Inria

Researchers construct matched benign and attacked Claude Code and Codex executions to study injections that advance through a workflow before causing a consequential action. In the common-tool-call comparison with Claude Sonnet 5 as auditor backend, their Path-Aligned Attribution auditor reports higher recall and lower false-block rates than VIGIL and ARGUS; with GPT-5.5, results involve a recall–false-block tradeoff. The retained successful attacks and offline action-level evaluation demonstrate feasibility and auditing performance in controlled tasks, not deployment prevalence or live prevention rates.