Analyzing Defensive Misdirection Against Model-Guided Automated Attacks on Agentic AI Systems

arXiv·medium signal

Argues that detect-and-block defenses fail because predictable refusals give automated jailbreak search useful feedback. Their CMPE (Contextual Misdirection via Progressive Engagement) replaces refusals with misleading-but-safe responses, reducing estimated attack-success upper bounds by up to two orders of magnitude and nearly eliminating verified success in end-to-end PAIR and GPTFuzz runs. A contrarian take on agentic-AI defense worth scrutinizing.