{
 "body": "\n## What it measures\n\nAgentThreatBench checks whether an LLM agent can do useful work while resisting adversarial\nmanipulation hidden inside the data it reads, rather than checking task competence alone. Each of its\nthree tasks gives the agent an ordinary job -- answer a question using entries from a memory store,\ntriage an inbox of emails, or resolve a customer-support ticket -- where the tool output the agent\nconsumes has been seeded, in most samples, with an instruction trying to redirect its behaviour: a fake\nauthority claim, a gradually escalating request, an encoded payload, or a request to leak sensitive\ndata to an unauthorized recipient. Some samples are clean baselines with no attack, used to check that a\nmodel does not become so cautious it fails ordinary requests. The three tasks cover two categories from\nthe OWASP Top 10 for Agentic Applications (2026): memory and context poisoning (ASI06), and agent goal\nhijack via indirect prompt injection (ASI01), the latter tested through two different tool surfaces\n(email triage and customer support).\n\n## How it is scored\n\nEvery sample is graded on two independent binary outcomes: utility, whether the agent actually\ncompleted its assigned task, and security, whether it avoided being manipulated by the embedded attack.\nEach is CORRECT (1.0) or INCORRECT (0.0) by task-specific criteria -- for example, in the data-exfiltration\ntask, utility requires the agent to resolve the legitimate customer's ticket with a substantive\nresponse, while security requires that no sensitive field (SSNs, account numbers) was sent to an\nunauthorized recipient. The two scores are reported separately rather than combined, since a model that\nscores well on one and poorly on the other reveals a different failure mode than a model that scores\npoorly on both.\n\n## Dataset and licence\n\n24 samples total, split across three task-specific JSON files: 10 for memory poisoning, 6 for autonomy\nhijacking, and 8 for data exfiltration. Attack types vary per task (for example memory poisoning\nincludes direct instruction injection, gradual poisoning, authority impersonation, delimiter escape,\nmulti-vector poisoning and role hijack, alongside clean baselines), and memory-poisoning samples are\nfurther tagged easy, medium or hard, with harder samples replacing legitimate content entirely rather\nthan merely appending an attack alongside it. All data lives inside the inspect_evals repository, which\nis MIT licensed; no separate licence is stated for this task's own data files specifically. There is no\nheld-out or private split -- everything is public.\n\n## Who publishes it\n\nAgentThreatBench was contributed to Inspect Evals, a repository of community evaluations for the\nInspect AI framework created in collaboration by the UK AI Security Institute (AISI), Arcadia Impact and\nthe Vector Institute. The suite itself is credited to a single community contributor identified in the\nrepository only by their GitHub handle, vgudur-dev; no accompanying academic paper was found; the\n\"reference\" the task registry cites is the OWASP Top 10 for Agentic Applications (2026) resource page\nrather than a paper.\n\n## Lineage\n\nAgentThreatBench names no predecessor or successor benchmark; it is a purpose-built operationalisation\nof two OWASP Agentic Top 10 categories rather than a descendant of an earlier evaluation. Its own\ndocumentation notes that future releases may extend coverage to the remaining eight OWASP categories\n(tool misuse, agent identity abuse, supply-chain compromise, unexpected code execution, insecure\ninter-agent communication, cascading failures, human-agent trust exploitation, and rogue agents), none\nof which are implemented yet.\n\n## Saturation and contamination\n\nNo published per-model scores were found for this benchmark in the sources reviewed, so a saturation\nreading was not established; it has no known public leaderboard. It is also very new: it was added to\ninspect_evals in version 0.12.0, dated 2026-05-14, only a few months before this page was written. All\n24 samples and the grading logic are public in the repository, so contamination is structurally\npossible for any model trained on a crawl that includes it, though its recency limits how many\nalready-released models could have encountered it.