The transition of Large Language Model (LLM) security from passive chat safety to active intrusion centers on the exploitation of agentic AI frameworks, specifically NanoBrowser and BrowserUse. Research indicates that prompt injection has evolved into "Promptware"—enabling Command and Control (C2) capabilities—and "Agentic AI Worms" capable of autonomous propagation. Attackers are leveraging Indirect Prompt Injection (IPI), multimodal visual triggers, and vulnerabilities in Retrieval-Augmented Generation (RAG) pipelines to bypass controls. With IPI success rates reaching up to 68.16% in web environments and visual manipulations increasing manipulation rates by over 60%, current models like GPT-5 and Gemini-2.5-Flash demonstrate a critical resilience deficit, failing to maintain robust behavior under sustained adversarial conditions.

• Threat Model Evolution: From Chat to Agency

  • Transition from model-level "safety" nuisances to systemic, architectural intrusion vectors.
  • Emergence of "Stealthy Parasitism," allowing successful exploits without disrupting user workflows.
  • Expansion of attack surface via autonomous agentic capabilities, including web browsing, tool use, and RAG-driven decision-making.

• Attack Mechanics and Exploitation Vectors

  • Indirect Prompt Injection (IPI): Hijacking RAG pipelines and model routers by injecting malicious instructions through external data sources.
  • Multimodal/Visual Injection: Utilizing visual triggers to manipulate agent behavior, increasing product selection success from 10% to 76.67%.
  • Promptware C2: Weaponizing prompt injection payloads to establish Command and Control capabilities within agentic environments.

• Systemic and Security Impact

  • Agentic AI Worms: The potential for self-propagating AI entities to autonomously move through enterprise environments.
  • High Exploitation Success: Direct injection rates exceed 79%, with IPI achieving up to 68.16% success in realistic web settings.
  • Model-Specific Variance: Gemini-2.5-Flash demonstrated a 26.49% higher IPI success rate than GPT-5 when utilized on the NanoBrowser framework.

• Research and Technical Benchmarking

  • StakeBench: A new stakeholder-centric benchmark developed to evaluate the resilience of agentic prompt injection.
  • Resilience Deficit: Leading frontier models currently lack a "Robust Behavior" region, failing to complete tasks safely during active attacks.
  • Focus Areas: Research specifically targets the vulnerabilities inherent in NanoBrowser and BrowserUse agentic frameworks.

• Conclusion and Defensive Outlook

  • Shift defensive focus from LLM alignment to the architectural security of agentic workflows and RAG pipelines.
  • Requirement for rigorous validation of multimodal inputs and external data retrieved by autonomous agents.
  • Preparation for the evolution of AI-driven, self-propagating malware (Agentic Worms).