SEAL cuts AgentDojo prompt-injection success from 34.6% to 0.1%
Joint task completion without attack success rises from 51.4% to 77.5%, using about 127 times fewer defense tokens than PISanitizer.
52
Product
AgentDojo
- Mentions · 7d1
- Mentions · 30d8
- All mentions15
- First seenSep 4, 2026
- Last mentioned3d ago
Timeline
15 articles · newest firstPrompt-injection outcomes often form after the agent reads
Thinking cuts Qwen3 variance fixed at read time from 0.91 to 0.62, and single-run labels disagree up to 35%.
58
Shortcut Sensitivity in Agent-Safety Evaluations
Shortcut cues in agent-safety benchmarks can change guard decisions and measured accuracy.
48
Matoi: Selective Revalidation of Consequence Evidence for Agent Authorization
Matoi reuses checked consequence evidence for agent authorization, cutting lifecycle cost a few percent in tests.
36
The Agent Knew: Internal States Forecast Unauthorized Actions and Stop Them, and the Lies That Follow
Internal-state readouts forecast unauthorized agent actions and lies, cutting violations and prompt-injection success.
68
Formal Runtime Verification for Tool-Using LLM Agents: An Offline Same-Benchmark Study on AgentDojo and STAC
Offline MFOTL monitoring flags about 70% of AgentDojo and STAC agent attacks but also 29% of benign runs.
52
Correct Answers, Unsupported Findings: Evidence Binding in Forensic Reconstruction of LLM Agent Logs
Study finds LLM readers can match agent-log facts while asserting unsupported citation sources.
44
Compromise Is Not Consequence: Evaluating Task-Scoped Authorization in LLM Agents with Paired Replay
Scoped authorization stopped harmful LLM-agent tool execution that broad bearer tokens still allowed.
56
False Floors: LLM Safety Routing Evaluations Break Under Distribution Shift
Safety-router benchmarks overstate routing gains by picking the best model on test data.
52
ToolFence: Fine-Grained Authorization for Secure Tool-Using LLM Agents
ToolFence authorizes tool-using LLM agents before execution, driving AgentDojo attack success near zero on Qwen3-max.
62
Same Bytes, Different Authority: Reserved-Token Representations in Chat-Template Prompt Injection
Reserved chat-template tokens give injected instructions far more authority than identical subword text on open-weight models.
68
AgentXploit: Autonomous Repository-to-Runtime Red-Teaming for AI Agents
AgentXploit audits AI-agent repos into confirmed runtime attacks, reaching 59.3% success on 72 benchmark bugs.
62
ActGov: Governing LLM Agent Actions via Policy-Constrained Validation
ActGov validates each LLM agent tool call at runtime, cutting indirect prompt-injection success while preserving task utility.
61
CaMeLoT: CaMeL orchestrated with Temporal logic for static verification and liveness
Researchers present CaMeLoT, extending CaMeL with CTL model checking that statically rejects unsafe LLM agent plans before any tool executes.
40
EvoSafeHarness: Evolving Model- and Domain-Specific Harnesses for Securing Agents
EvoSafeHarness auto-synthesizes per-model, per-domain safety harnesses, cutting prompt-injection attack success on AgentDojo to 0.0% at 82.8% utility.
48
Appears with
- AgentDynproduct · 2
- CaMeLproduct · 2
- LinuxArenaproduct · 1
- PISanitizerproduct · 1
- Llama-3.1ai model · 1
- Hugging Faceorganization · 1
- HELM Safetyproduct · 1
- Qwen3-8Bai model · 1
- STACproduct · 1
- Haikuai model · 1
- gpt-ossai model · 1
- AgentVigilproduct · 1
- InjecAgentproduct · 1
- Agent-SafetyBenchproduct · 1
- Qwen3ai model · 1
- Claude Sonnetai model · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.