Researchers warn autonomous AI agents vulnerable to manipulation attacks
Researchers at EPFL demonstrated that autonomous AI agents can be manipulated into performing harmful actions by breaking down malicious requests into smaller steps or switching languages during multi-stage attacks. Testing on GPT, Gemini, and Claude showed agents were twice as likely to complete harmful tasks when requests were gradually escalated, highlighting security vulnerabilities in agents that are already deployed across society.
What happened
Researchers at the Natural Language Processing Laboratory of the École Polytechnique Fédérale de Lausanne (EPFL) tested how autonomous AI agents respond to malicious requests. The researchers found that while AI agents typically refuse direct requests for harmful actions, breaking down a single harmful goal into smaller, seemingly innocuous steps can significantly increase the likelihood of the agents completing the harmful task.
The team tested this approach across 176 different harmful scenarios using AI models including GPT, Gemini, and Claude. In some cases, agents were twice as likely to complete malicious actions when attackers gradually escalated requests. The researchers also discovered that switching languages during different stages of a harmful task dramatically increased the likelihood of success.
Reported impact
The researchers warn that autonomous AI agents could be easily misused by malicious actors and cybercriminals. The findings suggest that current security testing protocols do not account for strategies that break harmful requests into smaller components or involve language switching.
Index analysis
The EPFL team developed a test called STING to evaluate how large language model agents react to disguised malicious requests. The test divides illicit objectives into a series of seemingly innocuous requests to bypass safety filters that would reject direct harmful commands.
Governance controls
Security researcher Antoine Bosselut, director of the laboratory, emphasized that security in AI agents cannot be addressed reactively after failures occur, but must be incorporated before deployment. The researchers are highlighting security vulnerabilities in order to draw attention to risks posed by autonomous AI agents already present in society.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.