Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper introduces AGENTREDBENCH, a comprehensive benchmark designed to evaluate the vulnerability of LLM agents to indirect prompt injection attacks across 24 enterprise integrations. The benchmark reveals that existing models have a high attack success rate, ranging from 32% to 81%, highlighting the inadequacy of current defenses. The authors also present AGENTREDGUARD, a robust defense mechanism that significantly reduces the attack success rate from 69.9% to 2.4% while maintaining a low false-positive rate of 0.37%, demonstrating its effectiveness against adversarial tool-response content.
Attack success rates for LLM agents can soar as high as 81%, but AGENTREDGUARD slashes that risk to just 2.4% with a mere 0.37% false-positive rate.
Indirect prompt injection in tool-use agents is a concrete production threat: LLM agents read from integrations (third-party services such as Gmail, Salesforce, or Jira accessed through tool calls) whose response content the user neither writes nor controls. Existing benchmarks under-measure the threat: most cover only a handful of integrations with the same attack payload replayed across runs, and open-source guards are trained on chat-style data rather than tool-response content. We introduce AGENTREDBENCH, a dynamic LLM-driven redteaming benchmark of 215 subtle underspecified authorization (attacks at the boundary of what the user's request authorises) scenarios across 24 enterprise integrations in nine functional families and five attack types. Across an eight-model panel (Anthropic, OpenAI, Google), no-guard ASR (attack success rate) ranges from 32% (Claude Sonnet 4.6) to 81% (Gemini 3 Flash). To keep the scenario set out of training corpora and preserve headline ASR meaning over time, we release the codebase, integration schemas, and AGENTREDGUARD model openly; the canonical scenarios are evaluated through a maintainer-mediated channel with immutable versioning. We release AGENTREDGUARD alongside the benchmark: a guard trained on an integration-diverse corpus of adversarial tool-response content. AGENTREDGUARD cuts panel ASR from 69.9% to 2.4% at 0.37% false-positive rate, outperforming every open-source baseline with non-trivial detection (Llama Guard, PromptGuard 2, ProtectAI) on both axes. Cross-integration and cross-attack type holdouts both confirm the gain transfers beyond the training subset.