><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">\u2705 Why it matters: an attacker that scales with model capability<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Most prompt-injection benchmarks use fixed payloads, which frontier models saturated by mid-2025. Adaptive attacks exist, but the authors note that almost none can be reproduced on new models because code and attacker models are rarely shared. This report adds two things. First, a dataset whose attacker goals are harmless but unrelated tool calls, so it measures whether a model respects the instruction hierarchy rather than whether it recognises something as dangerous. Second, an attacker design whose strength grows with the model behind it. The grading is strict: an attack only counts if the model calls the exact target tool with all arguments matching, which rules out partial or lucky hits. The same pipeline is run across seven defenders and four attackers, so the trend with attacker strength is visible in one table.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\ud83e\uddea Method in brief<\/h2>\n\n\n<ul class=\"wp-block-list\"><li><strong>Dataset:<\/strong> 100 synthetic tool-use scenarios built from 249 tools across 53 domains, generated and validated with Gemini. Each pairs a user task in one domain (for example tutoring) with an attacker goal in another (for example logging health data). The injection is placed in the last tool result.<\/li><li><strong>Attacker (&#8220;Agentic Optimizer&#8221;):<\/strong> 8 teams of 2 agents each, every agent limited to 20 evaluation calls, so 320 attempts per scenario at most. Agents share a team whiteboard, read team and global leaderboards, and start from a database of strategies that worked before.<\/li><li><strong>Models:<\/strong> Gemini 3.6 Flash, 3.7 Flash, 3.8 Flash and 4 Argon, plus Kimi K3, GLM-5.3 and DeepSeek-V4.1-Flash via hosted endpoints. Gemini ran without safety classifiers and with out-of-model prompt-injection defenses switched off. Defenders used high thinking, hidden from the attacker unless stated.<\/li><li><strong>Metric:<\/strong> Attack Resistance Rate (ARR), the share of scenarios where no successful injection was found, reported at 150 queries and at the full budget.<\/li><\/ul>\n\n\n<h2 class=\"wp-block-heading\">\u2753 What remains open<\/h2>\n\n\n<ul class=\"wp-block-list\"><li><strong>Defenses switched off:<\/strong> Gemini was tested without its external classifiers and out-of-model protections, so the numbers describe the model alone, not Gemini as deployed in products.<\/li><li><strong>Synthetic, benign goals:<\/strong> The scenarios are generated by Gemini and the attacker goals are harmless tool calls. The authors argue chains of benign calls can add up to real harm, but that step is not tested here.<\/li><li><strong>No error bars, no code:<\/strong> The report gives no confidence intervals or repeated runs, and neither the dataset nor the attacker is released, so outside groups cannot reproduce the numbers.<\/li><li><strong>Not peer reviewed:<\/strong> This is a technical report on arXiv. All eleven authors work at Google DeepMind, which builds the Gemini models under test.<\/li><li><strong>The link to cyber skills is suggestive:<\/strong> Attacker strength roughly tracks ExploitBench cyber scores, but the authors call this an area for future work.<\/li><\/ul>\n\n\n<h2 class=\"wp-block-heading\">\ud83e\udded Context: from static payloads to attacker swarms<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The report builds on a line of adaptive-attack work: &#8220;The attacker moves second&#8221; (Nasr et al., 2025) pushed success rates against twelve defenses from nearly 0% to over 90%, and RL-Hammer (Wen et al., 2025) trained attackers that hit GPT-5 and Gemini 2.5. On defense, the authors point to model hardening, input filters and system-level designs such as CaMeL and FIDES. Our earlier coverage of an <a href=\"\/news\/amazon-prompt-injection-task-tampering-study\">Amazon study on task tampering<\/a> found a related gap: defenses tuned to known attacks miss new ones. This report adds that the gap widens as attacker models get better.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\ud83d\udee0\ufe0f What it means for teams deploying agents<\/h2>\n\n\n<ul class=\"wp-block-list\"><li><strong>Assume the model can be talked into it:<\/strong> Even the most robust model tested failed on about a third of scenarios at full budget. Limit what tools an agent can call after reading untrusted content.