Indirect Prompt Injection in LLM Agent Frameworks: A Comparative Study

Task framing, rather than the agent framework, is the primary driver of vulnerability in indirect prompt-
injection attacks on LLM agents. This study presents a controlled empirical analysis across 3,274
trials, benchmarking LangChain, MCP, and a Direct Anthropic API baseline exclusively on Claude
Sonnet 4 to isolate framework-specific vulnerabilities. The results demonstrate that vulnerability
is framework-independent on the model tested: MCP adds no measurable attack surface relative to
a raw API baseline (p > 0.6). Task framing was the dominant factor, with instruction-following
tasks reaching 89-91% attack success rates versus 15-26% for constrained tasks. LangChain’s
FAISS retrieval introduced task-dependent exposure, amplifying attack surface when payloads were
semantically similar to the query and inadvertently suppressing them when they were not. Hardened
system prompts reduced attack success by over 17× but created a brittle threshold rather than a
gradient: among the 20-21 valid trials where the model engaged despite hardening, exploitation rates
exceeded 55%.