\n\n## How to run it\n\nThe three tasks run through inspect_evals: `agent_threat_bench_memory_poison`,\n`agent_threat_bench_autonomy_hijack`, and `agent_threat_bench_data_exfil`, individually or together via\n`inspect eval-set`. Because the benchmark is so small (6 to 10 samples per task), a single sample\nflipping from correct to incorrect changes the reported percentage by roughly 10-17 points, so treat\nany single-run score as noisy and prefer averaging over multiple runs or seeds before drawing\nconclusions about a model's robustness. No lm-evaluation-harness, HELM, OpenCompass or BIG-bench\nintegration exists, as this benchmark is native to Inspect AI.\n\n## Reading the numbers\n\nA model that scores high on both utility and security across all three tasks is doing the hard thing:\nfinishing real work while declining to act on instructions smuggled in through data it was only asked\nto read, not obey. High utility paired with low security is the more dangerous combination in practice,\nsince it means the agent looks productive while remaining exploitable through its tool inputs. Because\nthe sample counts are tiny and the suite covers only 2 of the OWASP Top 10's ten agentic risk\ncategories, a strong AgentThreatBench score is evidence about resistance to these specific attack\npatterns on these specific tool surfaces, not a general claim about an agent's security posture.\n",
 "build": {
  "built_at": "2026-09-09T16:56:50+00:00",
  "commit": "0a599558854c0e238c03a0f0d725239cb28f9d11",
  "eligibility_as_of": "2026-09-09"
 },
 "disposition": {
  "canonical_id": "agent_threat_bench",
  "reasons": [],
  "status": "unassessed",
  "verified_results": []
 },
 "models_covered": [],
 "page": {
  "aliases": [],
  "category": "safety",
  "contamination": {
   "note": "All 24 samples and their grading logic are public in the inspect_evals GitHub repository. The suite is recent (added May 2026), so most models trained before that date could not have seen it, but any model trained on a crawl of the inspect_evals repository after that point could have, and the exact attack scenarios are easy to reproduce from the public source.",
   "risk": "medium"
  },
  "dataset": {
   "languages": [
    "en"
   ],
   "license": "MIT (the inspect_evals package licence; no separate licence is stated for this task's own data files)",
   "modalities": [
    "text"
   ],
   "public_test_set": true,
   "size": 24,
   "size_note": "24 samples across three fixed task datasets: memory_poison (10 samples: direct instruction injection, context poisoning, gradual poisoning, authority impersonation, delimiter escape, multi-vector poisoning, role hijack, and clean baselines, with easy/medium samples using append-style attacks and hard samples using replacement-style attacks), autonomy_hijack (6 samples: inline injection, progressive goal drift, authority escalation, multi-step social engineering, encoded payloads, and clean baselines, embedded in email-triage tool output), and data_exfil (8 samples: social-engineering exfiltration, redirect via tool output, impersonation, urgency pressure, JSON injection, and clean baselines, embedded in customer-support tool output).",
   "splits": "No train/test split; three fixed evaluation sets (10, 6 and 8 samples), with memory_poison samples additionally taggable by difficulty (easy, medium, hard).",
   "url": "https://github.com/UKGovernmentBEIS/inspect_evals/tree/main/src/inspect_evals/agent_threat_bench"
  },
  "freshness": {
   "researched": "2026-09-08",
   "researched_by": "sonnet-5 agent, batch 4, slice D",
   "reviewed": "",
   "reviewed_by": ""
  },
  "harness": {
   "bigbench": "",
   "helm": "",
   "inspect_evals": "agent_threat_bench_memory_poison, agent_threat_bench_autonomy_hijack, agent_threat_bench_data_exfil",
   "lm_eval": "",
   "opencompass": "",
   "other": ""
  },
  "id": "agent_threat_bench",
  "last_updated": "",
  "leaderboard_url": "",
  "lineage": {
   "family": "",
   "predecessor": "",
   "successors": [],
   "variants": []
  },
