LLMail-Inject: A Dataset from Real-World Adaptive Prompt Injection Challenges

The paper releases LLMail-Inject, a benchmark dataset containing 208,095 human-written indirect prompt injection attack prompts, from a two-phase public red-teaming challenge involving 839 participants over five months. The dataset evaluates the full attack chain: an attack must first be retrieved by the email database, bypass deployed defenses, and then trigger an out-of-scope tool call with correct parameters. When replaying attacks on models that did not participate in the challenge, Meta SecAlign still achieves a 32% attack success rate, GPT-4o 58%, and GPT-5 mini 47%; in contrast, these models often score below 5% on existing benchmarks like AgentDojo. Attacks also transfer to coding tasks (37%) and file management tasks (28%–45%). The authors also release the challenge platform, the annotated dataset, and a taxonomy of attack strategies.

Deep readingGenerating