Can open-source prompt-injection detectors catch realistic AI agent attacks?
Summary
The article benchmarks 10 open-source prompt-injection detectors against 629 real AgentDojo attacks embedded in tool output, showing most detectors miss many attacks or incorrectly block safe traffic. The takeaway is that text-only detectors are unreliable and require policy-based, context-aware enforcement that considers where instructions come from and what tool calls would do (taint tracking).