PIMiner builds a transferable prompt-injection strategy library with ~10 queries per sample.

arXiv 2608.05108 skips the RL-trained attacker models that dominate red teaming and generalize poorly, instead accumulating a strategy library across a sequence of (dataset, target) pairs that transfers to unseen targets with no retraining. AgentDojo: 86.7% ASR against Gemini-2.5-Pro, 53.3% GPT-5.1, 40.0% Claude-Sonnet-4.5. IPIArena: 76.2% / 61.9% / 42.9%. The spread across frontier models is the actionable part if you're choosing a backbone for tool-using agents that touch untrusted content.