<\/li><li><strong>Layer defenses:<\/strong> The authors recommend a full stack with defenses in depth: classifiers, permission checks and system designs that separate data from instructions.<\/li><li><strong>Hide reasoning from untrusted parties:<\/strong> Visible chain of thought made attacks easier in this study.<\/li><li><strong>Red-team with strong models:<\/strong> Weak automated attackers can give a false sense of safety. Re-test whenever a stronger attacker model becomes available.<\/li><\/ul>\n\n\n<p class=\"wp-block-paragraph\">More research on our <a href=\"\/news\/category\/studies\/safety-alignment\">Safety &amp; Alignment studies<\/a> page, in our <a href=\"\/news\/company\/google\">Google<\/a> coverage and on the <a href=\"\/news\/product\/gemini\">Gemini<\/a> hub.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\u270d\ufe0f About the analysis<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">This article is based on the full text of Kurakin et al. (2026), &#8220;Scaling Adaptive Prompt Injection Attacks with Agent Swarms,&#8221; Google DeepMind technical report, arXiv:2611.11861v1 (cs.CR, submitted November 9, 2026), including the dataset appendix. All numbers come from the paper. The chart was redrawn by i10X from Table 2; the paper is licensed CC BY 4.0. No external funding or conflict-of-interest statement is given; all authors are affiliated with Google DeepMind. AI tools assisted with research and drafting; selection, fact-checking and final editing were done by the i10X editorial team.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\ud83d\udd2d i10x Perspective<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">It is notable that a lab publishes evidence that its own flagship model can still be hijacked. The more uncomfortable finding is the trend: each better model is both a harder target and a better attacker. That makes prompt-injection robustness a moving benchmark, not a box to tick at launch. Releasing the scenario set, even without the attacker, would let others check how the numbers hold for non-Gemini defenders.<\/p>\n\n","protected":false},"excerpt":{"rendered":"<p>A Google DeepMind report shows a swarm of collaborating AI agents finds working prompt injections against every model tested, including Gemini 4 Argon.<\/p>\n","protected":false},"author":2,"featured_media":7075,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"paper_title":"Scaling Adaptive Prompt Injection Attacks with Agent Swarms","paper_url":"https:\/\/arxiv.org\/abs\/2611.11861","pdf_url":"https:\/\/arxiv.org\/pdf\/2611.11861","doi":"","arxiv_id":"2611.11861","authors":"Alexey Kurakin, Vishal Karande, Alex Bie, Chongyang Shi, Shuang Song, Saeed Mahloujifar, Abdullatif K\u00f6ksal, Jamie Hayes, Juliette Pluto, Yinghao Sun, Kamalika Chaudhuri","institutions":"Google DeepMind","paper_date":"2026-11-09","venue":"arXiv (cs.CR), technical report, version 1","peer_reviewed":false,"code_url":"","data_url":"","funding_coi":"No funding statement. All authors are affiliated with Google DeepMind, developer of the Gemini models tested. No conflicts of interest stated.","figure_license":"Own chart redrawn from Table 2 (paper CC BY 4.0)","paper_license":"CC BY 4.0","replication":"no","study_models":"Gemini 3.6 Flash, Gemini 3.7 Flash, Gemini 3.8 Flash, Gemini 4 Argon, Kimi K3, GLM-5.3, DeepSeek-V4.1-Flash","study_sample":"100 synthetic tool-use scenarios (249 tools, 53 domains); up to 320 attack evaluations per scenario; 80 AgentDojo scenarios for baseline comparison","footnotes":"","_yoast_wpseo_primary_category":""},"categories":[54,52],"tags":[],"companies":[46,37,47],"products":[49],"class_list":["post-7077","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-safety-alignment","category-studies","company-deepseek","company-google","company-moonshot","product-gemini"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.7 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>AI Agent Swarms Still Break Prompt Injection Defenses - i10X News<\/title>\n<meta name=\"description\" content=\"Google DeepMind study: a swarm of AI agents finds prompt injections against every model tested. Gemini 4 Argon resisted only 66% of attacks at full budget.