An Oct 16 arXiv preprint (Zarif et al.) audits 33,000 trajectories from eleven open-weight agents (2-14B parameters) on the InjecAgent and AgentDojo indirect prompt injection benchmarks. A label-blind LLM judge found most failed attacks were ignored (76-80%) rather than refused (17-18%). With identical weights, changing only the system prompt moved InjecAgent attack success from 0.2% to 43%. In 21.7% of AgentDojo episodes, the agent stayed safe but didn't finish the user's task. The authors argue that attack success rate alone overstates robustness. They want benchmarks to report how attacks fail and whether the real task got done. The labeled corpus, judge prompt and code are released. Takeaway if you run small local models as agents: a low ASR on a benchmark doesn't mean the model recognizes injections, and your system prompt can swing it a lot. Re-test after any prompt change. (Some X posts summarizing this paper misstate the numbers; the figures here are from the abstract.)