AgentDojo: stateful evaluation of tool agents under prompt injection

What changed

Built extensible stateful application environments with tool calls, user tasks and attacker-controlled data locations, checking utility and attack success through explicit environment-state predicates.

Scientific scope

Built extensible stateful application environments with tool calls, user tasks and attacker-controlled data locations, checking utility and attack success through explicit environment-state predicates. Original v1 comprises97user tasks,629security test cases and74tools, not later revisions. Deterministic task checks are not formal proof of system security; chosen attacks and placements do not exhaust threats.

Evidence

The linked original sources describe this contribution and its evidence limits. WRS has not independently reconstructed the full scientific claims. Original v1 comprises97user tasks,629security test cases and74tools, not later revisions. Deterministic task checks are not formal proof of system security; chosen attacks and placements do not exhaust threats.

Contributors

• Source-listed authors and technical contributors · SCIENCE: Source-listed authors or explicitly credited technical contributors for the cited versions. Family entries retain source-specific attribution; a combined list is not one original-paper byline or equal individual work. Names alone do not establish resolved identities.

• AgentDojo: A Dynamic Environment to Evaluate Attacks and Defenses for LLM Agents

Provisional WRS assessment, edition 2026-10-16.1. Independent expert calibration is pending. This grade does not certify correctness or assign ownership.

Full scientific record · Browse contribution grades · Request a correction