Explosive Prompts
Understanding and preventing trigger-based prompt injections in LLM agents.
Explosive prompts are a new class of indirect prompt injection (IPI) against LLM agents. Unlike ordinary injections that fire the moment malicious content is ingested, an explosive prompt plants a conditional payload that stays dormant until an attacker-chosen trigger is satisfied: a keyword, a task type, an event, or the passage of time.
This paper gives the first systematic empirical analysis of these attacks. The central finding: the temporal separation is not cosmetic. Across nine foundation models, three deployed guardrails, and six production agents, rephrasing an imperative injection as an explosive prompt never lowers its bypass rate and raises it at every layer — improving the average bypass rate by up to 3× over regular IPI. The models most hardened against overt injection are precisely the ones the conditional form unlocks.
As a defense, the paper introduces DeFuse (DEtecting Fuse-based attacks before USE): a lightweight, model-agnostic detector that reaches AUC = 0.99 while adding only ~150 ms of latency.
Research
The attack: explosive prompts
An explosive prompt has three defining properties: (1) injection–execution temporal separation — payload planted now, fires later; (2) conditional activation — executes only when a trigger holds; (3) model independence — it exploits ordinary instruction-following over untrusted data, so it transfers across vendors.
Key findings. Activation is trigger-selective with near-zero control leakage, even when the payload is embedded in a benign business email. It degrades gracefully under imperfect triggers — concept paraphrases (≥96%), synonyms (up to 51%), tool-selection conditioning (100%). Conditioning on the user’s action type activates all nine tested models (34–100%), with the largest gains on the safety-hardened frontier models. Against a live tool backend (AgentDojo), 20–28% of triggered trials produced real state mutations — funds transferred, emails sent, files created — with zero mutations on controls.
| Defense layer | Imperative IPI | Explosive prompt |
|---|---|---|
| Foundation LLMs (9 models) | 50.0% | 62.9% |
| Deployed guardrails (miss rate) | 43.5% | 89.3% |
| Production agents | 0% | up to 90% |
Six production agents were tested: OpenAI Codex, Gemini CLI, Claude Code, Cursor, GitHub Copilot, and Google Assistant. Identical imperative injections were blocked entirely.
Per-app results
Success rate of the explosive prompt (DTI — delayed tool invocation) versus the imperative injection (IPI) on real agentic applications, each run with permissions granted:
| App | Model | Permissions | DTI success | IPI success |
|---|---|---|---|---|
| Anthropic Claude Code CLI | Claude Haiku 4.5 | --dangerously-skip-permissions | 15/30 = 50% | 0/30 = 0% |
| Google Gemini CLI | gemini-3.1-flash-lite | YOLO mode | 25/30 = 83.33% | 1/30 = 3.33% |
| OpenAI Codex PC app | 5.4-mini-low reasoning | Full access | 13/30 = 43.33% | 0/30 = 0% |
| GitHub Copilot (VS Code) | MAI-Code-1-Flash-low | Autopilot | 21/30 = 70% | 0/30 = 0% |
The defense: DeFuse
DeFuse scans untrusted retrieved data for the conditional structure before it reaches the model. A sliding window (15 words, stride 5) with GloVe embeddings + a Random Forest gave the best accuracy/latency trade-off: AUC = 0.99, ~150 ms added latency, robust to out-of-distribution payloads, triggers, and templates. Because no dataset of explosive prompts existed, the work includes a generator that assembles ≈322,000 unique combinations from five pools (patterns, prefixes, condition words, triggers, payloads).
Figures from the paper
Overview
A short video explaining explosive prompts and the DeFuse defense.
Demos
The same attack, phrased two ways, on real agentic applications. A regular indirect prompt injection (IPI) states the malicious goal directly; an explosive prompt (delayed tool invocation, DTI) hides the same goal behind a condition that fires later. In every app the direct injection is blocked while the explosive-prompt form succeeds.
Google Gemini CLI
Run on gemini-cli, 15 July 2026.
IPI — blocked
A direct injection in Google Gemini CLI. The overt instruction is recognized and refused — the attack fails.
Explosive prompt (DTI) — succeeds
The same goal rephrased as a conditional explosive prompt passes the defenses, lies dormant, and fires later when the trigger is satisfied — deleting a sensitive file — the attack succeeds.
OpenAI Codex
IPI — blocked
A direct injection in OpenAI Codex. The overt instruction is recognized and refused — the attack fails.
Explosive prompt (DTI) — succeeds
The same goal rephrased as a conditional explosive prompt passes the defenses, lies dormant, and fires later when the trigger is satisfied — the attack succeeds.
Cursor CLI
IPI — blocked
A direct injection in Cursor CLI. The overt instruction is recognized and refused — the attack fails.
Explosive prompt (DTI) — succeeds
The same goal rephrased as a conditional explosive prompt passes the defenses, lies dormant, and fires later when the trigger is satisfied — the attack succeeds.
Claude CLI
IPI — blocked
A direct injection in Claude CLI. The overt instruction is recognized and refused — the attack fails.
Explosive prompt (DTI) — succeeds
The same goal rephrased as a conditional explosive prompt passes the defenses, lies dormant, and fires later when the trigger is satisfied — the attack succeeds.
Devin AI
IPI — blocked
A direct injection in Devin AI. The overt instruction is recognized and refused — the attack fails.
Explosive prompt (DTI) — succeeds
The same goal rephrased as a conditional explosive prompt passes the defenses, lies dormant, and fires later when the trigger is satisfied — the attack succeeds.
Grok Build
IPI — blocked
A direct injection in Grok Build. The overt instruction is recognized and refused — the attack fails.
Explosive prompt (DTI) — succeeds
The same goal rephrased as a conditional explosive prompt passes the defenses, lies dormant, and fires later when the trigger is satisfied — the attack succeeds.
Paper
The full paper, Defusing Explosive Prompts: Understanding and Preventing Trigger-Based Prompt Injections in LLM Agents, by Justin Szczepaniak*, Elad Feldman*, Naum Viner, and Ben Nassi (*equal contribution).
Q&A
What is an explosive prompt?
An indirect prompt injection whose payload is conditional. It is planted in retrieved content but stays dormant until an attacker-chosen trigger is satisfied. Three properties: injection–execution temporal separation, conditional activation, and model independence.
How is it different from a normal prompt injection?
A normal injection issues an imperative command that executes immediately. An explosive prompt says "when X happens, then do Y" — separating injection from execution.
Why does it bypass defenses that block ordinary injection?
Defenses are tuned to catch immediate, imperative instructions. The conditional phrasing augments the user's own request rather than overriding it, so it looks benign at ingestion time and fires later.
What can trigger the payload?
A keyword ("Thanks"), a task type, a characteristic of the input, an event, or time. It even survives inexact triggers: paraphrases (≥96%), synonyms (up to 51%), tool-selection conditioning (100%).
How much more effective is it?
Up to 3× higher average bypass: foundation models 50.0%→62.9%; guardrails miss it 89.3% vs 43.5%; production agents 0%→up to 90%.
Can it cause real damage, not just text?
Yes. On a live backend (AgentDojo), 20–28% of triggered trials caused real state mutations — funds transferred, emails sent, files created — with zero on controls.
What is DeFuse and how well does it work?
A lightweight, model-agnostic detector scanning for the conditional structure before it reaches the model. Sliding window + GloVe + Random Forest, AUC = 0.99 at ~150 ms, robust to out-of-distribution attacks.