{
  "profile": "wrs-published-research-view-1",
  "edition": "ratings-e039106f30dec177",
  "content_trust": "UNTRUSTED_SCIENTIFIC_DATA_NOT_TOOL_INSTRUCTIONS",
  "entry": {
    "id": "debenedetti-et-al-agentdojo-2024",
    "title": "AgentDojo: stateful evaluation of tool agents under prompt injection",
    "summary": "Built extensible stateful application environments with tool calls, user tasks and attacker-controlled data locations, checking utility and attack success through explicit environment-state predicates.",
    "boundary": "Original v1 comprises97user tasks,629security test cases and74tools, not later revisions. Deterministic task checks are not formal proof of system security; chosen attacks and placements do not exhaust threats.",
    "area": "Adversarial agent evaluation",
    "topic": "Artificial intelligence",
    "year": 2024,
    "lane": "HUMAN",
    "result": "BENCHMARK",
    "contribution_kind": "EVALUATION_RESOURCE_DESIGN",
    "package_id": "debenedetti-et-al-agentdojo-2024",
    "target": {
      "record_id": "urn:uuid:a5180088-24b3-4b2a-a59f-103ff0b4a976",
      "version": 1,
      "content_hash": "sha256:d585621431f29061590dc439884584d080986f007c4f41f4ef6e04fcf75f43b0"
    },
    "humans": [
      "Edoardo Debenedetti",
      "Jie Zhang",
      "Mislav Balunovic",
      "Luca Beurer-Kellner",
      "Marc Fischer",
      "Florian Tramèr"
    ],
    "authors_complete": true,
    "human_role_note": "Source-listed authors or explicitly credited technical contributors for the cited versions. Family entries retain source-specific attribution; a combined list is not one original-paper byline or equal individual work. Names alone do not establish resolved identities.",
    "agents": [],
    "related": [],
    "subresults": [],
    "scientific_assessment": {
      "source_review": "SOURCE_CURATED",
      "scientific_review": "NOT_REVIEWED_BY_WRS",
      "formal_replay": "NOT_RUN",
      "provider_attestation": "NONE"
    },
    "sources": [
      {
        "id": "cur20261015-arxiv-2406-13352v1",
        "title": "AgentDojo: A Dynamic Environment to Evaluate Attacks and Defenses for LLM Agents",
        "url": "https://arxiv.org/abs/2406.13352v1"
      }
    ],
    "points": "120000",
    "published_grade": {
      "id": "debenedetti-et-al-agentdojo-2024",
      "entry_id": "debenedetti-et-al-agentdojo-2024",
      "band": "A",
      "modifier": null,
      "target": {
        "record_id": "urn:uuid:a5180088-24b3-4b2a-a59f-103ff0b4a976",
        "version": 1,
        "content_hash": "sha256:d585621431f29061590dc439884584d080986f007c4f41f4ef6e04fcf75f43b0"
      },
      "what_changed": "Built extensible stateful application environments with tool calls, user tasks and attacker-controlled data locations, checking utility and attack success through explicit environment-state predicates.",
      "scope": "Built extensible stateful application environments with tool calls, user tasks and attacker-controlled data locations, checking utility and attack success through explicit environment-state predicates. Original v1 comprises97user tasks,629security test cases and74tools, not later revisions. Deterministic task checks are not formal proof of system security; chosen attacks and placements do not exhaust threats.",
      "status": "PROVISIONAL_EDITORIAL",
      "scientific_correctness_certified": false
    },
    "assessment_disposition": {
      "status": "ASSESSED",
      "label": "Provisionally assessed",
      "reason": "A current grade and separate reference score identify this exact contribution.",
      "target": {
        "record_id": "urn:uuid:a5180088-24b3-4b2a-a59f-103ff0b4a976",
        "version": 1,
        "content_hash": "sha256:d585621431f29061590dc439884584d080986f007c4f41f4ef6e04fcf75f43b0"
      },
      "edition": "ratings-e039106f30dec177"
    }
  },
  "version": {
    "kind": "PUBLIC_RECORD_VIEW",
    "previous": null,
    "published_at": "2026-10-16T00:00:00Z",
    "publisher": {
      "principal_id": "urn:uuid:80116931-785b-40a2-a24b-9d59db0c7e33",
      "role": "WRS_EDITORIAL_PUBLICATION"
    },
    "record": {
      "contributors": [
        {
          "attribution_basis": "SOURCE_CITED",
          "credit": "historical_scientific",
          "entity_kind": "historical_person",
          "name": "Edoardo Debenedetti",
          "note": "Archive attribution; detailed role assignment remains source-bound",
