CAISI AgentDojo - Credential Exfiltration, Non-Public Injection (2025)
Safety · 2025-09-30
This condition of CAISI's credential-exfiltration AgentDojo task uses the sophisticated non-public injection selected from prior manual red-teaming on U.S. models. It reports hijacking frequency across the same 30 benign Workspace tasks, with five samples per task and failures to encounter the injection excluded.
Top models (lower is better)
| Model | Score |
|---|---|
| GPT-5 | 0.0 |
| Opus 4 | 16.0 |
| gpt-oss-120b | 53.0 |
| DeepSeek-R1-0528 | 76.0 |
| DeepSeek-R1 | 86.0 |
| DeepSeek-V3.1 | 92.0 |