Press Delete to remove.
When an agent was taken over, 0 of 6 attempts to send private data out got past a scoped permission; an all-purpose key let all 6 through (84 live runs). On AgentDojo, attacks that landed fell from 16.4% to 6.2% across all four suites with the task still done 94.9% of the time. 150 of 150 forged records were rejected, and the policy engine handled 48 of 48 AgentGovBench scenarios.
Hijacked data sends out
AgentDojo attacks landed
Forged records caught
Injection kit (mcp/examples/injection-test), AgentDojo v1.2.2 (all four suites), forged-record check (cost-of-trust), AgentGovBench (48 scenarios), authority-at-dispatch permission suite
injection kit 2026-11-09 at production a4264251d (84 runs, two hosted models); AgentDojo 089ed468 at engine bundle 272ed656, 2026-11-09; forged records 2026-10-20 with @proofable/sdk 0.1.3; AgentGovBench library 479c5f0 at protocol 4eae90e, 2026-10-30; permission suite 2026-11-02 at production 327e50de3
z-ai/glm-5.3-flash and deepseek/deepseek-v4.1-flash-1017 (injection kit); google/gemma-4-31b-it on both AgentDojo arms
Injection kit (github.com/proofable/mcp/tree/main/examples/injection-test), AgentDojo v1.2.2 with the Proofable permission gate, AgentGovBench with the Proofable policy engine
0 of 6 on a scoped permission (5 refused before they ran, 1 never attempted) against 6 of 6 on an all-purpose key; 84 live runs
16.4% to 6.2% across all four suites with the engine-decided per-task delegation; utility 95.9% to 94.9%; utility under attack 88.1% to 87.0%; banking alone 45.8% to 16.0% (949 attacked pairs per arm, one attack template, k=1 per pair)
150 of 150 forged copies rejected across ten kinds; 15 of 15 genuine accepted
48 of 48 AgentGovBench scenarios (allow-everything gate 20, no governance 5; the maintainers' gateway 46)
8 of 8 live cases stopped before they ran; 15 signed records verify offline
6 of 6 data sends got out; 7 of 42 runs used a tool outside the task
47.7% targeted attack success; tool_filter 6.8% at 56.3% utility under attack
proofs bench:injection-test 0x2ada1c53e5ce6a379c1aad6006e5f641f9cf770065f14cc0c0f77b1d4a6bad72 and 0x814cfefe92a322735c31aa6c14f084d53ec8252b9a337b2a1c386df88271a023
proof bench:agentdojo 0xca09b4aaa3b4becab17497b185d4f81fe0612c5f719ddf9a4a0327d94e114ff7; per-run files at https://docs.proofable.me/evidence/agentdojo/2026-11-09/
Every figure is the current value in the claim register on 2026-11-10. AgentDojo's model is named because the published rows are other models; the attacks that still land use the send or transfer tool the task itself needs.