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/i10xnews.kinsta.cloud\/deepmind-agent-swarm-prompt-injection-study\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"AI Agent Swarms Still Break Prompt Injection Defenses - i10X News\" \/>\n<meta property=\"og:description\" content=\"Google DeepMind study: a swarm of AI agents finds prompt injections against every model tested. Gemini 4 Argon resisted only 66% of attacks at full budget.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/i10xnews.kinsta.cloud\/deepmind-agent-swarm-prompt-injection-study\" \/>\n<meta property=\"og:site_name\" content=\"i10X News\" \/>\n<meta property=\"article:published_time\" content=\"2026-11-10T08:06:10+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/11\/deepmind-agent-swarm-prompt-injection-study-title.webp\" \/>\n\t<meta property=\"og:image:width\" content=\"1344\" \/>\n\t<meta property=\"og:image:height\" content=\"768\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/webp\" \/>\n<meta name=\"author\" content=\"Christopher Ort\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@i10x_ai\" \/>\n<meta name=\"twitter:site\" content=\"@i10x_ai\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Christopher Ort\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"NewsArticle\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/deepmind-agent-swarm-prompt-injection-study#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/deepmind-agent-swarm-prompt-injection-study\"},\"author\":{\"name\":\"Christopher Ort\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/person\\\/d410bb7ee72febefca2c9c369939219a\"},\"headline\":\"Study: AI Agent Swarms Still Break Gemini&#8217;s Prompt Injection Defenses\",\"datePublished\":\"2026-11-10T08:06:10+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/deepmind-agent-swarm-prompt-injection-study\"},\"wordCount\":1281,\"publisher\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/deepmind-agent-swarm-prompt-injection-study#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/deepmind-agent-swarm-prompt-injection-study-title.webp\",\"articleSection\":[\"Safety &amp; Alignment\",\"Studies\"],\"inLanguage\":\"en-US\",\"dateModified\":\"2026-11-10T08:06:10+00:00\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/deepmind-agent-swarm-prompt-injection-study\",\"url\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/deepmind-agent-swarm-prompt-injection-study\",\"name\":\"AI Agent Swarms Still Break Prompt Injection Defenses - i10X News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/deepmind-agent-swarm-prompt-injection-study#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/deepmind-agent-swarm-prompt-injection-study#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/deepmind-agent-swarm-prompt-injection-study-title.webp\",\"datePublished\":\"2026-11-10T08:06:10+00:00\",\"description\":\"Google DeepMind study: a swarm of AI agents finds prompt injections against every model tested. Gemini 4 Argon resisted only 66% of attacks at full budget.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/deepmind-agent-swarm-prompt-injection-study#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/deepmind-agent-swarm-prompt-injection-study\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/deepmind-agent-swarm-prompt-injection-study#primaryimage\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/deepmind-agent-swarm-prompt-injection-study-title.webp\",\"contentUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/deepmind-agent-swarm-prompt-injection-study-title.webp\",\"width\":1344,\"height\":768,\"caption\":\"Illustration: i10X\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/deepmind-agent-swarm-prompt-injection-study#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/i10x.ai\\\/news\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Study: AI Agent Swarms Still Break Gemini&#8217;s Prompt Injection Defenses\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#website\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\",\"name\":\"i10X News\",\"description\":\"Stay updated with the latest news and announcements from i10X.\",\"publisher\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/i10x.ai\\\/news?