%PDF-1.7
%¿÷¢þ
1 0 obj
<< /Lang (en) /Metadata 3 0 R /Names 4 0 R /OpenAction 5 0 R /Outlines 6 0 R /PageMode /UseOutlines /Pages 7 0 R /Type /Catalog /ViewerPreferences << /DisplayDocTitle true >> >>
endobj
2 0 obj
<< /Author (Neil Fendley; Zhengyu Liu; Aonan Guan; Jiacheng Zhong; Yinzhi Cao) /CreationDate (D:20260513001526+00'00') /Creator (arXiv GenPDF \(tex2pdf:a6404ea\)) /DOI (https://doi.org/10.48550/arXiv.2605.11229) /Keywords (Agentic Workflows, Jailbreak, Prompt Injection, CI/CD Security) /License (http://arxiv.org/licenses/nonexclusive-distrib/1.0/) /ModDate (D:20260513001526+00'00') /PTEX.Fullbanner (This is pdfTeX, Version 3.141592653-2.6-1.40.28 \(TeX Live 2025\) kpathsea version 6.4.1) /Producer (pikepdf 8.15.1) /Title (Comment and Control: Hijacking Agentic Workflows via Context-Grounded Evolution) /Trapped /False /arXivID (https://arxiv.org/abs/2605.11229v1) >>
endobj
3 0 obj
<< /Subtype /XML /Type /Metadata /Length 17726 >>
stream
Adobe PDF Schema
pdf
http://ns.adobe.com/pdf/1.3/
Trapped
Text
internal
Indication if the document has been modified to include trapping information
XMP Media Management Schema
xmpMM
http://ns.adobe.com/xap/1.0/mm/
DocumentID
URI
internal
UUID based identifier for all versions and renditions of a document
InstanceID
URI
internal
UUID based identifier for specific incarnation of a document
VersionID
Text
internal
Document version identifier
RenditionClass
RenditionClass
internal
The manner in which a document is rendered
IPTC Core Schema
Iptc4xmpCore
http://iptc.org/std/Iptc4xmpCore/1.0/xmlns/
CreatorContactInfo
ContactInfo
external
Document creator's contact information
ContactInfo
http://iptc.org/std/Iptc4xmpCore/1.0/xmlns/
Iptc4xmpCore
Basic set of information to get in contact with a person
CiAdrCity
Text
Contact information city
CiAdrCtry
Text
Contact information country
CiAdrExtadr
Text
Contact information address
CiAdrPcode
Text
Contact information local postal code
CiAdrRegion
Text
Contact information regional information such as state or province
CiEmailWork
Text
Contact information email address(es)
CiTelWork
Text
Contact information telephone number(s)
CiUrlWork
Text
Contact information Web URL(s)
PRISM Basic Metadata
prism
http://prismstandard.org/namespaces/basic/3.0/
complianceProfile
Text
internal
PRISM specification compliance profile to which this document adheres
publicationName
Text
external
Publication name
aggregationType
Text
external
Publication type
bookEdition
Text
external
Edition of the book in which the document was published
volume
Text
external
Publication volume number
number
Text
external
Publication issue number within a volume
pageRange
Text
external
Page range for the document within the print version of its publication
issn
Text
external
ISSN for the printed publication in which the document was published
eIssn
Text
external
ISSN for the electronic publication in which the document was published
isbn
Text
external
ISBN for the publication in which the document was published
doi
Text
external
Digital Object Identifier for the document
url
URL
external
URL at which the document can be found
byteCount
Integer
internal
Approximate file size in octets
pageCount
Integer
internal
Number of pages in the print version of the document
subtitle
Text
external
Document's subtitle
pikepdf 8.15.1
Agentic Workflows, Jailbreak, Prompt Injection, CI/CD Security
1.7
application/pdf
