mlsanityData to 7 Oct 2026

Arbiter: Detecting Interference in LLM Agent System Prompts

arXiv 2603.08993 ↗First posted 9 Mar 2026cs.SE cs.AI cs.CRcited by 2

On the map: LLM agents and tool use → Software engineering coding agents

Abstract (arXiv)

System prompts for LLM-based coding agents are software artifacts that govern agent behavior, yet lack the testing infrastructure applied to conventional software. We present Arbiter, a framework combining formal evaluation rules with multi-model LLM scouring to detect interference patterns in system prompts. Applied to three major coding agent system prompts: Claude Code (Anthropic), Codex CLI (OpenAI), and Gemini CLI (Google), we identify 152 findings across the undirected scouring phase and 21 hand-labeled interference patterns in directed analysis of one vendor. We show that prompt architecture (monolithic, flat, modular) strongly correlates with observed failure class but not with severity, and that multi-model evaluation discovers categorically different vulnerability classes than single-model analysis. One scourer finding was structural data loss in Gemini CLI's memory system was consistent with an issue filed and patched by Google, which addressed the symptom without addressing the schema-level root cause identified by the scourer. Total cost of cross-vendor analysis: 0.27 USD.

Key facts. Cited by 2 papers in the map (data through 7 Oct 2026). Placed in Software engineering coding agents, one of 16 directions in LLM agents and tool use. Builds on 6 of its 14 references that are in the map. First posted on arXiv 9 Mar 2026.

Builds on

6 of 14 references.

References · 6

  1. 2022Chain-of-Thought Prompting Elicits Reasoning in Large Language Modelscited by 12,302
  2. 2023Judging LLM-as-a-Judge with MT-Bench and Chatbot Arenacited by 8,393
  3. 2022Self-Consistency Improves Chain of Thought Reasoning in Language Modelscited by 5,601
  4. 2023Tree of Thoughts: Deliberate Problem Solving with Large Language Modelscited by 3,155
  5. 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,339
  6. 2023Prompt Injection attack against LLM-integrated Applicationscited by 568

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2026: 2.

2 papers.

Similar, not cited

Close in wording, no citation either way

  1. 2026Just Ask: Curious Code Agents Reveal System Prompts in Frontier LLMs
  2. 2026Understanding Agent-Reactive Bugs at the Model-Harness Boundary: An Empirical Study of LLM Agent Issue Reports
  3. 2026TraceLab: Characterizing Coding Agent Workloads for LLM Serving
  4. 2026Taming Scylla: Understanding the multi-headed agentic daemon of the coding seas
  5. 2026When Agents Implement Systems: A Case Study in Defects, Detection, and Evaluation Rigor
  6. 2026Complex Agents, Shallow Tests: Demystifying and Enhancing Test Adequacy of Agent Harness in the Wild
  7. 2025ImpossibleBench: Measuring LLMs' Propensity of Exploiting Test Cases
  8. 2025More Vulnerable than You Think: On the Stability of Tool-Integrated LLM Agents