How to Evaluate Prompt Injection Defenses in Agent Safety Tools

Quick answer

For a repeatable comparison, use the same suite, user tasks, model, attack, and defense configuration for every candidate. Record the exact command and AgentDojo version with each result, then compare those records before drawing conclusions.

Start by installing AgentDojo with pip install agentdojo. Use the benchmark script’s --help output to inspect the available options, then prepare the documented workspace suite run with your selected tasks and settings.

Confirm separately that you can access the model you choose and have configured any provider credentials it requires. The model identifier in an example does not guarantee that you have access, and the package API may change.

Keep the scope of the result in view: the documented quickstart does not specify built-in false-positive or latency reporting. Don’t infer those measures from benchmark results; evaluate them separately if they are part of your purchasing decision.

Step-by-step guide

Prepare a model-accessible evaluation environment

Before installing AgentDojo, decide which model and provider access you plan to use. Confirm that the model is available to you and arrange any provider credentials it requires; the quickstart’s example model identifier does not guarantee access, and the documentation says credentials may need separate configuration.

Make sure your evaluation environment can run the documented installation command, pip install agentdojo. You can install the package in the next step, once model access is ready.

You do not need to settle every benchmark option here. Choose the suite, user tasks, model, defense, and attack when you prepare the run, then keep those settings consistent when comparing candidates.

Sources: AgentDojo: Quickstart and benchmark FAQ.

Install AgentDojo

With model access and any required provider credentials arranged, install AgentDojo in the Python environment you plan to use for the evaluation. Open a terminal for that environment and run:

pip install agentdojo

Wait for the command to finish, then review its output for an installation-success message before continuing. This gives you the documented package installation; it does not by itself confirm that your chosen model or provider credentials are working, so keep those setup requirements separate.

If the command reports an error, read and retain the full error message rather than treating the installation as complete. Once installation succeeds, continue to the benchmark script’s help output to inspect its available options.

Sources: AgentDojo: Quickstart and benchmark FAQ.

Inspect the benchmark options

With AgentDojo installed and model access arranged, inspect the benchmark script’s options before choosing your run settings. Its --help output is the documented way to check what the benchmark supports.

Use the benchmark script invocation shown in the AgentDojo documentation, adding --help instead of starting a run. Read the output and note the option names and any choices it lists for the suite, user tasks, model, defense, and attack.

These are the settings you’ll need to keep consistent when comparing candidates.

Don’t assume that an example model identifier will work with your provider. Confirm that you can access your selected model and that any required credentials are configured separately.

If an option is unclear, use the help output to check its description before proceeding. The package API may change, so record your installed AgentDojo version alongside the options you plan to use; you’ll save the exact benchmark command with each run.

Sources: AgentDojo: Quickstart and benchmark FAQ.

Run candidates with a consistent configuration

Run the documented AgentDojo benchmark invocation for the workspace suite and the user tasks you selected. Use the model, attack, and defense settings you identified from the benchmark options, and keep the suite, tasks, model, attack, and defense configuration unchanged across the candidate runs.

For each run, save the exact command, the AgentDojo version, and the results together. Recording these details matters because the package API may change; they also let you check whether the runs used the same conditions before comparing their results.

After each run, review the saved command and version record against the others. If a setting differs, correct it and rerun the candidate so the comparison uses consistent benchmark conditions; confirm that the recorded suite, tasks, model, attack, and defense match across runs.

Check separately that your selected model is accessible and any provider credentials it requires are configured—an example model identifier does not guarantee access.

Sources: AgentDojo: Quickstart and benchmark FAQ.

Check that candidate runs are comparable

Compare the saved command and AgentDojo version for every candidate run. Check that each used the same suite, user tasks, model, attack, and defense configuration; a difference in any of these means the runs are not directly comparable.

If you find a mismatch, correct the setting and rerun that candidate, then check the records again. Keep the command, version, and results together so you can see which configuration produced each result.

This matters because AgentDojo’s package API may change.

Treat the comparison as a benchmark-run check, not as a complete assessment of safety-tool performance. The documented quickstart does not specify built-in reports for false-positive rates or latency impact, so these runs alone do not verify either measure.

If those factors matter to your decision, assess them separately rather than inferring them from the benchmark results.

Sources: AgentDojo: Quickstart and benchmark FAQ.

Resolve setup and option issues

If a benchmark option is unclear, check the benchmark script’s --help output before running the evaluation. Use it to confirm the available choices for the suite, user tasks, model, defense, and attack rather than guessing at an option.

If a run cannot access its model provider, confirm that your selected model is available to you and that any required provider credentials are configured separately. The model identifier in an example does not guarantee access.

If results or behavior differ between runs, compare the saved AgentDojo versions and exact commands, then check that the suite, tasks, model, attack, and defense settings match. AgentDojo’s package API may change, so keeping those records with each result helps identify configuration differences; rerun a candidate with matching settings if you find a mismatch.

Sources: AgentDojo: Quickstart and benchmark FAQ.

Next steps

If you want a repeatable starting point for comparing agent-defense configurations, use AgentDojo with matching suite, task, model, attack, and defense settings. Keep the exact command, version, and results together so you can confirm that each candidate was run under the same conditions.

Before relying on the comparison, check those records for mismatches and rerun any candidate that used different settings. Confirm model access and provider credentials separately, too.

If false-positive rates or latency are important to your decision, don’t treat these benchmark runs as evidence for those measures: the documented quickstart does not specify built-in reports for them. Assess those factors separately before choosing a tool.