What is prompt injection? It is what happens when hidden instructions in content your agent reads — an email, a retrieved document, a tool result — steer the agent somewhere you never authorized. And here is the part most defenses miss: TRACER is a research paper from the Mohamed bin Zayed University of Artificial Intelligence, published October 18, 2026, showing that the same indirect prompt injection succeeds at dramatically different rates depending on the presentation channel. The authors call it the framing gap — and it means your agent may have passed the injection test only because the attack arrived through the channel you tested.
Prompt injection is an attack where instructions planted in data an AI system processes — rather than typed by the user — get treated as commands. Direct injection comes from the user typing a malicious prompt. Indirect injection, the kind TRACER studied, hides in third-party content: emails, web pages, documents, tool outputs, calendar invites. The agent reads them as context and follows the planted instructions.
It is not a theoretical risk. Indirect prompt-injection payloads rose roughly fivefold to about 1% of all prompts by May 2026, according to Check Point research reported in July 2026, and Google recorded a 32% jump in malicious attempts between November 2025 and February 2026. OWASP lists it as LLM01 — the top risk for LLM applications.
TRACER's authors — Kshitij Mishra, Salem Lahlou, and Nils Lukas — systematically tested indirect prompt injection across presentation channels: follow-up messages, RAG documents, and tool outputs. The same injection re-wrapped in a different channel succeeded at higher rates. Their conclusion: LLM defenses are channel-conditioned and require deployment-aware training. Channel-conditioned training then cut attack success from 65.5% to 6.1% on RAG-framed attacks while preserving 78–82% clean accuracy.
Source: zot.news research digest of the TRACER paper, October 19, 2026 — paper coverage, not independently verified.
Most teams test one channel — usually direct chat prompts — and declare victory. The framing gap says: test every channel your agent actually consumes. Our open-source channel-framing-prober re-wraps abstract test cases across these five:
| Channel | What the framing adds |
|---|---|
| Email follow-up | From/Subject framing plus a known-sender trust marker — the channel that looks most legitimate |
| RAG document | Retrieved-chunk framing with a source citation — authority borrowed from your own knowledge base |
| Tool output | JSON tool-result envelope — structured data agents tend to trust implicitly |
| Calendar invite | Organizer authority framing — an invite feels like it came from inside the organization |
| HTTP header | Header-style key/value encoding, truncated at 120 characters — the channel that degrades the payload |
The prober scores each re-wrapped test against your own channel-susceptibility profile and reports per-channel success rates plus the gap delta (best channel rate minus worst). A large delta means the same abstract tests score very differently by channel — harden the weakest channel first. It is labeled everywhere as test-harness measurement on abstract fixtures, not proof of exploitability.
Five questions. They test whether you think in channels or only in prompts — the exact habit the framing gap punishes.
1. TRACER training cut attack success on RAG-framed attacks from 65.5% to…?
2. Which presentation channels did the TRACER authors test?
3. In the channel-framing-prober, which channel adds a known-sender trust marker?
4. Which channel truncates the test payload at 120 characters?
5. What does a large gap delta mean?
Rogue-Agent Defense — Ingenious AI's autonomous-agent monitoring platform — watches for exactly this class of attack: injections arriving through channels your tests never covered, plus exfiltration detection when one lands. Get early access on WhatsApp.
Every platform is in early access. Tap any link to request access on WhatsApp:
Bundle deal: all 11 Ingenious AI platforms, one price.
Prompt injection is an attack where instructions planted in data an AI system processes — rather than typed by the user — get treated as commands. Direct injection comes from the user typing a malicious prompt; indirect injection hides in third-party content such as emails, web pages, documents, tool outputs, or calendar invites, which the agent reads as context and then follows.
The framing gap is the finding that the same indirect prompt injection succeeds at dramatically different rates depending on the presentation channel it arrives in. Defenses tuned on one channel — say, follow-up messages — do not automatically transfer to others like RAG documents or tool outputs, so testing in a single channel measures only that channel.
The TRACER authors systematically tested indirect prompt injection across follow-up messages, RAG documents, and tool outputs. Attacks re-wrapped in different channels succeeded at higher rates, which is what revealed the framing gap and motivated channel-conditioned training.
According to the paper coverage, TRACER's channel-conditioned training reduced attack success from 65.5% to 6.1% on RAG-framed attacks while preserving 78 to 82 percent clean accuracy. The paper is by Kshitij Mishra, Salem Lahlou, and Nils Lukas of MBZUAI, published October 18, 2026.
No. That is exactly the trap the framing gap describes: a defense that blocks an injection delivered as a follow-up message may still fall for the same injection delivered as a retrieved document or a tool result. LLM defenses are channel-conditioned, so they need deployment-aware testing across every channel your agent actually reads.
Re-wrap your own injection test cases across every channel your agent consumes — email, RAG documents, tool output, calendar invites, HTTP headers — and score each channel separately. Ingenious AI's open-source channel-framing-prober does exactly this with abstract fixtures: per-channel success rates plus the gap delta, so the weakest channel is visible and gets hardened first.
Related checks: