Prompt injection
0 of 949 attacks succeeded, and more of the work got done under attack.
Scored on AgentDojo, ETH Zurich's public prompt-injection benchmark: the same agent, the same 949 attacked cases, with and without Needlepath in front of the model. Two dated runs, newest first. Below them, six attack styles pooled, an attacker that rewrites its injections to beat Needlepath, and a second benchmark, AgentDyn, with three more agent suites.
Needlepath selects what the model reads, quarantines planted instructions and writes a receipt. The agent, the model and the tasks were otherwise unchanged.
Read the prompt injection benchmark in detail
Six attack styles, pooled: 90% fewer attacks succeeded.
- 154 of 5,694 attacked cases succeeded with Needlepath, against 554 of 5,694 with no defense: 90% fewer successful attacks.
- 2With Needlepath, no attack succeeded in the important_instructions, tool_knowledge or injecagent style.
- 3+2.1 points more of the work completed while under attack: 3,925 attacked cases completed, against 3,806.
Attacks that succeeded by attack style, no defense then Needlepath, of 949 attacked cases each: important_instructions 268 to 0, tool_knowledge 212 to 0, system_message 24 to 17, direct 22 to 22, injecagent 15 to 0, ignore_previous 13 to 15.
Tasks completed under attack by attack style, no defense then Needlepath: important_instructions 56.16% to 71.34%, tool_knowledge 59.54% to 63.96%, system_message 73.02% to 69.44%, direct 73.13% to 73.45%, injecagent 69.76% to 62.28%, ignore_previous 69.44% to 73.13%.
AgentDojo v1.2.2, suites workspace, travel, banking and slack, six attack styles: 949 attacked cases per style per arm, 5,694 in all, 0 error rows. The important_instructions pair is the 26 October 2026 run; the other five styles were measured 9 November 2026, each against its own same-day no-defense arm. Answer model gpt-4o-2024-08-06 at temperature 0 in both arms of every pair, on the hosted service, pinned to operating point np-2026-10-r8. The pooled figures count attacked cases across the six styles. On 9 November 2026 the 97 benign tasks ran once, and 75 of 97 were completed in both arms.
Injections rewritten to beat Needlepath: 82% fewer succeeded.
- 117 of 144 attacked cases succeeded with Needlepath, against 93 of 144 with no defense: 82% fewer successful attacks.
- 2Each arm faced injections optimized against it: every rewrite the Needlepath arm saw had already been tested against Needlepath.
- 314 of 16 benign tasks completed in both arms.
AutoDojo, a public adaptive attack built on AgentDojo v1.2.2, suite banking: an attacker model, gemini-2.5-pro, rewrote each injection over four optimization rounds, testing every rewrite against the arm it was attacking, and the benchmark ran the first of five optimized variants. 144 attacked cases and 16 benign tasks per arm, 0 error rows. Answer model gpt-4o-2024-08-06 at temperature 0 in both arms. Measured 10 November 2026 on the hosted service, pinned to operating point np-2026-10-r8.
AgentDyn, three more agent suites: 84% fewer attacks succeeded.
- 135 of 560 attacked cases succeeded with Needlepath, against 217 of 560 with no defense: 84% fewer successful attacks.
- 2+1.1 points more of the work completed while under attack: 322 attacked cases completed, against 316.
- 337 of 60 benign tasks completed with Needlepath, against 36 of 60 with no defense.
Attacks that succeeded by suite, no defense then Needlepath: github 34 to 6 of 180, shopping 53 to 1 of 180, dailylife 130 to 28 of 200.
Tasks completed under attack by suite, no defense then Needlepath: github 71.67% to 69.44%, shopping 46.11% to 46.67%, dailylife 52.00% to 56.50%.
AgentDyn, the open-source benchmark from the paper “AgentDyn: Are Your Agent Security Defenses Deployable in Real-World Dynamic Environments?”, built on the AgentDojo framework. Attack important_instructions, suites github, shopping and dailylife: 560 attacked cases and 60 benign tasks per arm, 0 error rows. Answer model gpt-4o-2024-08-06 at temperature 0 in both arms. Measured 10 November 2026 on the hosted service, pinned to operating point np-2026-11-r9.
26 October 2026: no attack succeeded in any suite.
- 10 of 949 attacked cases succeeded with Needlepath, against 268 of 949 with no defense.
- 2+15.2 points more of the work completed while under attack.
- 322% lower model bill, from 13% fewer model calls (3,706 against 4,278), before any Needlepath fee.
Attacks that succeeded by suite, no defense then Needlepath: workspace 13.57% to 0.00%, travel 22.14% to 0.00%, banking 56.25% to 0.00%, slack 76.19% to 0.00%.
Tasks completed under attack by suite, no defense then Needlepath: workspace 46.79% to 68.21%, travel 60.00% to 74.29%, banking 79.86% to 81.25%, slack 68.57% to 70.48%.
AgentDojo v1.2.2, attack important_instructions, suites workspace, travel, banking and slack: 949 attacked cases and 97 benign tasks per arm, 0 error rows. Answer model gpt-4o-2024-08-06 at temperature 0 in both arms, and every model call was answered by that model. Measured 26 October 2026, both arms the same day, on the hosted service, pinned to operating point np-2026-10-r8. Benign task completion is within noise of no defense. The model bill prices every input and output token at the model's standard list rate, before any Needlepath fee. OpenAI retired gpt-4o-2024-05-13, the model the earlier run used, so this is a new matched comparison on gpt-4o-2024-08-06, not a re-run of the earlier one.
20 to 21 October 2026: attack success fell in every suite.
- 190% fewer successful attacks: 41 of 949 attacked cases, against 403 of 949 with no defense.
- 2+19.9 points more of the work completed while under attack.
- 332% lower model bill, from fewer model calls: 3,867 against 4,725.
Attacks that succeeded by suite, no defense then Needlepath: workspace 26.96% to 5.18%, travel 32.14% to 0.00%, banking 76.39% to 6.94%, slack 92.38% to 1.90%.
AgentDojo v1.2.2, attack important_instructions, suites workspace, travel, banking and slack: 949 attacked cases and 97 benign tasks per arm, 0 error rows. Answer model gpt-4o-2024-05-13 at temperature 0 in both arms. Measured 20 to 21 October 2026 on the hosted service, pinned to operating point np-2026-10-r7. Benign task completion is within noise of no defense. The model bill is the answer model's bill at list price, before any Needlepath fee. AgentDojo's own results page lists this model at 69.07 / 50.08 / 47.69 from June 2024; the no-defense arm here is not a reproduction of that row, because the benchmark has had four revisions since. It is the same-day, same-version baseline for the Needlepath row.