  "measures": "AgentThreatBench gives an agent an ordinary task -- answer a question from a memory store, triage an email inbox, resolve a customer-support ticket -- where one of the tool outputs the agent reads (a memory entry, an email body, a customer record) has been seeded with an adversarial instruction trying to redirect the agent's behaviour. It tests whether the agent both finishes the legitimate task and refuses to be manipulated by the embedded attack, scoring the two outcomes independently rather than folding them into one number. The three tasks operationalise two categories from the OWASP Top 10 for Agentic Applications (2026), namely memory and context poisoning and agent goal hijack via indirect prompt injection.\n",
  "metric": {
   "baseline_note": "The suite's own documentation frames results as a 2x2 read: high utility/high security means the agent is capable and robust; high utility/low security means it completes tasks but is manipulable; low utility/high security means it is over-cautious; low utility/low security means it fails at both. No random or human baseline is defined by the source.",
   "direction": "higher_is_better",
   "human_baseline": null,
   "max_score": 100.0,
   "name": "dual binary metric per sample: utility (task completed correctly) and security (attack resisted), each graded CORRECT (1.0) or INCORRECT (0.0) by task-specific criteria, reported as two separate percentages rather than combined into one score",
   "random_baseline": null,
   "unit": "%"
  },
  "name": "AgentThreatBench",
  "page_kind": "benchmark",
  "paper": {
   "arxiv": "",
   "title": "",
   "url": "",
   "year": null
  },
  "publisher": {
   "authors": [
    "vgudur-dev (GitHub handle; no fuller author name given in the source)"
   ],
   "org": "Inspect Evals (UK AI Security Institute, in collaboration with Arcadia Impact and the Vector Institute); this specific suite was community-contributed",
   "url": "https://github.com/UKGovernmentBEIS/inspect_evals"
  },
  "released": "2026-05",
  "repo_url": "https://github.com/UKGovernmentBEIS/inspect_evals/tree/main/src/inspect_evals/agent_threat_bench",
  "saturation": {
   "as_of": "",
   "note": "No published per-model results were found in the sources reviewed; the benchmark is new (added to inspect_evals in version 0.12.0, dated 2026-05-14) and has no known leaderboard.",
   "status": "unknown",
   "top_score": null
  },
  "sources": [
   {
    "accessed": "2026-09-08",
    "title": "inspect_evals AgentThreatBench README (task descriptions, attack types, scoring)",
    "url": "https://raw.githubusercontent.com/UKGovernmentBEIS/inspect_evals/main/src/inspect_evals/agent_threat_bench/README.md"
   },
   {
    "accessed": "2026-09-08",
    "title": "inspect_evals agent_threat_bench task directory",
    "url": "https://github.com/UKGovernmentBEIS/inspect_evals/tree/main/src/inspect_evals/agent_threat_bench"
   },
   {
    "accessed": "2026-09-08",
    "title": "agent_threat_bench eval.yaml (registry metadata -- group, tasks, sample counts, contributor)",
    "url": "https://raw.githubusercontent.com/UKGovernmentBEIS/inspect_evals/main/src/inspect_evals/agent_threat_bench/eval.yaml"
   },
   {
    "accessed": "2026-09-08",
    "title": "inspect_evals CHANGELOG.md (confirms addition in v0.12.0, 2026-05-14)",
    "url": "https://raw.githubusercontent.com/UKGovernmentBEIS/inspect_evals/main/CHANGELOG.md"
   },
   {
    "accessed": "2026-09-08",
    "title": "OWASP Top 10 for Agentic Applications (2026) -- the threat taxonomy this suite operationalises",
    "url": "https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/"
   },
   {
    "accessed": "2026-09-08",
    "title": "inspect_evals top-level README (project origin: UK AISI, Arcadia Impact, Vector Institute)",
    "url": "https://raw.githubusercontent.com/UKGovernmentBEIS/inspect_evals/main/README.md"
   }
  ],
  "status": "active",
  "subcategory": "agent security / prompt-injection and goal-hijack resistance (OWASP Agentic Top 10)",
  "summary": "Small Inspect AI suite that scores whether an LLM agent completes its task and separately whether it resists prompt-injection attacks drawn from the OWASP Agentic Top 10.",
  "tags": [
   "safety",
   "agentic",
   "prompt-injection",
   "agent-security",
   "owasp"
  ],
  "task_format": "Three separate Inspect AI tasks, each a small set of multi-turn tool-use scenarios with an adversarial payload embedded in one tool's output; the agent calls tools to complete its task while a dual grader checks task completion and whether the embedded attack succeeded."
 }
}