Mobius Injection：单次提示词注入可让 AI 智能体持续耗尽资源

View PDF HTML (experimental)

Abstract:Large Language Model (LLM) agents have emerged as key intermediaries, orchestrating complex interactions between human users and a wide range of digital services and LLM infrastructures. While prior research has extensively examined the security of LLMs and agents in isolation, the systemic risk of the agent acting as a disruptive "hub" within the user-agent-service chain remains largely overlooked. In this work, we expose a novel threat paradigm by introducing Mobius Injection, a sophisticated attack that weaponizes autonomous agents into zombie nodes to launch what we define as Agent-based and -Oriented DDoS (AbO-DDoS) attacks. Mobius Injection composes known indirect prompt injection and persistent agent components through a distinct structural mechanism named Semantic Closure, which induces sustained recursive execution of agent components through a single injection event. We demonstrate that this attack is lightweight for the adversary, can evade traditional volumetric DDoS monitors and input filters calibrated for low false-positive rates, and is highly configurable, allowing for surgical targeting of specific environments or model providers. To evaluate the real-world impact, we conduct extensive experiments across three representative claw-style agents and three mainstream coding agents, integrated with 12 frontier proprietary or open-weight LLMs. Our results demonstrate that Mobius Injection achieves substantial attack success across diverse tasks, driving single-node call amplification up to 51.0x. Under coordinated multi-node pressure, each infected node still drains about 123k--127k tokens on a shared five-GPU backend; benign request latency rises by abou 23x--24x, and coordinated infections eventually saturate shared capacity until benign traffic is effectively denied service.

Comments:	Relative to the NDSS 2027 camera-ready version: same experimental runs; T-ASR and R-ASR labeling refined after we found under-detection in the prior T-ASR checks (successful triggers missed); Nested P/T/R labels; all others unchanged. Source code: this https URL
Subjects:	Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI); Computation and Language (cs.CL)
Cite as:	arXiv:2605.11442 [cs.CR]
	(or arXiv:2605.11442v3 [cs.CR] for this version)
	https://doi.org/10.48550/arXiv.2605.11442 arXiv-issued DOI via DataCite

Submission history

From: Zi Liang [view email]
[v1] Tue, 12 May 2026 02:51:12 UTC (2,388 KB)
[v2] Mon, 19 Oct 2026 03:34:45 UTC (2,415 KB)
[v3] Mon, 2 Nov 2026 02:11:41 UTC (2,416 KB)