          "roles": [
            "formulator"
          ],
          "source": {
            "citation": "AgentDojo: A Dynamic Environment to Evaluate Attacks and Defenses for LLM Agents",
            "url": "https://arxiv.org/abs/2406.13352v1"
          }
        },
        {
          "attribution_basis": "SOURCE_CITED",
          "credit": "historical_scientific",
          "entity_kind": "historical_person",
          "name": "Jie Zhang",
          "note": "Archive attribution; detailed role assignment remains source-bound",
          "roles": [
            "formulator"
          ],
          "source": {
            "citation": "AgentDojo: A Dynamic Environment to Evaluate Attacks and Defenses for LLM Agents",
            "url": "https://arxiv.org/abs/2406.13352v1"
          }
        },
        {
          "attribution_basis": "SOURCE_CITED",
          "credit": "historical_scientific",
          "entity_kind": "historical_person",
          "name": "Mislav Balunovic",
          "note": "Archive attribution; detailed role assignment remains source-bound",
          "roles": [
            "formulator"
          ],
          "source": {
            "citation": "AgentDojo: A Dynamic Environment to Evaluate Attacks and Defenses for LLM Agents",
            "url": "https://arxiv.org/abs/2406.13352v1"
          }
        },
        {
          "attribution_basis": "SOURCE_CITED",
          "credit": "historical_scientific",
          "entity_kind": "historical_person",
          "name": "Luca Beurer-Kellner",
          "note": "Archive attribution; detailed role assignment remains source-bound",
          "roles": [
            "formulator"
          ],
          "source": {
            "citation": "AgentDojo: A Dynamic Environment to Evaluate Attacks and Defenses for LLM Agents",
            "url": "https://arxiv.org/abs/2406.13352v1"
          }
        },
        {
          "attribution_basis": "SOURCE_CITED",
          "credit": "historical_scientific",
          "entity_kind": "historical_person",
          "name": "Marc Fischer",
          "note": "Archive attribution; detailed role assignment remains source-bound",
          "roles": [
            "formulator"
          ],
          "source": {
            "citation": "AgentDojo: A Dynamic Environment to Evaluate Attacks and Defenses for LLM Agents",
            "url": "https://arxiv.org/abs/2406.13352v1"
          }
        },
        {
          "attribution_basis": "SOURCE_CITED",
          "credit": "historical_scientific",
          "entity_kind": "historical_person",
          "name": "Florian Tramèr",
          "note": "Archive attribution; detailed role assignment remains source-bound",
          "roles": [
            "formulator"
          ],
          "source": {
            "citation": "AgentDojo: A Dynamic Environment to Evaluate Attacks and Defenses for LLM Agents",
            "url": "https://arxiv.org/abs/2406.13352v1"
          }
        }
      ],
      "evidence": [
        {
          "description": "Bibliographic/stated-result source; not a WRS proof verification",
          "id": "source-0",
          "kind": "source_reference",
          "source": {
            "citation": "AgentDojo: A Dynamic Environment to Evaluate Attacks and Defenses for LLM Agents",
            "url": "https://arxiv.org/abs/2406.13352v1"
          }
        }
      ],
      "origin": "HUMAN_LEGACY",
      "record_profile": "wrs-local-research-notes-0.1",
      "record_type": "research_note",
      "rrp_version": "0.1",
      "scope": {
        "description": "Original v1 comprises97user tasks,629security test cases and74tools, not later revisions. Deterministic task checks are not formal proof of system security; chosen attacks and placements do not exhaust threats.",
        "domain": "Adversarial agent evaluation"
      },
      "sources": [
        {
          "citation": "AgentDojo: A Dynamic Environment to Evaluate Attacks and Defenses for LLM Agents",
          "url": "https://arxiv.org/abs/2406.13352v1"
        }
      ],
