Ajar scores the unused access AI defenses leave open

A paper posted to arXiv names Claude Code's Auto mode as one of five defenses tested against a new benchmark called Ajar, which measures something AgentDojo and similar tests skip entirely: unused access. Most prompt-injection benchmarks ask whether an attack worked. The Ajar paper argues a defense can pass that test and still leave an agent free to read, delete, or transfer things the task never asked for.

Ajar builds its temptations from material that already exists. It takes a benchmark's own tasks and reference solutions, generates extra tool calls the task doesn't need, then offers them to the agent at each step. If the agent takes one, that's access the defense left open, no attacker required.

The authors ran it against five defenses, including Progent, CaMeL, and AC4A alongside Claude Code's Auto mode. How much unnecessary access each one permitted varied widely. The abstract doesn't rank the five by name, so which defense held tightest isn't stated here, only that the spread was wide.

A team can point to a strong AgentDojo attack-success score while running a system that hands out reads and writes nobody asked for. Ajar runs on top of benchmarks teams already have, pulling extra tool-call temptations from tasks that already exist rather than adding a new dataset. That makes least privilege something a team can check with a number, not just claim in a design doc.