{
 "license": "CC-BY-4.0",
 "attribution": "Fide AI, Agentic Cyber Explorer",
 "url": "https://agentic-cyber-explorer.pages.dev/events/agentdojo-benchmark-2024/",
 "asOf": "2026-09-26",
 "id": "agentdojo-benchmark-2024",
 "date": "2024-06-19",
 "datePrecision": "day",
 "title": "AgentDojo: an extensible environment for prompt injection attacks and defenses on LLM agents",
 "lane": "defense",
 "kind": "benchmark",
 "summary": "Debenedetti and colleagues (ETH Zurich, Invariant Labs) release AgentDojo, a dynamic environment with 97 realistic user tasks across workspace, banking, travel and Slack suites and 629 security test cases. It measures both utility and targeted attack success, and reports that existing attacks break some security properties but not all. It became the standard testbed used by CaMeL, US AISI/CAISI, LlamaFirewall and adaptive-attack studies.",
 "whyItMatters": "Most later agent prompt-injection defense claims, and the adaptive attacks against them, are reported on AgentDojo.",
 "actors": [
  "eth-zurich",
  "invariant-labs"
 ],
 "topics": [
  "prompt-injection",
  "tool-and-mcp-security"
 ],
 "atlas": [
  "untrusted-content",
  "tools",
  "eval-environment"
 ],
 "artifacts": [
  "agentdojo",
  "gpt-4-family"
 ],
 "sources": [
  {
   "url": "https://arxiv.org/abs/2406.13352",
   "publisher": "arXiv",
   "title": "AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents",
   "date": "2024-06-19",
   "type": "primary",
   "accessed": "2026-09-25"
  },
  {
   "url": "https://arxiv.org/html/2406.13352",
   "publisher": "arXiv",
   "title": "AgentDojo (HTML, current version)",
   "date": "2024-06-19",
   "type": "primary",
   "accessed": "2026-09-25"
  }
 ],
 "keyFacts": [
  {
   "fact": "97 tasks and 629 security test cases.",
   "locator": "Abstract"
  },
  {
   "fact": "GPT-4o: 69.00% benign utility, 50.08% utility under the 'important instructions' attack, 47.69% targeted attack success rate.",
   "locator": "Section 4.1, Figure 6; Appendix C Table 3 (current HTML version)"
  },
  {
   "fact": "Targeted ASR for GPT-4o with defenses: tool filter 6.84%, prompt injection detector 7.95%, repeat user prompt 27.82%, data delimiting 41.65%, against 57.69% with no defense in the same table (current version).",
   "locator": "Section 4.3, Figure 9; Appendix C Table 5"
  }
 ],
 "significance": 5,
 "fideQuestions": [],
 "methods": [
  "adaptive-red-teaming",
  "control-data-isolation",
  "indirect-prompt-injection",
  "injection-classifiers",
  "input-delimiting"
 ],
 "review": "assistant-drafted",
 "addedOn": "2026-09-25"
}