Skip to main content
Every number on this page is measured and reproducible. It is here because a detection rate quoted without its limits is not evidence — and because the control we would actually stake an agent’s safety on is Capability Containment, not the classifier.

​
The measured numbers

Across 2,369 benchmark samples from eight datasets, at the moderate preset with the injection threshold at 0.8: Precision and recall move against each other as the threshold moves, so neither means anything without the operating point. Full dataset breakdown and confidence intervals are in the benchmark write-up.
That benchmark measures a static attacker. It is a fair measurement of a fixed corpus and not a claim of robustness against someone adapting to the detector.

​
The ceiling, and why more detectors will not lift it

Nasr et al., The Attacker Moves Second (USENIX Security 2026), ran tuned search-based attacks against twelve published defences and bypassed all of them at over 90% attack success. Most had first reported near-zero attack success on static benchmarks. The paper states plainly that stacking more detectors does not fix this. The structural reason is where the input comes from. A detector reads the tool output or the retrieved document — content the attacker controls. Its accuracy is an empirical property, so an attacker who can iterate eventually finds the gap. No amount of detector quality changes that. Our own measurements agree: The fine-tune result is the instructive one. It beat everything in-domain and collapsed on an independent corpus — which is what overfitting to your own attack distribution looks like, and why we do not ship it.

​
What does not depend on detection accuracy

Three controls answer a different question — was the agent ever authorised to do this? — and their security argument does not rest on classifying an attack correctly.

Capability Containment

Derives an envelope from the user’s objective — trusted input the attacker does not control — and refuses anything outside it, fail-closed.

Rule of Two

Reads the toolset, not the prose. An agent holding untrusted input, private data and a way to act needs a human in the loop, whatever the classifier says.

Human approval

On the consequential step. The only control with no false-negative rate.
Containment is worth nothing if the attacker can write the objective. If your user_objective is lifted from an inbound email or a ticket body, the argument collapses entirely — see the precondition on the containment page.
Measured caveat, added 2026-08-18. On AgentDojo’s banking suite — a benchmark built for exactly this multi-step agentic attack — the trace-level and containment defences showed no measurable reduction in attack success: 47.2% and 43.1% against 46.5% undefended, over 144 cases (p = 1.00 and p = 0.64). The per-message guard did work on the same benchmark, taking 46.5% to 0.7%, at a cost of roughly 30% of task completion.We do not yet know why the trace-level controls did not engage, and we are not going to guess: an initial explanation (AgentDojo’s tools carried no untrusted-source label) turned out to be a real bug that changed nothing when fixed. Until that is understood, treat containment’s argument as structurally sound but not independently confirmed on an agentic benchmark, and prefer gating the consequential action.

​
How to read our claims

  • Detection reduces risk measurably; it does not eliminate a class of attack.
  • Any figure we publish names its dataset, sample count and interval — including the ones that do not flatter us. Ask the same of anyone quoting you a detection rate.
  • Where a control has a residual failure rate, we publish the residual. gemini-2.5-pro still complies with 13.6% of adaptive attacks with marking active, so a Gemini agent doing consequential work should gate the action rather than rely on marking.
If you are designing an agent and want one recommendation: put the trust boundary at the action, not at the text. Everything on this page is defence in depth behind it.