Verification · Reproducible evidence

Benchmarks — tested honestly, including the misses

We publish our full test suite and its results — passing and failing — because a security tool that hides its misses isn't trustworthy. These are measured on a fixed 200-attempt suite run through the actual enforcement engine, not a cherry-picked demo.

Headline result

200 attempts · 193 blocked · 96.5% block rate. The 7 misses are documented below with payloads so you can reproduce and assess them yourself.

Attack category	Attempts	Blocked	Block rate
Direct injection	50	48	96%
Obfuscated / encoded	50	47	94%
Multi-turn / split	50	48	96%
Tool-call hijack	50	50	100%
Total	200	193	96.5%

The threshold used is a risk score at or above 45 (high severity), matching the runtime's default. Run it yourself with the same secret the runtime uses.

Reproduce it yourself

Everything is in the public repo:

Benchmark script: scripts/benchmark_injection.py — runs all 200 payloads through score_content.
116 passing unit tests — the full enforcement engine is covered, including threat-expansion smoke tests and the code-change review gate.
~2.7k LOC core — small enough to audit in full.

View the benchmark script Download and run it yourself

python scripts/benchmark_injection.py --threshold 45

Expanded threat coverage

The community threat list now ships 45 signals + 8 compact patterns (up from 25 + 2), covering jailbreak framing, indirect injection, markdown/XML-tag injection, tool abuse, memory poisoning, SSRF, credential harvesting, session hijack, and more. New obfuscation decoders catch HTML-entity and unicode-escape hiding. The paid threat feed extends this further and refreshes weekly.

116 passing tests — including 32 threat-expansion smoke tests that verify each new signal fires, benign text doesn't false-positive, and the benchmark block rate doesn't regress.

Code-change review gate (optional)

AgentInterdict now includes an optional code-change review gate: scan an AI-generated code diff with the same engine and record a signed, tamper-evident evidence verdict. It governs the code your agent writes, not just what it reads — without changing any existing enforcement behavior.

POST /api/v1/code-change
{ "diff": "+api_key = 'sk-...'", "repo": "myapp", "branch": "main" }

The 7 documented misses (transparency is a feature)

These are the attacks that got through. We publish them because hiding them would defeat the purpose of a benchmark. Each represents a known gap, and the payloads are public so researchers can assess the real risk.

Known miss classes

Highly obfuscated multi-encoding — payloads using layered obfuscation that the pattern layer doesn't decompose.
Non-instruction-shaped injection — attacks phrased as data that don't trip instruction/authority signals.
Novel authority-spoof framing — content that convincingly imitates a trusted system prompt without matching a known pattern.

Honest scope: AgentInterdict reduces and contains prompt-injection risk. It does not make injection impossible and is not a substitute for host permissions, least-trust, sandboxing, or independent human approval for high-impact actions.

If you find a miss we haven't documented, please report it responsibly — that's how the benchmark gets better.

What we will never claim

No "99.9% block rate" with no reproducible evidence.
No model-level safety guarantee — AgentInterdict is a runtime-boundary enforcer, not a change to model weights.
No claim that prompt injection is "solved." It isn't, by anyone.

Put our claims to the test in the Attack Lab Read the technical research

Open source. Independently built. Publicly benchmarked.