What Victims Take Away: Attack Reuse and Defense Revision after Prompt-Injection Attacks

What it is

A study by Zihan Chen, Lei Nico Zheng and Di Zhu (Stevens Institute of Technology and UMass Boston), posted to arXiv on 27 October 2026. It asks whether people who see the prompt injection used against them go on to use it. The setting is Tensor Trust, an online game where players defend LLM-guarded bank accounts and attack others. Each account's attack history shows the full attack text, the model's reply, the outcome and the money taken. The data are 563,349 attack records from 17 June 2023 to 17 February 2024.

How it works

For each target, the authors compare the attack texts the target received with texts that were circulating among similar players at the same moment but never reached that target. They also compare one text across targets for whom it ended differently.

The game scores an attack as a success only if the model's whole reply is "access granted". The authors define a near-miss as a reply that starts with that phrase and continues, so it is scored a failure. A blinded coder mostly read near-misses as successes, which lets the study separate how a reply reads from how it was scored.

Findings beyond the summary

• Reuse tracks the score, not the look of the reply. Near-misses were reused much less than successes and not detectably more than failures. The authors call this consistent with payoff-biased social learning.
• The reuse effect holds across four specifications. A successful receipt raised the probability of reuse by 8.8 to 10.0 percentage points over a matched circulating text.
• Breaches led to defense changes. Among breach events where the owner returned within a week, 78% saw a deployed change to the defense. Same-family attacks then succeeded 24.5 points less often against that target, relative to other defenders.
• Reuse came from players already attacking. The authors tested three accounts: newcomers learning from what they receive, experienced attackers gaining most, and active attackers having the opportunity. The abstract says reuse came mainly from players already attacking, not newcomers.
• Received texts fed real success. Texts received before first use made up 23.2% of the successful hijacks analysed, meaning attacks that made the model grant access directly.

What to do

The authors derive testable hypotheses, not validated controls. Their main suggestion for AI security tools, incident databases and red-teaming reports is to describe the technique without publishing the full attack text. They treat attack visibility as a design lever with two effects: it enables repair and it enables reuse.

Caveats

• The fetched text stops partway through Section 3. Detailed results, the discussion, the other proposed hypotheses and the study's own stated limits were not available.
• The data come from a game in which attacking other accounts was permitted and rewarded. The page does not show that the rates carry over to enterprise red-team reports or incident databases.
• The disclosure advice has not been tested. The abstract calls it a hypothesis.