Mahal Systems AgentDojo
Fits assistants that read untrusted content (email, documents, web) and then act with tools. Borrow the pairing of a user task with an injection task, and the utility-under-attack plus targeted attack success rate metrics checked on environment state, not on model text.
What it asks the agent to do
- complete an email, calendar or file task from a one-line request
- make a bank transfer or check transactions
- book travel from a request
- ignore instructions hidden in tool output while finishing the task
- avoid doing the attacker's task (send data, transfer money)
What to borrow from it
grading designsandbox designcase templatebaseline
Caveats
97 user tasks become 629 security cases only by crossing tasks with injections; all data is synthetic; the results page is not a maintained leaderboard and ends in early 2025.
Details
| Workloads | safety, security, tool calling, email calendar, finance |
|---|---|
| Interaction | single turn |
| Environment | api sandbox |
| End state checked | Yes |
| Tools | simulated email, calendar, cloud drive, Slack, travel booking and banking APIs |
| Grading | state diff, programmatic check |
| Size | 97 |
| Data | synthetic |
| Personal data | none |
| License | MIT |
| Harness | inspect_evals, own repo |
| Status | active |
Links
Situations it helped establish
- Injected instruction: Content the agent reads, such as a web page, email or record, contains instructions aimed at the agent.