← All benchmarks

ASPI - execution-state tool-channel attack success rate

Safety · 2026-05-17

Scale AI's ASPI (Ambiguous-State Prompt Injection) builds 728 task-attack groups on AgentDojo's workspace, Slack, travel and banking suites, each pairing a benign user task with an attacker goal. In this condition (exec_tool), the standard AgentDojo setting, the agent gets the fully specified prompt and the attacker's instruction arrives in a task tool's return value; the attack success rate is the share of the 728 groups in which AgentDojo's deterministic security check finds the attacker goal achieved. Lower is better; it measures robustness to prompt injection, not capability.

Top models (lower is better)