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\",\"name\":\"i10X\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/i10x-logo-180.png\",\"contentUrl\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/i10x-logo-180.png\",\"width\":180,\"height\":180,\"caption\":\"i10X\"},\"image\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/i10x_ai\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/i10x-ai\",\"https:\\\/\\\/instagram.com\\\/i10x.ai\",\"https:\\\/\\\/www.youtube.com\\\/@i10X_ai_official\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/person\\\/d410bb7ee72febefca2c9c369939219a\",\"name\":\"Christopher Ort\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/christopher-ort-192.webp\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/christopher-ort-192.webp\",\"contentUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/christopher-ort-192.webp\",\"caption\":\"Christopher Ort\"},\"description\":\"Christopher Ort handles SEO, AI agent workflows and PR & partnerships at i10x.ai, the all-in-one AI workspace built by i10X Global Pte. Ltd. in Singapore. He is a graduate of Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU). He is the author of \u201cThe Style Penalty\u201d, a study published on SSRN that analyses 1,576 evaluation decisions by four frontier AI models to show how AI-written CVs fare in automated hiring screens; the research has been covered by heise online and t3n.\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/author\\\/christopher-ort\",\"sameAs\":[\"https:\\\/\\\/i10x.ai\\\/blog\\\/author\\\/christopher-ort\"],\"worksFor\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\"},\"alumniOf\":{\"@type\":\"EducationalOrganization\",\"name\":\"Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU)\",\"url\":\"https:\\\/\\\/www.fau.eu\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"AI Agent Swarms Still Break Prompt Injection Defenses - i10X News","description":"Google DeepMind study: a swarm of AI agents finds prompt injections against every model tested. Gemini 4 Argon resisted only 66% of attacks at full budget.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/i10xnews.kinsta.cloud\/deepmind-agent-swarm-prompt-injection-study","og_locale":"en_US","og_type":"article","og_title":"AI Agent Swarms Still Break Prompt Injection Defenses - i10X News","og_description":"Google DeepMind study: a swarm of AI agents finds prompt injections against every model tested. Gemini 4 Argon resisted only 66% of attacks at full budget.","og_url":"https:\/\/i10xnews.kinsta.cloud\/deepmind-agent-swarm-prompt-injection-study","og_site_name":"i10X News","article_published_time":"2026-11-10T08:06:10+00:00","og_image":[{"width":1344,"height":768,"url":"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/11\/deepmind-agent-swarm-prompt-injection-study-title.webp","type":"image\/webp"}],"author":"Christopher Ort","twitter_card":"summary_large_image","twitter_creator":"@i10x_ai","twitter_site":"@i10x_ai","twitter_misc":{"Written by":"Christopher Ort","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"NewsArticle","@id":"https:\/\/i10xnews.kinsta.cloud\/deepmind-agent-swarm-prompt-injection-study#article","isPartOf":{"@id":"https:\/\/i10xnews.kinsta.cloud\/deepmind-agent-swarm-prompt-injection-study"},"author":{"name":"Christopher Ort","@id":"https:\/\/i10x.ai\/news\/#\/schema\/person\/d410bb7ee72febefca2c9c369939219a"},"headline":"Study: AI Agent Swarms Still Break Gemini&#8217;s Prompt Injection Defenses","datePublished":"2026-11-10T08:06:10+00:00","mainEntityOfPage":{"@id":"https:\/\/i10xnews.kinsta.cloud\/deepmind-agent-swarm-prompt-injection-study"},"wordCount":1281,"publisher":{"@id":"https:\/\/i10x.ai\/news\/#organization"},"image":{"@id":"https:\/\/i10xnews.kinsta.cloud\/deepmind-agent-swarm-prompt-injection-study#primaryimage"},"thumbnailUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/deepmind-agent-swarm-prompt-injection-study-title.webp","articleSection":["Safety &amp; Alignment","Studies"],"inLanguage":"en-US","dateModified":"2026-11-10T08:06:10+00:00"},{"@type":"WebPage","@id":"https:\/\/i10xnews.kinsta.cloud\/deepmind-agent-swarm-prompt-injection-study","url":"https:\/\/i10xnews.kinsta.cloud\/deepmind-agent-swarm-prompt-injection-study","name":"AI Agent Swarms Still Break Prompt Injection Defenses - i10X News","isPartOf":{"@id":"https:\/\/i10x.ai\/news\/#website"},"primaryImageOfPage":{"@id":"https:\/\/i10xnews.kinsta.cloud\/deepmind-agent-swarm-prompt-injection-study#primaryimage"},"image":{"@id":"https:\/\/i10xnews.kinsta.cloud\/deepmind-agent-swarm-prompt-injection-study#primaryimage"},"thumbnailUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/deepmind-agent-swarm-prompt-injection-study-title.webp","datePublished":"2026-11-10T08:06:10+00:00","description":"Google