Findings/architectural-isolation-bounds-injection

Separating an agent's control flow from untrusted data can give provable protection against control-flow hijacking at a modest utility cost.

Revalidatemeasured1 evidence record from 1 independent sourceassistant-drafted

Scope: what this does not show

One design (CaMeL) on AgentDojo; does not stop manipulation within permitted data flows, and has not been independently attacked at scale.

Revalidate: Older than its half-life with no newer evidence. May no longer hold.

Evidence

Mar 24, 2025

Google DeepMind's CaMeL defeats prompt injections by design with capability-based control and data flow

arXiv

Solved 77% of AgentDojo tasks with provable security; about 7 points below an undefended agent.

How it relates to other findings

supportsqualifiescontestssupersedes

ReportedCorroboratedQualifiedContestedSupersededRevalidate· node size = evidence records · columns group by topic

Select a finding to see how it relates to others. Arrows point from the newer finding to the one it supports, qualifies, contests, or supersedes.

Limiting what untrusted input can cause an agent to do gives injection resistance that does not depend on the model resisting. supports this findingCaMeL is one implementation of this principle.

Status history

2025-03-24ReportedGoogle DeepMind introduces CaMeL. · record
2026-09-26RevalidateComputed: 551 days since the last evidence, past the 540-day half-life.

What would change this: An independent adaptive evaluation of CaMeL or a successor.
Evidence kind: measured: An experiment or evaluation produced the number.
Freshness: Evidence 551d old · past its 540-day recheckNewest evidence Mar 24, 2025. Half-life 540 days.
Methods tested: Separating control flow from untrusted data Indirect prompt injection
Topics: Prompt injection
Attack surface: Untrusted content Tools & MCP

Cite this record

Fide AI. "Separating an agent's control flow from untrusted data can give provable protection against control-flow hijacking at a modest utility cost.." Agentic Cyber Explorer, record architectural-isolation-bounds-injection. https://agentic-cyber-explorer.pages.dev/findings/architectural-isolation-bounds-injection/ (corpus as of 2026-09-26).

BibTeX

@misc{fide-ace-architectural-isolation-bounds-injection,
  author = {{Fide AI}},
  title = {Separating an agent's control flow from untrusted data can give provable protection against control-flow hijacking at a modest utility cost.},
  howpublished = {Agentic Cyber Explorer},
  year = {2026},
  url = {https://agentic-cyber-explorer.pages.dev/findings/architectural-isolation-bounds-injection/},
  note = {Record architectural-isolation-bounds-injection; corpus as of 2026-09-26}
}

Data: JSON · CC BY 4.0

Know of evidence that changes this? Tell us.