Voluntary Servitude
“We measure this at the generation stage across six models and ten consumer-service domains, for three attack families, and show that it transfers to production browser agents, outperforming instruction injection, and to a retrieval pipeline (1.0-57.0% end-to-end success, depending on the retriever).”
The authors, in the abstract
Weaponized Safety Warning Mechanisms for Controlling AI Agents