LLM agents that read untrusted content can be hijacked by prompt injections, according to a new arXiv paper. The abstract notes that runtime monitors—which try to catch a hijack before the agent acts—and benchmarks that score each task with a single run share a common assumption. That assumption, though the abstract cuts off mid-sentence, is central to the paper's argument: the moment of decision matters.
The title, "The Window Is in the Reasoning," suggests that the decisive moment is not the final action but the reasoning that precedes it. If an agent's internal deliberation is where a prompt injection takes hold, then monitoring and evaluation methods that only look at outcomes may miss the hijack entirely.
This has practical implications for both safety and benchmarking. Runtime monitors would need to inspect the reasoning process, not just the action taken. Benchmarks would need to account for the possibility that a single run's score hides whether an injection influenced the agent's chain of thought.
The paper is a single source, so its claims should be read as a research position rather than a settled finding. But it highlights a growing concern: as LLM agents act on untrusted content, the reasoning window may be the most important place to look for attacks.