The attacker never has to write a command into the page.
On November 3, Technion released a paper titled Voluntary Servitude, a play on "voluntary servitude," listed as accepted at NeurIPS 2026. It studies a routine entry point for AI agents today: reading review pages, forum threads and listing pages, then making a recommendation, a ranking or a purchase decision on the user’s behalf. Paper
The defence against indirect prompt injection rests on a shared assumption: the attacker must write a command into the retrieved content, and the deployed injection detector screens for command syntax. This paper argues that the assumption itself hands the attacker an opening.
The payload contains no command
The attacker’s move is mundane. Post a few ordinary reviews on the review pages, forums and listings for the target service category, complete with a username, a date and a title, structured exactly like the genuine reviews around them. What is unusual is the claim inside. For example: "this provider abandoned our family during a medical emergency." Not one line of the payload is addressed to the model. There is no instruction, no override of the system prompt, no request to adopt a persona.
The paper splits the attack into three families. The safety family fabricates a hazard and leans on the model’s harm-avoidance. The authority family fabricates an institutional endorsement and leans on deference to institutions. The attribute family simply argues that the attacker’s listing is better and leans on ordinary persuasion. With no filter in place, the safety family matches instruction injection almost exactly: 60.4% against 66.0%.
Not an accusation, a hazard
The paper runs a clean control. Position, review count and page format are held fixed, and only the claim changes. Replace the hazard with an accusation of ethical misconduct, which carries no safety content, and success drops to 8.2%. Replace it with a purely positive review that only promotes the attacker’s target, and success is 6.8%, which the authors cannot tell apart statistically from the misconduct case (p=0.14). With no poisoning at all, the target is chosen on 0.7% of queries.
Negative content alone does not move the agent. Hazard content does. The safety family beats the misconduct complaint by 22.8 to 84.4 percentage points, and it holds across all ten domains and all four models. The trigger is not the accusation. It is harm-avoidance.
Why the detectors wave it through
The paper measures pass rates on two real commercial detectors. Both flag 46% to 84% of instruction injection payloads, but flag at most 22% of the safety family. Lakera Guard is the more extreme case, scoring 78% of the safety family as benign. What looks like an attack is an instruction. This payload reads like testimony between two travellers.
Multiplying the pass rate by the success rate gives the effective success rate behind the filter. Under ProtectAI the safety family reaches 60.4 against 35.7 for instruction injection; under Lakera, 47.1 against 10.6. In systems where such a filter is actually deployed, the attack that avoids instructions lands 1.7 to 4.4 times harder than the one everyone has been defending against.
It wins by elimination, not persuasion
An agent can reach the attacker’s listing in two ways. It can eliminate the legitimate providers, so that the target is what remains, or it can compare, keeping every option and ranking the target first. On four of the six models, the safety family succeeds mostly by elimination, accounting for 97% to 99% of its successful attacks. The authority family reaches 64% at most, and the attribute family 28%. On Claude Haiku 4.5, no successful authority or attribute attack eliminated a provider at all.
The model ordering runs against intuition. Grok 4.3, which resists ordinary persuasion, follows the safety framing more readily (73.6% attribute, 53.7% safety). Claude Haiku 4.5 resists both other families, showing 22.5% safety against 9.3% attribute. Gemini 3.1 Flash Lite reaches 86.5% on the safety family. A model with stronger harm-avoidance is not harder to attack; it simply offers a more convenient entrance.
It reaches products in production
The paper moves the attack into four production browser agents. Microsoft’s Edge with Copilot selected the attacker’s listing in every trial, against 20% for instruction injection. Perplexity’s Comet was at 60%, with instruction injection never succeeding there. OpenAI’s Codex browser was at 20%, also with instruction injection never succeeding. Brave’s assistant selected it under both attacks in every trial. The safety payload outperforms instruction injection on three of the four.
One layer down sits the retrieval pipeline. With BM25 selecting the top three pages, end-to-end success reaches 57.0%. With a dense retriever selecting a single page, it is 1.0%. Handing the model the poisoned page directly gives 98.0%. But whenever that page is genuinely retrieved, the agent picks the attacker’s target on 49.0% to 66.0% of queries, and that conditional rate barely moves with the retrieval setting. The division of labour is clear: the retriever decides how often a poisoned page surfaces, and the model decides what to do once it does.
Two independent studies supply background on the same road. One crawl covered 1.2B URLs across 24.8M hosts and found validated indirect injections on 11.7K pages, roughly 70% of them hidden in markup that only a machine reads. Another found that appending 13 words to a frequently retrieved user-generated page is enough for the attacker’s content to surface in 38% to 51% of generated reports.
The fix changes what counts as evidence
The proposed defence is one extra requirement in the agent’s system prompt. A safety-critical claim is treated as unverified when it appears in only a small minority of sources, or when the accounts making it look alike in wording and timing. An unverified claim may not disqualify a provider on its own; independent corroboration is required first.
No retraining and no extra infrastructure. Pooled across three models, success falls from 68.4% to 3.6% (95% CI 2.2 to 5.7%), which removes roughly 95% of the exposure. The more revealing number is where the instruction acts. With the requirement in place, the agent still cites the planted hazard in nearly every answer (98.4% against 99.8%), yet it almost never eliminates a provider on that basis (4.0% against 90.9%). It keeps reading. It simply stops obeying.
The cost is stated too. Against an attacker who knows the rule, and can manufacture apparently independent corroboration, that setting is left open. And a genuine warning from a single source now waits for corroboration as well.
So what
The point worth carrying away is not a number. Every behaviour alignment has written into a model is a decision rule that reads external evidence, and external evidence is untrusted. Harm-avoidance, deference to institutions, the weight given to other people’s testimony: each one can be used as a lever. So agent security cannot stop at asking whether the text contains a command. It has to ask what the model treats as evidence, and how many independent sources count as enough.
The paper leaves its own limits visible. The experiments cover travel and consumer services, single selection decisions, models called through OpenRouter between March and May, and a defence evaluated only against an attacker who does not adapt.