Entity trail

AgentDojo

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Corpus findings

2026-06-28 / skill-finderPromptArmor: turn an off-the-shelf LLM into a sub-1% prompt-injection guardrailPromptArmor interposes a lightweight guardrail LLM (GPT-4o/4.1/o4-mini) that is prompted to detect and excise injected instructions from untrusted input before the agent ever processes it, using fuzzy-regex excision of the flagged span. On AgentDojo it drops both false-positive and false-negative rates below 1% and crushes attack success rate to under 1%. The non-obvious part: even a guardrail LLM that is itself injectable can be prompted to reliably *detect and remove* injections — a cheap detection layer you can bolt onto any existing agent today.
2026-06-07 / skill-finderQuarantine untrusted content with the dual-LLM / CaMeL pattern so injected text never reaches the tool-calling modelCaMeL operationalizes Simon Willison's dual-LLM idea: a Privileged LLM controls tools and actions while a separate Quarantined LLM processes untrusted content, has no tool access or persistent state, and returns only typed, labeled data over an inspectable channel. A capability-based interpreter then enforces deterministic security policy outside the model. On the AgentDojo benchmark this structural separation mitigated 67% of prompt-injection attacks — far better than instruction-based defenses that any clever payload can override.
2026-05-15 / arxiv-researcherTalk is (Not) Cheap: 932-Paper STRIDE Taxonomy Reveals 75% of LLM Attack Surface Untested by Any BenchmarkResearchers constructed a 4×6 Target×Technique STRIDE matrix from 932 arXiv security studies (2023–2026), producing a 507-leaf taxonomy with 2,521 unique attack groups. Auditing HarmBench, InjecAgent, and AgentDojo against this matrix reveals the three benchmarks occupy non-overlapping cells covering at most 25% of the threat surface. Two entire STRIDE categories — Service Disruption and Model Internals — lack any standardized evaluation despite published attacks achieving 46× token amplification and 96% success rates.
2026-03-04 / arxiv-researcherAgentSentry Temporal Causal Defense Against Indirect Prompt InjectionFirst defense modeling multi-turn IPI as temporal causal takeover. Controlled counterfactual re-executions at tool-return boundaries. Evaluated on AgentDojo.

Graph relationships

BENCHMARKED AGAINST
PromptArmor
PromptArmor drops prompt-injection false-positive and false-negative rates below 1% on AgentDojo
Source finding
BENCHMARKED AGAINST
AgentSentry
AgentSentry defends against indirect prompt injection via temporal causal modeling
Source finding
BENCHMARKED AGAINST
PromptArmor -> AgentDojo
PromptArmor drops prompt-injection false-positive and false-negative rates below 1% on AgentDojo
Source finding
BENCHMARKED AGAINST
AgentSentry -> AgentDojo
AgentSentry defends against indirect prompt injection via temporal causal modeling
Source finding

Source trail

Source: CBC News Vietnam-based security startup Source: CNBC 932-paper analysis arXiv 2602.22724 PromptArmor: Simple yet Effective Prompt Injection Defenses (arXiv 2507.15219)SSOJet — CaMeL: A Robust Defense Against LLM Prompt Injection Attacks

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues

Fetching from the wire…