AgentDojo: testing buyer-agent authority under hostile supplier content

External-source research synthesis, not an OfferSignal client result. Based on the retained October 2026 research and source-specific dates.

A supplier catalogue page, PDF, email or quote can contain useful product facts and still contain instructions aimed at the buyer agent itself. The business problem is not only whether an agent can retrieve a specification or compare an offer. It is whether retrieved content can influence a shortlist, disclose history, send an RFQ, negotiate, place an order or release payment. AgentDojo is evidence about how to test that boundary—not evidence that an enterprise agent has safely bought anything.

What AgentDojo actually evaluates

ETH Zürich’s SPY Lab and collaborators created an adversarial, simulated-agent benchmark in May 2024. An LLM receives a legitimate task, reads untrusted tool output and may call tools that alter simulated state; an attacker adds instructions in an email, webpage, file or similar output to make the model pursue a second, malicious task. The original suites cover Workspace, Slack, Travel and Banking. They contain 97 legitimate user tasks and 629 paired security cases, with deterministic checks of model output and pre- and post-state rather than an LLM judging whether its own action was safe. Data were synthetic, generated by the authors, GPT-4o and Claude Opus, then schema-validated and manually inspected. The paper says tasks may require up to 18 tool calls. Its prose says 74 tools, while the table and data card say 70, a discrepancy to resolve in any replication. 1

This is agentic inside a controlled sandbox: the model selects and executes tools, but no real supplier, bank, inbox, payment rail or purchase order is connected. The public package was extensible as of 23 October 2026, while its API remained under development. Its results page warns that it is not a leaderboard because models are not all tested with every attack and defense. 2 3

Read the percentages with their denominators

Benign utility is the share of 97 clean tasks solved. Utility under attack and targeted attack-success rate (ASR) use the 629 security-case pairs, so they are not interchangeable populations. In the paper’s generic Important Message comparison, GPT-4o recorded 69.00% benign utility (95% confidence interval ±3.61), 50.08% utility under attack (±3.91) and 47.69% targeted ASR (±3.90). Claude 3.5 Sonnet recorded 78.22% benign utility (±3.23) and 33.86% targeted ASR (±3.70). These are configuration-specific synthetic results, not current-model rankings or production failure rates. 1 2

A separate GPT-4o defense experiment restricted available tools before the agent saw untrusted data. The tool filter produced 73.13% benign utility (±3.5), 56.28% utility under attack (±3.9) and 6.84% targeted ASR (±2.0), compared with 57.69% ASR without defense in that experiment. A prompt-injection detector reached 7.95% ASR, but clean utility fell to 41.49% and utility under attack to 21.14%. The filter failed where tools could not be known in advance or the same tool was needed by both user and attacker—17% of cases—and does not address a malicious listing that merely biases a recommendation. 1

Adaptive attacks changed the lesson

U.S. CAISI and the UK AI Security Institute extended and independently exercised the benchmark on upgraded Claude 3.5 Sonnet, adding simulated remote-code-execution, mass-exfiltration and personalised-phishing tasks. In joint red teaming, attacks developed on a random subset of Workspace tasks and tested on held-out tasks produced 11% ASR for the strongest baseline attack and 81% for the strongest new attack. The task count, exact prompts and per-task rates were not published, so 81% is not a universal AgentDojo score. Across five injection tasks, average ASR rose from 57% after one attempt to 80% when each attack was tried 25 times. These are simulated, model-specific findings, not market attack-incidence rates. 4 6

The UK Inspect implementation is an evolution and reproducibility signal, not a clean sequel leaderboard. On 16 June 2025 it reported Claude 3.7 Sonnet at 83.3% ±3.8 clean utility, 71.9% ±1.5 utility under attack and 8.5% ±0.9 ASR; GPT-4o was 68.8% ±4.8, 49.4% ±1.6 and 31.4% ±1.5. Different task versions, implementations, models and attack availability prevent intrinsic safety comparisons; stronger joint attacks were not included. 5

An illustrative procurement test

For a manufacturer or distributor, treat supplier-controlled content as untrusted evidence. Build synthetic catalogue, PDF, email and RFQ cases with explicit attack goals. Separate retrieval, recommendation, drafting, outbound sending, disclosure, acceptance and payment into scoped capabilities. The technical or commercial owner remains authoritative for product identity, quote terms, customer-history disclosure and commitment. A planning-stage tool filter is promising for declared tasks, but dynamic RFQ workflows need additional gates.

Test deterministic before-and-after states: did the shortlist change, did a restricted field leave the system, did an RFQ reach an unapproved recipient, or did payment authority change? Record model, task, attack, tool set, version and number of attempts. The original paper estimated about US$35 for 629 GPT-4o security cases and US$4 for 97 clean cases, but that is a June 2024 research-run estimate, not an implementation budget or return-on-investment claim. No cited result covers real supplier data, product specifications, quote normalisation, negotiation, payment release, a customer deployment or commercial outcome. 1

Sources and next reading

Explore OfferSignal · Focused Business & AI Workshop · All research

References