Adaptive Attacks Break Defenses Against Indirect Prompt Injection Attacks on LLM Agents