StakeBench research finds AI web agents have no reliable defense against prompt injection attacks

Research from Nanyang Technological University showed that AI web agents running on GPT-5 and Gemini implementations lack consistent defenses against prompt injection—not a single attack scenario was reliably blocked across the tested systems. The findings indicate a foundational vulnerability in agent security across leading model implementations.