agentdojo

Open, privacy-bounded assurance for AI agents: containment provenance, identity passports, authorization twins, OTel evidence, CI gates, and OSCAL.

Action-graded severity scoring (L0-L6) for tool-using AI agents, computed from red-team execution traces.

Reproducible evaluation of deterministic sequence rules for AI-agent tool-call traces.

Formal runtime verification for tool-using LLM agents: MFOTL/MonPoly replayed offline on AgentDojo, STAC and R-Judge. Paper, MFOTL specifications, experiments, and the benchmark-readiness audit (CPSIoTSec 2026).

LangChain-native AgentDojo benchmark: utility + ASR evaluation across banking, slack, travel, and workspace suites.

Benchmarking schema-valid false tool observations and defense baselines for tool-using LLM agents.

LLM agents read untrusted text, then call tools. We built a detector, measured it failing live (0/125), and replaced it with a pre-execution lock on money calls. Same 144 episodes, 0.00% attack success.

Measure how well an agent tool-call authorization layer separates legitimate actions from injected ones, on AgentDojo ground truth. No agent runs, no model calls, seconds to run. Ships the controls that make a block rate meaningful.

Information-flow control runtime for LLM agents: label data, track flows through tool calls, and block prompt-injection exfiltration at the sink. Python + TypeScript, CaMeL-style strict mode, OPA, OCSF/SARIF, AgentDojo-benchmarked.

Security audit of LLM-based multi-agent systems with indirect prompt-injection PoCs and mitigations.

Deterministic, text-blind policy gate that stops prompt injection in tool-using LLM agents — measured on AgentDojo

Evaluating provenance-gated tool calls as a prompt injection defense on AgentDojo. Reproducible runs, per-case analysis, and published results.

Systematic evaluation of prompt injection defenses in LLM agents, across seven models and two benchmarks, plus a mechanistic analysis of why the defenses fail.

プロンプトインジェクションの評価フレームワークの再現実験

A local-first research scaffold for evaluating models, agent harnesses, and complete agent products on realistic, stateful tasks.

Measuring prompt-injection defences against policy-conformant attacks

Personal research project — solo, unaffiliated. Inspect AI evaluation framework for LLM agent security: ASR, benign utility, and Transparency Rate across prompt injection, tool poisoning, and psych attacks.