# Exploiting Web Search Tools of AI Agents for Data Exfiltration Source: [Exploiting Web Search Tools of AI Agents for Data Exfiltration]() Collection index: [llms.txt]() Data updated: 2026-04-14T05:00:04.234Z Authors: Dennis Rall, Bernhard Bauer, Mohit Mittal, Thomas Fraunholz Published: 2025-10-10T07:39:01.000Z ## Abstract Large language models (LLMs) are now routinely used to autonomously execute complex tasks, from natural language processing to dynamic workflows like web searches. The usage of tool-calling and Retrieval Augmented Generation (RAG) allows LLMs to process and retrieve sensitive corporate data, amplifying both their functionality and vulnerability to abuse. As LLMs increasingly interact with external data sources, indirect prompt injection emerges as a critical and evolving attack vector, enabling adversaries to exploit models through manipulated inputs. Through a systematic evaluation of indirect prompt injection attacks across diverse models, we analyze how susceptible current LLMs are to such attacks, which parameters, including model size and manufacturer, specific implementations, shape their vulnerability, and which attack methods remain most effective. Our results reveal that even well-known attack patterns continue to succeed, exposing persistent weaknesses in model defenses. To address these vulnerabilities, we emphasize the need for strengthened training procedures to enhance inherent resilience, a centralized database of known attack vectors to enable proactive defense, and a unified testing framework to ensure continuous security validation. These steps are essential to push developers toward integrating security into the core design of LLMs, as our findings show that current models still fail to mitigate long-standing threats. ## Recorded benchmark results A research result applies to its stated dataset, split, metric and evaluation configuration. Compare like-for-like settings, preserve the metric's unit and direction, and distinguish paper-reported results from independent reproduction. The best result recorded here is not a claim of exhaustive, current global coverage. - [Data Exfiltration via Indirect Prompt Injection on Indirect Prompt Injection Dataset 1.0 (test)](): Data Exfiltration via Indirect Prompt Injection; Indirect Prompt Injection Dataset 1.0 (test); Data Exfiltration Success Rate: not recorded. ## Original sources and implementation [Original paper]() [PDF]()