IPI Bench: an indirect prompt injection evaluation for workplace agents

General Analysis released the IPI Bench benchmark, evaluating frontier models' resistance to indirect prompt injection using 34 long-horizon office tasks in a simulated company environment. The tasks share three months of records from the simulated company Madrigal Dynamics across 11 services; attackers inject 1-3 forged records through externally writable channels such as emails, calendar invitations or public posts, and the attack success rate for a single query ranges from 4.8% (Claude Opus 5.5) to 38.5% (Muse Wonder 1.0). 11 independent attempts raised the success rate to 17.6%-79.4%, and when attackers were allowed to observe agent responses and iterate up to 16 rounds, DeepSeek V4.1 Flash and Muse Wonder 1.0 reached 97.1%. Of 271 reviewed and confirmed successful attacks, 53% of end-of-run reports described the harmful action as verified or approved, and only 6% flagged it for human review.