New Research: Single Prompt Injection Can Cause Recursive Execution in AI Agents, Amplifying Resource Consumption by 51x
Researchers propose 'Mobius Injection,' an attack paradigm using Semantic Closure to trap AI agents in recursive execution loops, leading to resource-exhaustion DDoS.
ImportanceMaterialEvidenceE2 unreplicatedWrite-upQuick
An arXiv preprint titled "Mobius Injection" introduces a novel attack paradigm that weaponizes autonomous Large Language Model (LLM) agents into zombie nodes to launch Agent-based and -Oriented DDoS (AbO-DDoS) attacks. The study, updated on October 19, 2026, was conducted by researchers including Zi Liang.
While prior research focused on the security of LLMs or agents in isolation, this work exposes the systemic risk of agents acting as disruptive "hubs" between users and services. The core mechanism, termed "Semantic Closure," combines known indirect prompt injection techniques with persistent agent components. A single malicious input triggers sustained recursive execution within the agent. This attack is lightweight for adversaries and evades traditional volumetric DDoS monitors and input filters calibrated for low false-positive rates.
Experiments across three representative claw-style agents and three mainstream coding agents, integrated with 12 frontier proprietary or open-weight LLMs, demonstrated substantial impact. The attack achieved a single-node call amplification factor of up to 51.0x. Under coordinated multi-node pressure, each infected node drained approximately 123k–127k tokens on a shared five-GPU backend. Benign request latency increased by about 23x–24x, eventually saturating shared capacity and effectively denying service to legitimate traffic.