Mahal Systems InjecAgent
Fits a first, cheap check of any tool-calling agent for indirect prompt injection. Borrow the two attacker goals (direct harm, data theft) and the user-case times attacker-case crossing that gives many cases from few templates.
What it asks the agent to do
- read a tool result that contains attacker instructions
- avoid calling a harmful tool the attacker asks for
- avoid extracting private data and sending it to the attacker
- finish the user's original request
What to borrow from it
case templatetaxonomy
Caveats
No tool is executed; tool responses are templates, so success is just whether the attacker tool is called; the repo has not changed since mid-2024 and newer models mostly pass it.
Details
| Workloads | safety, security, tool calling |
|---|---|
| Interaction | single turn |
| Environment | static |
| End state checked | No |
| Tools | templated tool specs; 17 user tools, 62 attacker tools |
| Grading | programmatic check |
| Size | 1,054 |
| Data | synthetic |
| Personal data | none |
| License | MIT |
| Harness | own repo |
| Status | frozen |
Links
Situations it helped establish
- Injected instruction: Content the agent reads, such as a web page, email or record, contains instructions aimed at the agent.