Debenedetti and colleagues (Google, Google DeepMind, ETH Zurich) propose CaMeL, which extracts control flow from the trusted user query so untrusted data cannot change which actions run, and attaches capabilities to data to block unauthorized flows. On AgentDojo the first version reported 67% of tasks solved with provable security; the June 2025 revision, with newer models, reports 77% versus 84% for an undefended system.
Why it matters
CaMeL is the leading system-level (out-of-band) defense that does not rely on the model resisting injected text.
Key facts
As stated in the sources, with where to find them.
- First version (March 24, 2025): CaMeL solves 67% of AgentDojo tasks with provable security.arXiv v1 abstract
- Revised version (June 24, 2025, newer models): CaMeL solves 77% of AgentDojo tasks with provable security, compared with 84% for the undefended system.arXiv v2 abstract
- The authors list non-goals including text-to-text manipulation that does not cause exfiltration and injection-induced phishing, and discuss side channels as residual risk.Section 3.1 and Section 7
Findings that cite this record
Key questions this bears on
- Can prompt injection against AI agents be reliably defended?Not reliably. Defenses reduce injection but none has eliminated it; limiting what untrusted input can trigger is the most defensible approach.
Sources
Related records
Mar 24, 2025
Jun 10, 2025
May 20, 2025
May 22, 2025
May 6, 2025
Jan 19, 2026