AgentDyn: Can Your Agent Security Defenses Be Deployed in Real Dynamic Environments?

The researchers propose the AgentDyn benchmark to test whether agents' ability to defend against indirect prompt injection transfers to real dynamic environments. The authors point out three shortcomings of existing benchmarks, namely the lack of dynamic open-ended tasks, the lack of helpful instructions, and user tasks being too simple, and on this basis manually design 60 open-ended tasks covering shopping, GitHub and daily life, and 560 injection test cases, requiring agents to plan dynamically and handle useful third-party instructions. Evaluation of ten state-of-the-art defenses shows that almost all defenses either lack sufficient security or exhibit obvious over-defense, and that existing defenses still fall short of real deployment. The benchmark is open-sourced at https://github.com/leolee99/AgentDyn。