{
 "public_id": "AIR-2026-0071",
 "incident_id": "2026-03-caisi-grayswan-ukaisi-ipi-competition",
 "date_disclosed": "2026-03-16",
 "date_occurred": null,
 "title": "CAISI x Gray Swan x UK AISI indirect-prompt-injection competition: all 13 frontier models broken",
 "class": "research_demo",
 "attack_surface": "other",
 "initial_vector": "indirect_prompt_injection",
 "agent_capability_abused": [
  "tool_use",
  "retrieval",
  "code_execution",
  "computer_use"
 ],
 "target_product": "Gray Swan Arena (13 frontier models in tool-use, coding and computer-use agent settings)",
 "target_vendor": "Gray Swan AI; NIST CAISI; UK AI Security Institute; frontier AI labs",
 "autonomy_level": "semi_autonomous",
 "impact_realized": false,
 "impact_type": [
  "policy_violation",
  "data_exfiltration",
  "unauthorized_action"
 ],
 "blast_radius": "13 frontier models, 41 scenarios, three agent settings",
 "cve": [],
 "taxonomy": {
  "owasp_asi": [
   "ASI01",
   "ASI05"
  ],
  "mitre_atlas": [],
  "labels": [
   "competition",
   "crowdsourced_red_team",
   "indirect_prompt_injection",
   "cross_model_transfer"
  ]
 },
 "defense_present": "vendor-native agent safety training and injection defenses",
 "defense_bypassed": true,
 "fix_shipped": null,
 "primary_sources": [
  "https://arxiv.org/abs/2603.15714",
  "https://www.nist.gov/blogs/caisi-research-blog/insights-ai-agent-security-large-scale-red-teaming-competition"
 ],
 "verified_quote": "CAISI partnered with Gray Swan, the UK AI Security Institute (UK AISI), and several frontier AI labs",
 "confidence": "high",
 "notes": "Paper: 'How Vulnerable Are AI Agents to Indirect Prompt Injections? Insights from a Large-Scale Public Competition' (Dziemian, Lin, Fu, Nowak, Zou, Ahmad, Chaudhuri, Davies, Rando, Qi, Fredrikson, Kolter et al., 16 Mar 2026). NIST CAISI blog of 23 Mar 2026 reports 'more than 250,000 attack attempts from over 400 participants'; the paper reports 272,000 attempts from 464 participants and 8,648 successful attacks across 41 scenarios, with per-model success from 0.5% (Claude Opus 4.5) to 8.5% (Gemini 2.5 Pro). Also listed in the user's init.md reading list, but retained here because it is a named-frontier-agent result, not just literature.",
 "risk_category": "security_fraud",
 "risk_secondary": [
  "privacy"
 ],
 "risk_subcategory": "Prompt Injection",
 "risk_sub_secondary": [
  "Remote Code Execution & Sandbox Escape"
 ],
 "ai_entity": "generative",
 "agency": "agent_acted",
 "agency_debatable": true,
 "agency_reason": "all 13 agents took tool, retrieval and code-execution actions under injection",
 "vector_family": "indirect_prompt_injection",
 "vector_detail": "indirect_prompt_injection",
 "guardrail_kind": [
  "abuse_detection"
 ],
 "guardrail_outcome": "silent",
 "xrefs": {
  "aiid": [],
  "atlas": [],
  "cve": [],
  "ghsa": []
 },
 "primary_asi": "ASI01",
 "agent_framework": "unknown",
 "model_provider": "unknown",
 "model_name": "",
 "detection_mechanism": "academic_study",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "unsafe_actuation",
 "eai_domain": "agent_behaviour",
 "eai_secondary": [
  "data_exfiltration_channels",
  "confused_deputy"
 ],
 "eai_reason": "impact rule: unsafe_actuation",
 "asi_curated": [
  "ASI01"
 ],
 "asi_scope": "in_scope",
 "asi_provenance": "curated_plus_rule",
 "asi_reason": "curated: ASI01 | added ASI05 (vector=code_exec)",
 "submitted_by": "EAI Internal"
}