---
source: https://info.defcon.org/defcon34/content/66817
created: 2026-08-09T11:42:00
---
- [Bogdan Stelee](https://info.defcon.org/defcon34/people/67551 "Bogdan Stelee")
- [Arnav Garg](https://info.defcon.org/defcon34/people/67531 "Arnav Garg")

## Overview

Finding one prompt injection isn't the end goal; checking how many variants still bypass your safeguarding layers is the new target. Introducing MPG, an XPIA mutation framework that generates adversarial payload variants and tests them across agentic AI systems to expose hidden vulnerability surfaces and emerging data exfiltration risks.

## Notes

### Convergent Search
- TAP, PAIR, GPTFuzzer — find a successful jailbreak

### Mutated Prompt Generator (MPG) Framework
- Input: unconfirmed UPIA / IPIA seed playlist
- Output: map of residual exploitable surface
- Goals
	- Breach the variant space
	- Mutation gated by token-segment classification
	- Outcome scored by subtree viability

### Use Cases
- Attack surface exploration: explore the breadth of the attack surface
- Edge-case discovery: was the mitigation enough, or are there uncovered edge cases?
- Both are usable defensively — before release, or as patch validation on an AI feature

### Indirect Prompt Injection (IPIA)
- Tokens are segmented to hide malicious prompt instructions
- Semantically-aware mutation
	- Classify the attack ops and benign operations
	- Then mutate the attack or benign instructions appropriately
- Sequenced so the attack instructions land in the right place
- The framework includes an evaluation layer, then an execution layer to measure the breadth and viability

### Tool
- Built a Playwright browser tool to carry out the above steps
- Initial prompt should be blocked if patched
	- Then mutations are tested and evaluated pass/fail
- Subtree viability algorithm
	- Checks how many times it succeeded once a bypass is found