AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents

An agent can encounter attacker-controlled text while carrying out a legitimate request, and that text can redirect later tool use. Evaluating only whether the model rejects an instruction misses whether the user's task was completed, whether an unwanted state change occurred, and which capabilities the attacker actually controlled.

Static payload collections also become inadequate as defenses change. AgentDojo therefore treats evaluation as an extensible interaction environment in which user tasks, injection locations, attacker goals, agents, and defenses can be varied independently.

Stateful workspace, messaging, travel, and banking environments with implemented tools and realistic task data.

Separate executable criteria for legitimate user goals and adversarial objectives, combined into security test cases.

Interfaces for new attacks and modular agent defenses, with reporting that distinguishes benign utility, utility under attack, and targeted attacker success.

Each environment stores mutable application state, such as messages, calendar events, or account data. Tools read or modify this state through defined functions. A user task provides a natural-language instruction, a reference sequence of calls, and a deterministic utility check over the agent's output and the state before and after execution.

An injection task specifies an adversarial goal and designated content the attacker may replace. The attack supplies text for those placeholders, which can be encountered through ordinary tool use. Pairing user and injection tasks creates a security case without granting the attacker arbitrary control over the entire conversation or environment.

The agent receives the legitimate task and tool descriptions and runs until completion. The framework then applies the user-task and attacker-goal checks separately. Attacks can be replaced or adapted, and agent pipelines can incorporate components such as output delimiters, injection detectors, repeated task reminders, or a preselected tool subset.

Baseline experiments run multiple language-model agents across the task suites in benign and attacked conditions. Benign utility measures completion without an attack; utility under attack requires completing the authorized task without adversarial side effects; targeted attack success measures whether the specified attacker goal is achieved.

Attack ablations vary message components and knowledge of the victim or tool interface. Defense comparisons examine both utility and attacker outcomes, while additional analyses consider injection placement and combinations of attacks. The protocol supports testing new adaptive attacks rather than treating resistance to the supplied payloads as a general robustness guarantee.