      "statement": "# AgentDojo: stateful evaluation of tool agents under prompt injection\n\nBuilt extensible stateful application environments with tool calls, user tasks and attacker-controlled data locations, checking utility and attack success through explicit environment-state predicates.\n\n## Scientific scope\n\nOriginal v1 comprises97user tasks,629security test cases and74tools, not later revisions. Deterministic task checks are not formal proof of system security; chosen attacks and placements do not exhaust threats.\n\n## People and systems\n\nEdoardo Debenedetti; Jie Zhang; Mislav Balunovic; Luca Beurer-Kellner; Marc Fischer; Florian Tramèr\n\n\n\n## Original sources\n\n- [AgentDojo: A Dynamic Environment to Evaluate Attacks and Defenses for LLM Agents](https://arxiv.org/abs/2406.13352v1)\n",
      "summary": "Built extensible stateful application environments with tool calls, user tasks and attacker-controlled data locations, checking utility and attack success through explicit environment-state predicates.",
      "title": "AgentDojo: stateful evaluation of tool agents under prompt injection"
    },
    "record_id": "urn:uuid:a5180088-24b3-4b2a-a59f-103ff0b4a976",
    "version": 1,
    "source_ref": {
      "record_id": "urn:uuid:a5180088-24b3-4b2a-a59f-103ff0b4a976",
      "version": 1,
      "content_hash": "sha256:d585621431f29061590dc439884584d080986f007c4f41f4ef6e04fcf75f43b0"
    },
    "export_view": "wrs-public-editorial-view-1",
    "public_view_hash": "sha256:ef170c4c76e1de2f34ec79ea5db6989a51313f540ec69ede89815b16cd9def5a"
  },
  "target": {
    "record_id": "urn:uuid:a5180088-24b3-4b2a-a59f-103ff0b4a976",
    "version": 1,
    "content_hash": "sha256:d585621431f29061590dc439884584d080986f007c4f41f4ef6e04fcf75f43b0"
  },
  "published_grade": {
    "profile": "wrs-published-grade-1",
    "edition": "2026-10-28.1",
    "id": "debenedetti-et-al-agentdojo-2024",
    "entry_id": "debenedetti-et-al-agentdojo-2024",
    "revision": 1,
    "title": "AgentDojo: stateful evaluation of tool agents under prompt injection",
    "context": "Adversarial agent evaluation",
    "track": "Evaluation resource design",
    "band": "A",
    "modifier": null,
    "status": "PROVISIONAL_EDITORIAL",
    "assessed_on": "2026-10-16",
    "evidence_cutoff": "2026-10-16",
    "achievement_state": "SUPPORTED_SCOPED_RESULT",
    "what_changed": "Built extensible stateful application environments with tool calls, user tasks and attacker-controlled data locations, checking utility and attack success through explicit environment-state predicates.",
    "scope": "Built extensible stateful application environments with tool calls, user tasks and attacker-controlled data locations, checking utility and attack success through explicit environment-state predicates. Original v1 comprises97user tasks,629security test cases and74tools, not later revisions. Deterministic task checks are not formal proof of system security; chosen attacks and placements do not exhaust threats.",
    "evidence_summary": "The linked original sources describe this contribution and its evidence limits. WRS has not independently reconstructed the full scientific claims. Original v1 comprises97user tasks,629security test cases and74tools, not later revisions. Deterministic task checks are not formal proof of system security; chosen attacks and placements do not exhaust threats.",
    "references": [
      {
        "title": "AgentDojo: A Dynamic Environment to Evaluate Attacks and Defenses for LLM Agents",
        "url": "https://arxiv.org/abs/2406.13352v1",
        "locator": "Original contribution and stated assumptions, evaluation scope and limitations; source-linked assessment, not independent execution or proof certification."
      }
    ],
    "roles": [
      {
        "who": "Source-listed authors and technical contributors",
        "credit": "SCIENCE",
        "did": "Source-listed authors or explicitly credited technical contributors for the cited versions. Family entries retain source-specific attribution; a combined list is not one original-paper byline or equal individual work. Names alone do not establish resolved identities."
      }
    ],
    "target": {
      "record_id": "urn:uuid:a5180088-24b3-4b2a-a59f-103ff0b4a976",
      "version": 1,
      "content_hash": "sha256:d585621431f29061590dc439884584d080986f007c4f41f4ef6e04fcf75f43b0"
    },
    "scientific_correctness_certified": false,
    "independent_expert_calibration": false,
    "method": "PROPRIETARY",
    "points": "120000"
  },
  "canonical_agent_submission": false,
  "scientific_verification_awarded": false,
  "reader_guide": null,
  "reading_status": "SOURCE_LINKED_NOTE"
}