AgentDojo - Dynamic Environment for Agent Prompt Injection Evaluation

Overview

AgentDojo is an evaluation framework for agents that call tools over untrusted data. It was designed not as a fixed test suite but as an environment that researchers can extend with new tasks, defenses and adaptive attacks.

Research question

How can the adversarial robustness of tool-using agents be measured in a way that keeps pace with new attacks and defenses, and that does not reward a defense simply for making the agent useless?

Method and artifact

The environment is populated with 97 realistic tasks, such as managing an email client, navigating an e-banking website or making travel bookings, plus 629 security test cases and several attack and defense paradigms from the literature. It reports utility (does the agent complete the user's task) and security (does it avoid the attacker's goal) separately, both with and without attacks.

• ethz-spylab/agentdojo (GitHub) - official, extensible benchmark framework

Key findings reported by the authors

Source statements: the points below summarize what the cited publication reports for the models and configurations it tested.

• The benchmark was challenging for both sides: state-of-the-art LLMs at the time failed many tasks even without attacks.
• Existing prompt injection attacks broke some security properties, but not all.
• The authors present AgentDojo as a basis for research on new design principles for reliable and robust agents.

Security interpretation

Site interpretation: this section is Prompt-Injection.net's explanation of why the work matters, not a claim made by the authors.

Measuring utility and security together is the key contribution for practitioners. A defense that blocks attacks by also blocking legitimate work is not a solution; AgentDojo makes that trade-off visible. Later work, including CaMeL, reports results on this benchmark.

Limits and caveats

• All model and defense results are tied to the versions and configurations tested; scores can change as the environment is updated.
• The arXiv record notes an updated version after fixing a bug in one model implementation and updating a task suite, so compare only results from the same version.
• Simulated environments approximate, but do not replicate, production permissions and data.

How to use this work

Use AgentDojo when evaluating an agent defense: report utility with and without attacks alongside security, and record the framework version. Treat leaderboards derived from it as snapshots, not rankings of current products.

Related content on Prompt-Injection.net

• AI Agent Prompt Injection - How prompt injection in an agentic system can become a security-relevant action chain, why proposal is not authorization, and which deterministic gates break the chain.
• Tool Output Injection - Why a trusted tool does not make its returned content trusted, how tool results reach model context, and how provenance, capability limits and deterministic authorization contain agent impact.
• AI Agents and Tool Calling - How model proposals become actions: the tool-calling loop, availability vs permission, runtime authorization, approval, tool results as variable data and audit.
• Agent Authorization - How to authorize AI agent actions outside the model: initiating principal, agent identity, resource, action, parameters, destination, scope and policy version, with exact-action binding and downstream revalidation.
• Prompt Injection Detection - How to detect prompt injection attempts and effects at runtime by correlating content, context, model behavior, plan, tool and enforcement signals. Probabilistic evidence for response and investigation, never authorization or a replacement for deterministic enforcement.
• Tool-Chain Analysis (Lab) - A guided exercise on sequence-level analysis of composed tool effects: ordered chains from application telemetry, cumulative limits, unobserved results and bounded cross-agent chains.
• CaMeL - Defeating Prompt Injections by Design - A system-layer defense that derives control and data flow from the trusted user query, so untrusted data cannot change program flow, and enforces capability-based policies on tool calls.