Comment and Control: Hijacking Agentic Workflows via Context-Grounded Evolution
arXiv
2026-05-13T00:15:26Z
Text
Neil FendleyZhengyu LiuAonan GuanJiacheng ZhongYinzhi Cao
cs.CRcs.AIcs.SE
main.tex
en
2026-05-13T00:15:26Z
2026-05-13T00:15:26Z
2026-05-13T00:15:37.182817+00:00
arXiv GenPDF (tex2pdf:a6404ea)
uuid:75fd75f2-b182-4bbb-ac9b-620a88d7aeae
uuid:54675467-5954-4c46-ab13-eae4c4182054
1
default
Maryland
USA
Neil.Fendley@jhuapl.edu
three
Proceedings of
book
1
1
16
16
http://arxiv.org/licenses/nonexclusive-distrib/1.0/
endstream
endobj
4 0 obj
<< /Dests 8 0 R >>
endobj
5 0 obj
<< /D [ 9 0 R /Fit ] /S /GoTo >>
endobj
6 0 obj
<< /Count 14 /First 10 0 R /Last 11 0 R /Type /Outlines >>
endobj
7 0 obj
<< /Count 16 /Kids [ 12 0 R 13 0 R 14 0 R ] /Type /Pages >>
endobj
8 0 obj
<< /Kids [ 15 0 R 16 0 R 17 0 R 18 0 R 19 0 R ] /Limits [ (Doc-Start) (table.caption.8) ] >>
endobj
9 0 obj
<< /Annots [ 20 0 R 21 0 R 22 0 R 23 0 R 24 0 R 25 0 R 26 0 R 27 0 R 28 0 R 29 0 R 30 0 R 31 0 R 32 0 R 33 0 R 34 0 R 35 0 R 36 0 R 37 0 R 38 0 R 39 0 R 40 0 R 41 0 R 42 0 R ] /Contents [ 43 0 R 44 0 R 45 0 R 46 0 R ] /MediaBox [ 0 0 612 792 ] /Parent 12 0 R /Resources 47 0 R /Type /Page >>
endobj
10 0 obj
<< /A 48 0 R /Next 49 0 R /Parent 6 0 R /Title 50 0 R >>
endobj
11 0 obj
<< /A 51 0 R /Parent 6 0 R /Prev 52 0 R /Title 53 0 R >>
endobj
12 0 obj
<< /Count 6 /Kids [ 9 0 R 54 0 R 55 0 R 56 0 R 57 0 R 58 0 R ] /Parent 7 0 R /Type /Pages >>
endobj
13 0 obj
<< /Count 6 /Kids [ 59 0 R 60 0 R 61 0 R 62 0 R 63 0 R 64 0 R ] /Parent 7 0 R /Type /Pages >>
endobj
14 0 obj
<< /Count 4 /Kids [ 65 0 R 66 0 R 67 0 R 68 0 R ] /Parent 7 0 R /Type /Pages >>
endobj
15 0 obj
<< /Kids [ 69 0 R 70 0 R 71 0 R 72 0 R 73 0 R 74 0 R ] /Limits [ (Doc-Start) (cite.Zhang2025MCPSB) ] >>
endobj
16 0 obj
<< /Kids [ 75 0 R 76 0 R 77 0 R 78 0 R 79 0 R 80 0 R ] /Limits [ (cite.Zhu2023AutoDANIG) (lstnumber.-1.23) ] >>
endobj
17 0 obj
<< /Kids [ 81 0 R 82 0 R 83 0 R 84 0 R 85 0 R 86 0 R ] /Limits [ (lstnumber.-1.24) (page.10) ] >>
endobj
18 0 obj
<< /Kids [ 87 0 R 88 0 R 89 0 R 90 0 R 91 0 R 92 0 R ] /Limits [ (page.11) (subsection.5.1) ] >>
endobj
19 0 obj
<< /Kids [ 93 0 R 94 0 R 95 0 R ] /Limits [ (subsection.5.2) (table.caption.8) ] >>
endobj
20 0 obj
<< /A << /D (cite.Muralee2023ARGUS) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 336.642 215.06 346.973 222.688 ] /Subtype /Link /Type /Annot >>
endobj
21 0 obj
<< /A << /D (cite.DAN) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 432.977 215.141 439.138 222.688 ] /Subtype /Link /Type /Annot >>
endobj
22 0 obj
<< /A << /D (cite.Chao2023JailbreakingBB) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 442.104 215.141 448.266 222.688 ] /Subtype /Link /Type /Annot >>
endobj
23 0 obj
<< /A << /D (cite.Greshake2023NotWY) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 451.232 215.141 461.563 222.688 ] /Subtype /Link /Type /Annot >>
endobj
24 0 obj
<< /A << /D (cite.Meincke2025CallMe) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 464.529 215.06 474.86 222.688 ] /Subtype /Link /Type /Annot >>
endobj
25 0 obj
<< /A << /D (cite.Wang2025AgentVigilGB) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 477.825 215.06 488.157 222.688 ] /Subtype /Link /Type /Annot >>
endobj
26 0 obj
<< /A << /D (cite.Yang2025MCPSecBenchAS) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 491.122 215.06 501.454 222.688 ] /Subtype /Link /Type /Annot >>
endobj
