Open-weight agents 88% more susceptible to indirect prompt injection, study finds
Security research firm PromptArmor published a 9,800-trial evaluation claiming that agents built on open-weight models (DeepSeek, Kimi, GLM, Qwen) fell for real-world indirect prompt-injection attack chains 26.7% of the time, versus 14.2% for proprietary models (GPT, Claude, Gemini) — about 88% higher. It cites per-attack gaps such as 49% versus 9% for a chain that summarizes a URL and runs malware, and 36% versus 5% for a phishing login overlay. The study also says proprietary vendors' cost-effective models were 169% more susceptible than their flagships, while Qwen's and DeepSeek's cheaper models were slightly more robust than older flagships; PromptArmor has not released its full methodology or dataset, so the results are unverified.
Teams deploying agents on open-weight models may be taking on materially more prompt-injection risk, so injection defenses should factor into model selection.