It already knows — the injection signal your API does not return

The detection signal for indirect prompt injection already exists inside the model, published and reproducible; the clause that binds an EU deployer today is not AI Act Article 15 but the state-of-the-art ratchet in GDPR Article 32(1) and NIS2 Article 21(1).

Post

Your agent already knows it has been injected. It carries out the attack anyway.

That is the finding in a paper posted to arXiv on 1 August.

The setup is the real one: indirect prompt injection — a malicious side-task hidden in a tool result, not in the user's message. Researchers trained simple linear probes on the model's hidden states, read before it generates anything. Across six models, including a 753B-parameter one, those probes predict injection exposure at 90%+ AUROC — on attacks and task suites the probe had never seen, and holding under adaptive attacks.

So the signal is there. Cheap, linear, pre-generation.

Then the part that should change your architecture, not your compliance slide. The authors call it a recognition–action gap: the model encodes that it is under attack and completes the injected task regardless. Knowing and refusing are different circuits. Their fix gates an anti-injection reasoning step on the probe firing — attack success on one model on hard AgentDojo settings drops from 34.6% to 0%.

Now the European part — not the article you expect.

Everyone reaches for AI Act Article 15(5) — resilience against "inputs designed to cause the AI model to make a mistake". The Digital Omnibus deferred stand-alone high-risk obligations to December 2027. Article 15 is not your problem this month.

What is: GDPR Article 32(1) and NIS2 Article 21(1). Both require measures "taking into account the state of the art". That phrase is a ratchet. It has no fixed content — it means whatever is currently published and reproducible.

A public paper showing 90%+ detection from a linear probe is exactly what moves it.

What I'd do Monday:

  1. Log provenance per tool result — which retrieved document carried which instruction, per call. Without it, "we saw nothing" is not evidence.

  2. If you self-host, a probe on hidden states is a weekend, not a roadmap. You already have the activations. Closed APIs do not hand them to you.

  3. Ask your model vendor, in writing, whether they expose any injection-exposure signal. The answer, or the silence, is your documentation either way.

  4. Stop treating "the model refused" as the control. Recognition and refusal came apart in the measurements.

The uncomfortable version: after 1 August it is harder to argue this class of attack was undetectable.

What would you be able to show, three months later?

#AgenticAI #PromptInjection #NIS2 #EUAIAct #AIEngineering

AI disclosure: the narration voice and the cover art in this video are AI-generated. The script, the claims and the source checks are mine.

First comment

Sources, primary first:

The paper — arXiv 2608.02657, submitted 1 August 2026. Probes, the recognition–action gap, and the AGRI result https://arxiv.org/abs/2608.02657

AgentAntibody, arXiv 2608.04053, submitted 4 August 2026 — a different injection defence posted three days later https://arxiv.org/abs/2608.04053

GDPR Article 32 — "taking into account the state of the art" https://gdpr-info.eu/art-32-gdpr/

NIS2 Article 21 — the same phrase, different addressee https://www.nis-2-directive.com/NIS_2_Directive_Article_21.html

AI Act Article 15 — the resilience and adversarial-example wording, deferred for stand-alone high-risk systems https://artificialintelligenceact.eu/article/15/

Regulation (EU) 2026/1744, the Digital Omnibus on AI — the deferral itself https://eur-lex.europa.eu/eli/reg/2026/1744/oj/eng

One point cut for length: I could not confirm the authors' institutions. The arXiv abstract page does not print affiliations and the HTML render was rate-limited every time I tried, so this says "researchers" rather than naming a university I did not verify. Every figure above comes from the paper's own abstract.

AI disclosure: the narration voice and the cover art in this video are AI-generated. The script, the claims and the source checks are mine.

Claims

Sources

Corrections

Author affiliations for arXiv 2608.02657 are not printed on the arXiv abstract page, and the HTML render at arxiv.org/html/2608.02657v1 returned HTTP 429 on every attempt during this run. No institution is attributed anywhere in this edition; the post says "researchers". Every figure quoted comes from the paper's own abstract.

The state-of-the-art wording in GDPR Article 32(1) and NIS2 Article 21(1) is quoted from third-party reproductions of the instruments, not from the Official Journal. An attempt to confirm NIS2 Article 21(1) against EUR-Lex CELEX:32022L2555 reached only the recitals before the extraction limit. Both claims are flagged secondary-sourced in the claims index.

The 34.6% to 0% figure is the paper's own worked example on one model (Qwen3.5-27B) on difficult AgentDojo settings. It is not a mean across the benchmark and is not presented as one.