{
 "license": "CC-BY-4.0",
 "attribution": "Fide AI, Agentic Cyber Explorer",
 "url": "https://agentic-cyber-explorer.pages.dev/events/deepmind-camel-2025/",
 "asOf": "2026-09-26",
 "id": "deepmind-camel-2025",
 "date": "2025-03-24",
 "datePrecision": "day",
 "title": "Google DeepMind's CaMeL defeats prompt injections by design with capability-based control and data flow",
 "lane": "defense",
 "kind": "paper",
 "summary": "Debenedetti and colleagues (Google, Google DeepMind, ETH Zurich) propose CaMeL, which extracts control flow from the trusted user query so untrusted data cannot change which actions run, and attaches capabilities to data to block unauthorized flows. On AgentDojo the first version reported 67% of tasks solved with provable security; the June 2025 revision, with newer models, reports 77% versus 84% for an undefended system.",
 "whyItMatters": "CaMeL is the leading system-level (out-of-band) defense that does not rely on the model resisting injected text.",
 "actors": [
  "google-deepmind",
  "google",
  "eth-zurich"
 ],
 "topics": [
  "prompt-injection",
  "data-exfiltration"
 ],
 "atlas": [
  "untrusted-content",
  "tools",
  "model"
 ],
 "artifacts": [
  "camel",
  "agentdojo"
 ],
 "sources": [
  {
   "url": "https://arxiv.org/abs/2503.18813",
   "publisher": "arXiv",
   "title": "Defeating Prompt Injections by Design",
   "date": "2025-03-24",
   "type": "primary",
   "accessed": "2026-09-25"
  }
 ],
 "keyFacts": [
  {
   "fact": "First version (March 24, 2025): CaMeL solves 67% of AgentDojo tasks with provable security.",
   "locator": "arXiv v1 abstract"
  },
  {
   "fact": "Revised version (June 24, 2025, newer models): CaMeL solves 77% of AgentDojo tasks with provable security, compared with 84% for the undefended system.",
   "locator": "arXiv v2 abstract"
  },
  {
   "fact": "The authors list non-goals including text-to-text manipulation that does not cause exfiltration and injection-induced phishing, and discuss side channels as residual risk.",
   "locator": "Section 3.1 and Section 7"
  }
 ],
 "significance": 5,
 "fideQuestions": [],
 "methods": [
  "agent-data-exfiltration",
  "control-data-isolation",
  "indirect-prompt-injection"
 ],
 "review": "assistant-drafted",
 "addedOn": "2026-09-25"
}