27 0 obj
<< /A << /D (cite.Zhang2025MCPSB) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 504.473 215.06 514.804 222.688 ] /Subtype /Link /Type /Annot >>
endobj
28 0 obj
<< /A << /D (cite.Zhu2023AutoDANIG) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 517.77 215.06 528.101 222.688 ] /Subtype /Link /Type /Annot >>
endobj
29 0 obj
<< /A << /D (cite.Zou2023UniversalAT) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 531.067 215.141 541.398 222.688 ] /Subtype /Link /Type /Annot >>
endobj
30 0 obj
<< /A << /D (cite.Muralee2023ARGUS) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 338.172 193.142 348.503 200.77 ] /Subtype /Link /Type /Annot >>
endobj
31 0 obj
<< /A << /D (cite.DAN) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 343.834 138.428 349.996 145.976 ] /Subtype /Link /Type /Annot >>
endobj
32 0 obj
<< /A << /D (cite.Chao2023JailbreakingBB) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 352.737 138.428 358.899 145.976 ] /Subtype /Link /Type /Annot >>
endobj
33 0 obj
<< /A << /D (cite.Greshake2023NotWY) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 361.64 138.428 371.971 145.976 ] /Subtype /Link /Type /Annot >>
endobj
34 0 obj
<< /A << /D (cite.Meincke2025CallMe) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 374.712 138.348 385.044 145.976 ] /Subtype /Link /Type /Annot >>
endobj
35 0 obj
<< /A << /D (cite.Yu2024DontLT) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 387.785 138.348 398.116 145.976 ] /Subtype /Link /Type /Annot >>
endobj
36 0 obj
<< /A << /D (cite.Zhu2023AutoDANIG) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 400.857 138.348 411.188 145.976 ] /Subtype /Link /Type /Annot >>
endobj
37 0 obj
<< /A << /D (cite.Zou2023UniversalAT) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 413.929 138.428 424.26 145.976 ] /Subtype /Link /Type /Annot >>
endobj
38 0 obj
<< /A << /D (cite.Wang2025AgentVigilGB) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 489.262 138.348 499.593 145.976 ] /Subtype /Link /Type /Annot >>
endobj
39 0 obj
<< /A << /D (cite.Yang2025MCPSecBenchAS) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 502.334 138.348 512.666 145.976 ] /Subtype /Link /Type /Annot >>
endobj
40 0 obj
<< /A << /D (cite.Zhang2025MCPSB) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 515.407 138.348 525.738 145.976 ] /Subtype /Link /Type /Annot >>
endobj
41 0 obj
<< /A << /D (cite.Kinsman2021HowDS) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 439.152 83.553 449.484 91.181 ] /Subtype /Link /Type /Annot >>
endobj
42 0 obj
<< /A << /S /URI /URI (https://arxiv.org/abs/2605.11229v1) >> /BS << /W 0 >> /NM (fitz-L0) /Rect [ 12 218.78998 32 573.21 ] /Subtype /Link >>
endobj
43 0 obj
<< /Length 10 /Filter /FlateDecode >>
stream
xœ+ä î |
endstream
endobj
44 0 obj
<< /Filter /FlateDecode /Length 5206 >>
stream
xÚµ;Û–Û8rïþ
½…�ÓÂÞæig�{;Þ�{Ïœ¬ÇhŠ-ѦHHºGþúT¡
¼éâLròÒ°X(Ô½ªÃÕv®^½¿yxñ§ŸU˜®d"”ŒÌêái•j¡³xg±ÐI´zج>/›ý¾¨»»µŠÂÀÖ¼lêîx—MõM¼.?ÛüKYoéñÇ;©‚-¼Wæ4ñë]ÍñËÓÝÚ„AÕÜ%ÁsKK_K{÷éáÍJ†©0©^e&25|¾î
Øü{·~å>Ø×›ân�ŒÈO_}W65B�3I¹’RdQ¤ðLëÆ:sPS# êeEïÿ\Ô›
?pòo›U*’8‘ør,…Ö+#´¡÷þuüà«Ø}!KE*ñ±Pãý¦ÙÕ|¾×ÍïKĸ8¶ewbZUÉgB:˜Ž�dp‡ p½[Aw§¶ÌÐ[ûèv¯!•™ï~g�°?
N\Ø=øÃ�´_…BÿB<ÒCŒ¤øóç]o• ¤ú‹t•©
>l‘*&ë?vE½=õŒ`Ù_$©‚kH¿KS€.þ0Mñ�
îÍD„(À#"~«Ê^f
iq›q/Ë•ŽDó»Žý›ÚÖô™W½/�2a¼øê¯w&Nߊá’[BPÂ÷{cÉvR×5õòHR¡\Ïß°ˆ“Ø:~&bÀ—dˆ¼Ù_–¥c‘&éj�0^'¼)mŽWM_üÇ®�á¥K”Z¤K²þ?^"ðT–Îûó7DNep‹·/1Q" #ºD~÷¿ÊúÛ®d}g›‹'T‘ˆBõ:á‘ÝÔQ4?áÉa)rÛ,9õLåö*5+²0“„~7dX妞yÛîhón