Navigation agents powered by large language models (LLMs) convert natural language instructions into executable plans and actions. Compared to text-based applications, their security is far more critical: a successful prompt injection attack does not just alter outputs but can directly misguide physical navigation, leading to unsafe routes, mission failure, or real-world harm. Despite this high-stakes setting, the vulnerability of navigation agents to prompt injection remains largely unexplored. In this paper, we propose PINA, an adaptive prompt optimization framework tailored to navigation agents under black-box, long-context, and action-executable constraints. Experiments on indoor and outdoor navigation agents show that PINA achieves high attack success rates with an average ASR of 87.5%, surpasses all baselines, and remains robust under ablation and adaptive-attack conditions. This work provides the first systematic investigation of prompt injection attacks in navigation and highlights their urgent security implications for embodied LLM agents.

翻译：基于大语言模型（LLM）的导航智能体将自然语言指令转换为可执行的规划与动作。与基于文本的应用相比，其安全性更为关键：成功的提示注入攻击不仅会篡改输出，更可直接误导物理导航，导致不安全路径、任务失败乃至现实危害。尽管风险极高，导航智能体对提示注入的脆弱性迄今尚未得到充分探究。本文提出PINA——一种针对黑盒、长上下文与动作可执行约束下的导航智能体设计的自适应提示优化框架。在室内外导航智能体上的实验表明，PINA实现了高达87.5%的平均攻击成功率，超越所有基线方法，并在消融实验与自适应攻击条件下保持稳健性。本研究首次系统性地探索了导航领域的提示注入攻击，并揭示了其对具身LLM智能体迫切的安全威胁。