DeepMind study: a swarm of AI agents finds prompt injections against every model tested. Gemini 4 Argon resisted only 66% of attacks at full budget.","breadcrumb":{"@id":"https:\/\/i10xnews.kinsta.cloud\/deepmind-agent-swarm-prompt-injection-study#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/i10xnews.kinsta.cloud\/deepmind-agent-swarm-prompt-injection-study"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i10xnews.kinsta.cloud\/deepmind-agent-swarm-prompt-injection-study#primaryimage","url":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/deepmind-agent-swarm-prompt-injection-study-title.webp","contentUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/deepmind-agent-swarm-prompt-injection-study-title.webp","width":1344,"height":768,"caption":"Illustration: i10X"},{"@type":"BreadcrumbList","@id":"https:\/\/i10xnews.kinsta.cloud\/deepmind-agent-swarm-prompt-injection-study#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/i10x.ai\/news"},{"@type":"ListItem","position":2,"name":"Study: AI Agent Swarms Still Break Gemini&#8217;s Prompt Injection Defenses"}]},{"@type":"WebSite","@id":"https:\/\/i10x.ai\/news\/#website","url":"https:\/\/i10x.ai\/news","name":"i10X News","description":"Stay updated with the latest news and announcements from i10X.","publisher":{"@id":"https:\/\/i10x.ai\/news\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/i10x.ai\/news?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/i10x.ai\/news\/#organization","name":"i10X","url":"https:\/\/i10x.ai\/news\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i10x.ai\/news\/#\/schema\/logo\/image\/","url":"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/10\/i10x-logo-180.png","contentUrl":"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/10\/i10x-logo-180.png","width":180,"height":180,"caption":"i10X"},"image":{"@id":"https:\/\/i10x.ai\/news\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/i10x_ai","https:\/\/www.linkedin.com\/company\/i10x-ai","https:\/\/instagram.com\/i10x.ai","https:\/\/www.youtube.com\/@i10X_ai_official"]},{"@type":"Person","@id":"https:\/\/i10x.ai\/news\/#\/schema\/person\/d410bb7ee72febefca2c9c369939219a","name":"Christopher Ort","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/christopher-ort-192.webp","url":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/christopher-ort-192.webp","contentUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/christopher-ort-192.webp","caption":"Christopher Ort"},"description":"Christopher Ort handles SEO, AI agent workflows and PR & partnerships at i10x.ai, the all-in-one AI workspace built by i10X Global Pte. Ltd. in Singapore. He is a graduate of Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU). He is the author of \u201cThe Style Penalty\u201d, a study published on SSRN that analyses 1,576 evaluation decisions by four frontier AI models to show how AI-written CVs fare in automated hiring screens; the research has been covered by heise online and t3n.","url":"https:\/\/i10x.ai\/news\/author\/christopher-ort","sameAs":["https:\/\/i10x.ai\/blog\/author\/christopher-ort"],"worksFor":{"@id":"https:\/\/i10x.ai\/news\/#organization"},"alumniOf":{"@type":"EducationalOrganization","name":"Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU)","url":"https:\/\/www.fau.eu"}}]}},"_links":{"self":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts\/7077","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/comments?post=7077"}],"version-history":[{"count":1,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts\/7077\/revisions"}],"predecessor-version":[{"id":7084,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts\/7077\/revisions\/7084"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/media\/7075"}],"wp:attachment":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/media?parent=7077"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/categories?post=7077"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/tags?post=7077"},{"taxonomy":"company","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/companies?post=7077"},{"taxonomy":"product","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/products?post=7077"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}