Security benchmark

Stops 93.8% of injected attacks. Keeps 87% of the work going.

Hide instructions in an email, a doc or a web page and an agent may follow them. Proofable checks every tool call against what you allowed, so a fooled agent still cannot act on them.

All benchmarks

93.8%

Of AgentDojo attacks stopped. Without Proofable: 83.6%.

0/6

Data-theft attempts a hijacked agent got out

87%

Of tasks still finished under attack

Every system tested.

With Proofable93.8%
Injection filter*92.0%
Same agent, no defense83.6%

Share of 949 injected attacks stopped

System	Result	Run by	Source
With ProofableProofable, scored by AgentDojo	93.8%	Proofable, scored by AgentDojo	Every decision
Injection filter*ETH Zurich SPY Lab, on gpt-4o	92.0%	ETH Zurich SPY Lab, on gpt-4o	Published table
Same agent, no defenseProofable, scored by AgentDojo	83.6%	Proofable, scored by AgentDojo	Baseline run

* AgentDojo’s published prompt-injection detector on gpt-4o finished 21.1% of tasks under attack. Proofable held task completion at 87.0% on the same model as its 83.6% baseline.

Against the alternatives.

Injected attacks stopped
Proofable93.8%
Same agent, no defense83.6%
Injection filter*92.0%from 52.3% on its model
Tasks finished under attack
Proofable87.0%
Same agent, no defense88.1%
Injection filter*21.1%from 50.1% on its model
Tasks finished with no attack
Proofable94.9%
Same agent, no defense95.9%
Injection filter*41.2%from 69.1% on its model
Holds when the model is fooled
ProofableYesevery call checked
Same agent, no defenseNo
Injection filter*No, it screens text

Measure	Proofable	Same agent, no defense	Injection filter*
Injected attacks stopped	93.8%	83.6%	92.0%from 52.3% on its model
Tasks finished under attack	87.0%	88.1%	21.1%from 50.1% on its model
Tasks finished with no attack	94.9%	95.9%	41.2%from 69.1% on its model
Holds when the model is fooled	Yesevery call checked	No	No, it screens text

* AgentDojo’s published prompt-injection detector on gpt-4o, the closest public result for filters like Lakera and Llama Guard. Proofable ran on Gemma 4 31B across the same 949 attacked tasks. Rates depend on the model, so compare each column with its own baseline.

A hijacked agent got nothing out.

Theft attempts that got data out
With Proofable0 of 6
All-purpose API key6 of 6
DifferenceAll 6 stopped
Runs that used a tool outside the task
With Proofable0 of 42
All-purpose API key7 of 42
DifferenceNone

Measure	With Proofable	All-purpose API key	Difference
Theft attempts that got data out	0 of 6	6 of 6	All 6 stopped
Runs that used a tool outside the task	0 of 42	7 of 42	None

84 live runs across five published attacks and two AI models. Every run can be checked publicly.

Mapped to the OWASP Top 10 for Agentic Applications 2026.

Each risk, the control that answers it, and the test behind it. Not a certification.

ASI01
Agent Goal Hijack
Partial
Every tool call is checked against the owner’s permission, so a hijacked goal cannot act outside it
AgentDojo: injections that got through fell from 16.4% to 6.2%
ASI02
Tool Misuse and Exploitation
Evidence
Scoped permission per agent, checked before the tool runs
8 of 8 live permission tests; 0 of 6 data-theft attempts got out
ASI03
Identity and Privilege Abuse
Evidence
Each agent has an owner and its own permissions; revoked, expired and reused access is refused
5 of 5 out-of-permission, revoked, expired and reused cases stopped before they ran
ASI04
Agentic Supply Chain Vulnerabilities
Not covered
Not addressed by these tests
None published
ASI05
Unexpected Code Execution
Not covered
Not addressed by these tests
None published
ASI06
Memory and Context Poisoning
Partial
Memory knows who each fact belongs to and whether it is still current, so outdated and other people’s facts stay out
PrecisionMemBench 77 of 77
ASI07
Insecure Inter-Agent Communication
Evidence
Every handoff carries a tamper-proof receipt the next agent checks
150 of 150 forged records and 3 of 3 tampered handoffs caught
ASI08
Cascading Failures
Partial
One revoke stops the running job and refuses the next
Running job stopped 18 seconds after revoke
ASI09
Human-Agent Trust Exploitation
Partial
Actions that need a yes wait for one; a late yes is refused
2 of 2 approval cases held as set
ASI10
Rogue Agents
Evidence
Revoking access stops a running job, with the reason recorded
Revoked mid-job: stopped in 18 seconds, next dispatch refused

Control	What Proofable does	Tested result	Status
ASI01Agent Goal Hijack	Every tool call is checked against the owner’s permission, so a hijacked goal cannot act outside it	AgentDojo: injections that got through fell from 16.4% to 6.2%	Partial
ASI02Tool Misuse and Exploitation	Scoped permission per agent, checked before the tool runs	8 of 8 live permission tests; 0 of 6 data-theft attempts got out	Evidence
ASI03Identity and Privilege Abuse	Each agent has an owner and its own permissions; revoked, expired and reused access is refused	5 of 5 out-of-permission, revoked, expired and reused cases stopped before they ran	Evidence
ASI04Agentic Supply Chain Vulnerabilities	Not addressed by these tests	None published	Not covered
ASI05Unexpected Code Execution	Not addressed by these tests	None published	Not covered
ASI06Memory and Context Poisoning	Memory knows who each fact belongs to and whether it is still current, so outdated and other people’s facts stay out	PrecisionMemBench 77 of 77	Partial
ASI07Insecure Inter-Agent Communication	Every handoff carries a tamper-proof receipt the next agent checks	150 of 150 forged records and 3 of 3 tampered handoffs caught	Evidence
ASI08Cascading Failures	One revoke stops the running job and refuses the next	Running job stopped 18 seconds after revoke	Partial
ASI09Human-Agent Trust Exploitation	Actions that need a yes wait for one; a late yes is refused	2 of 2 approval cases held as set	Partial
ASI10Rogue Agents	Revoking access stops a running job, with the reason recorded	Revoked mid-job: stopped in 18 seconds, next dispatch refused	Evidence

The full mapping, and EU AI Act and NIST AI RMF

Check the results yourself.

Security and governance: 48/48, AgentDojo, 0/6 leaks, 150/150 forgeriesVerified

Questions

What is AgentDojo?

The open prompt-injection benchmark from ETH Zurich. It hides malicious instructions in the data an agent reads across email, Slack, banking and travel tasks, then counts how often the agent obeys them and how often it still finishes the real task.

Why not just add an injection filter?

Filters guess from text, so they block real work too. AgentDojo’s published detector cut attacks on gpt-4o but finished only 21% of tasks under attack. Proofable lets the agent read anything and stops the action instead, so 87% of tasks still finished.

Why do 6.2% still get through?

Those attacks use the exact tool the task needs, such as the send or the transfer it was asked to make. A permission cannot tell that call from the real one. Spend caps and approval for big actions cover that gap.

Verify this run yourself

Put the same checks on your agents.

Connect an agent. Every action it takes is checked against your rules and leaves a receipt you can show anyone.

Start free