Post
2676
How often can an email make your AI agent move money?
We gave the agent one job: log an incoming email. But the emails carried an indirect prompt injection - a second instruction, written for the agent rather than for a person: make a payment.
Across nine agentic models, the same injected emails produced payment orders in **0% to 42%** of cases. All nine ran under the same conditions - one agent, one set of tools, the same 395 emails - so the numbers compare directly.
And the average score hides the interesting part: different models fail on different kinds of injections.
Full experiment and results:
https://huggingface.co/blog/mihailgribov/agentic-models-measured-on-the-injections-that-mov
The bench is public too - run your own model through the same test:
https://github.com/mihail-gribov/quadrat-ipi-model-eval
mihailgribov/quadrat-ipi
#prompt-injection #indirect-prompt-injection #agentic-ai #llm-security #ai-agents
We gave the agent one job: log an incoming email. But the emails carried an indirect prompt injection - a second instruction, written for the agent rather than for a person: make a payment.
Across nine agentic models, the same injected emails produced payment orders in **0% to 42%** of cases. All nine ran under the same conditions - one agent, one set of tools, the same 395 emails - so the numbers compare directly.
And the average score hides the interesting part: different models fail on different kinds of injections.
Full experiment and results:
https://huggingface.co/blog/mihailgribov/agentic-models-measured-on-the-injections-that-mov
The bench is public too - run your own model through the same test:
https://github.com/mihail-gribov/quadrat-ipi-model-eval
mihailgribov/quadrat-ipi
#prompt-injection #indirect-prompt-injection #agentic-ai #llm-security #ai-agents