In recent weeks there have been increasing reports of hacking groups using AI agents to break into government and healthcare systems, with little human oversight. The agents in these cases didn't give up when they hit a wall, they iterated their approach and found another way in.

‍

Most papers on prompt injection measure an agent's risk at one fixed attacker budget. At Dynamo we studied what happens if the attacker keeps trying to hack a simulated online store or email workspace.

‍

Our findings are available in our paper, Rethinking Indirect Prompt Injection as a Test-Time Search Problem, accepted at the NeurIPS 2026 Workshop on Evaluation of Interactive Agents.

Our AgentWarden product is built for an attacker who keeps trying. It screens what your agents read for prompt injections, and lets security teams set one central policy that locks each agent down to the actions its job needs. No attacker budget buys access beyond the policy.