Search papers, labs, and topics across Lattice.
This study evaluates the vulnerability of DeepSeek Harness (DSH) to indirect prompt injection attacks using the AI-Infra-Guard (A.I.G) framework, conducting 14,560 controlled executions across various content channels and attack methods. The results reveal that the highest attack success rates are 25.5% for hidden Unicode in file mode and 17.0% for fake-completion attacks in text mode, highlighting significant weaknesses in DSH's defenses. Furthermore, the research identifies critical controls needed to mitigate risks associated with untrusted content and sensitive actions, emphasizing the importance of robust security measures in AI systems.
Indirect prompt injection can compromise AI systems like DeepSeek Harness, with attack success rates reaching up to 25.5% under certain conditions.
We assess indirect prompt injection in DeepSeek Harness (DSH), using AI-Infra-Guard (A.I.G) to construct tests, deliver controlled taint, execute DSH, collect traces, and judge outcomes. The study covers 14,560 controlled executions over 16 indirect-content channels, text and file carrier modes, 35 payload objectives, one unmodified baseline, and 12 attack methods. The experiment preserves DSH's agent loop, tool registry, model adapter, and session-event path; source tools and sensitive sinks are local fixtures, so attempted actions are recorded without external side effects. We evaluate each trace with a deterministic rule-based judge, \JudgeR{} (RuleJudge), and a semantic LLM-based judge, \JudgeL{} (LLMJudge). The strongest observed attack success rates are 17.0% under \JudgeL{} for fake-completion attack in text mode, 25.5% under \JudgeR{} for hidden Unicode in file mode, and 16.0% under \JudgeR{} for the skills channel in file mode. \JudgeL{} also assigns partial compliance more often than \JudgeR{} (7.3% versus 2.0%). We relate these results to DSH's treatment of tool results, additional contexts, and tool-call policy hooks, then identify controls that should sit between untrusted content and sensitive actions. Our code is available at https://github.com/Tencent/AI-Infra-Guard/tree/main/Research/deepseek-harness-security-assessment .
