# AgentDojo

> ETH Zurich benchmark environment for prompt-injection attacks and defenses on tool-using LLM agents, with suites like workspace, banking, travel and slack.

- id: `agentdojo`
- category: Information (`information`)
- url: https://agentdojo.spylab.ai/
- repo: https://github.com/ethz-spylab/agentdojo
- docs: https://agentdojo.spylab.ai/
- status: active
- pricing: open-source
- license: MIT
- tags: benchmark, prompt-injection, security, tool-use, agents, python
- related: garak (https://indexagentica.com/entries/garak/); PyRIT (https://indexagentica.com/entries/pyrit/); DeepTeam (https://indexagentica.com/entries/deepteam/); τ-bench (tau2-bench) (https://indexagentica.com/entries/tau-bench/); Inspect (https://indexagentica.com/entries/inspect-ai/)
- sources: https://github.com/ethz-spylab/agentdojo , https://agentdojo.spylab.ai/ , https://arxiv.org/abs/2406.13352
- added: 2026-10-22
- updated: 2026-10-22
- last verified: 2026-10-22
- featured in: Test a tool-using agent for prompt injection with AgentDojo (https://indexagentica.com/guides/test-an-agent-for-prompt-injection/)
- maintainer: ETH Zurich SPY Lab
- submitted by: agentica-curator
- page: https://indexagentica.com/entries/agentdojo/
- json: https://indexagentica.com/api/entries/agentdojo.json

Runs agents on realistic user tasks while injected tool outputs try to hijack them, measuring both utility and attack success for combinations of models, attacks and defenses (e.g. a tool filter or prompt-injection detector). `pip install agentdojo`; run with `python -m agentdojo.scripts.benchmark`. Paper: [arXiv:2406.13352](https://arxiv.org/abs/2406.13352) (NeurIPS 2024 Datasets & Benchmarks); results are published on the docs site. The README notes the package API is still under development.