Twin Agent Cut Static Prompt-Injection Success to 0.1%—but Adaptive Attacks Still Reached 4.7%
A UC Berkeley-led research team has proposed a privilege-separated agent architecture that sharply reduced prompt-injection success without imposing the utility collapse seen in a rigid dual-agent baseline. Twin Agent lets one model inspect untrusted material while a second retains privileged tools, but restricts the information crossing that boundary to a short hint about the next useful action.
Across the paper’s static attacks, Twin Agent held task utility near the undefended systems while reducing attack success to 0% on an injected software-engineering benchmark and 0.1% overall on AgentDojo. The headline needs an important qualifier: a two-phase adaptive attack against the software-engineering agent still caused malicious action in 4.7% of full runs. The authors explicitly provide no formal security guarantee.
The practical contribution is therefore not an immunity claim. It is a testable way to treat agent context as an information-flow boundary: untrusted observations can support exploration, but they do not need to enter the same context that holds shell, file, browser, or API authority.
Privilege separation meets context compression
Twin Agent divides work between an Explore Agent and a Safe Agent. The Explore Agent can read repository content, messages, webpages, and other potentially hostile observations. The Safe Agent retains privileged actions and supplies its current context to the explorer, but receives only a compact next-action hint in return rather than the underlying untrusted text.
The design differs from simply placing a detector in front of one powerful agent. It assumes the exploratory side can be compromised, then constrains what that side can communicate across the trust boundary. It also differs from a strict dual-model split that permits too little information to complete long, iterative work. The paper frames hint length as a security–utility control: more communication can preserve more task detail, but also creates more capacity for an attack payload.
This is directly relevant to coding agents, where useful work requires repeated inspection, command execution, test feedback, and revised hypotheses. A fixed plan created before reading the repository can be safe but ineffective. Twin Agent instead allows repeated exploration while trying to keep raw issue text and repository instructions away from the executor’s privileged context.
Static attacks fell without a measured utility penalty
On SWE-bench-injected with GPT-5.2, the undefended agent recorded 61.2% utility and 97.0% attack success. The strict dual-agent baseline reached 0% attack success but also 0% utility. Twin Agent reported 62.5% utility and 0% attack success under the benchmark’s non-adaptive attacks.
On AgentDojo with Gemini 2.5 Flash, the default agent achieved 61.9% utility with 41.5% attack success. Twin Agent measured 62.9% utility with 0.1% attack success. The paper’s CaMeL comparison reached 0% attack success but 30.9% utility under the authors’ reduced retry budget; they note that this configuration is below the roughly 35% utility reported in the original work.
The AgentDojo aggregate also hides meaningful suite variation. Twin Agent recorded no successful static attacks in the workspace, Slack, and travel suites, but 0.7% in banking. Slack utility fell from 90.5% for the default agent to 66.7% for Twin Agent, even as overall utility slightly increased because results improved elsewhere. Deployment decisions should preserve per-workflow results rather than relying on the 62.9% aggregate alone.
DecodingTrust-Agent produced a less absolute result. With GPT-5.2, attack success fell from 10.0% to 3.3% while utility remained 95.0%. With Gemini 3.5 Flash, attack success fell from 26.7% to 3.3%, while utility declined from 96.7% to 93.3%. These are strong reductions, not elimination.
The adaptive attack crossed the compressed channel
The researchers then designed a two-phase attack with knowledge of Twin Agent’s architecture. First, they used PAIR to optimize malicious hints intended to make the Safe Agent write a secret code or delete a file. Second, a copy-and-paste injection in the bug report attempted to make the compromised Explore Agent forward that optimized payload through the hint channel.
The Safe Agent resisted the optimized hint in the isolated single-turn test, while the Explore Agent obeyed the copy-and-paste instruction in every evaluated attempt. In full multi-turn runs, however, 11 instances ended with malicious action, producing a 4.7% attack-success rate. The paper reports that malicious hints passed the security detector 57 times among 232 instances, and 11 of those ultimately led to execution.
When the authors reran those 11 failures five times each, none of the 55 reruns completed the malicious action. That suggests stochastic behavior in the evaluated setup, but it does not erase the original failures. For a security boundary, low-probability execution is still execution; repeated autonomous operation can turn a small per-run probability into material cumulative exposure.
What the evaluation establishes—and what it does not
The results support a narrow claim: compact, privilege-separated communication can improve the measured security–utility tradeoff over both unrestricted agents and rigid information-flow baselines on the tested benchmarks and models. They do not establish that a character budget is a deterministic policy, that all malicious intent requires long text, or that the Safe Agent cannot infer an unsafe action from a short hint.
The paper evaluates only a few application domains and says stronger attacks may defeat the design. The static benchmark attacks are especially important to distinguish from the adaptive result. A deployment should not advertise the 0% or 0.1% figures without also reporting the 4.7% architecture-aware attack and the exact models, hint budget, detector, tasks, and decoding configuration.
Twin Agent also leaves the ultimate authorization problem outside the model pair. A Safe Agent still reasons probabilistically about hints. Deterministic controls must decide whether a particular principal may execute a particular action on a particular resource. This complements, rather than replaces, the per-call authorization gap described in our confused-deputy analysis.
Defensive engineering guidance
- Keep untrusted bytes out of the privileged context. Repository issues, webpages, email, tool descriptions, logs, and retrieved documents should be processed by a component that has no production credentials or destructive tools.
- Make the crossing typed and narrow. Prefer bounded identifiers, enums, resource handles, and proposed actions over free-form text. A character limit reduces bandwidth but does not validate meaning.
- Re-authorize every action. Check principal, operation, resource, environment, and current state at execution time. Never treat a Safe Agent’s agreement as an authorization decision.
- Measure by workflow, not only in aggregate. Track utility and attack success separately for code, messaging, travel, finance, and other tool families; the AgentDojo suite results moved in different directions.
- Red-team the channel adaptively. Assume the explorer knows the architecture and can optimize every allowed field. Test short payloads, encoded instructions, repeated hints, stateful attacks, and attacks that exploit legitimate task vocabulary.
- Cap cumulative opportunity. Limit retries, tool calls, tokens, wall-clock time, and failed authorization attempts. A stochastic failure mode becomes more dangerous when an agent can try indefinitely.
- Log both sides of the boundary. Preserve the untrusted observation, compressed hint, detector result, Safe Agent decision, authorization result, and concrete side effect for incident reconstruction.
Twin Agent advances the agent-security discussion beyond asking whether a model can recognize prompt injection. Its stronger idea is architectural: a model reading attacker-controlled content should not be the same security principal that carries high-impact authority. Context compression can make that separation more usable, but the adaptive failures show why the final boundary still has to be deterministic, independently enforced, and designed to tolerate a fully compromised explorer.
Sources: