AgentDojo

Free plan APILinuxSelf-hosted

What AgentDojo is

AgentDojo is a free, self-hosted framework for evaluating prompt injection attacks and defenses in LLM agents. It provides benchmark task suites and a script for selecting models, attacks, defenses, suites, and tasks to run. Researchers can extend the benchmarks with new tasks and suites or build a benchmark from scratch. Custom attacks can target a pipeline, suite, user task, or injection task. Pipelines combine components such as system messages, LLMs, tool execution, and defenses. Documented tool-calling implementations cover OpenAI, Anthropic, Google, and Cohere, and the docs describe using Llama 3 70B through TogetherAI’s API. A prompting interface is also available for other models. Its Python functions runtime runs functions for function-calling LLMs, including ones using stateful environments. The prompt injection detector requires the `transformers` extra. Results can be explored as run traces in Invariant Explorer. The project cautions that its reported combinations are not a leaderboard because not every model, attack, and defense combination was tested. Installation uses `pip install agentdojo`.

Who it suits

AgentDojo is aimed at researchers evaluating attacks and defenses for LLM agents and building benchmarks. It suits users comfortable with Python and self-hosted tools.

What it does well

Free and self-hosted
Supports custom attacks and benchmark tasks
Pipelines can include defense components
Run traces can be inspected in Invariant Explorer

What to know first

Package API is still under development and may change
Prompt injection detector requires the `transformers` extra
Reported results do not cover every combination

Limits

The package API is still under development and may change. The results page cautions that combinations were not all tested, and the prompt-injection detector requires the `transformers` extra.

Getting started

Open the AgentDojo website.
Install the package with `pip install agentdojo`.
Use the benchmark script to select models, defenses, attacks, suites, and tasks.
Build a custom pipeline, attack, task suite, or benchmark as needed.
Install the `transformers` extra if using the prompt-injection detector.

Verdict

AgentDojo provides components for building and evaluating LLM agent security benchmarks, including custom attacks and defenses. Its changing API and incomplete result coverage are important constraints to account for.

Questions

How much does AgentDojo cost?

AgentDojo is free, with a free plan.

Which platforms does it support?

The listed platforms are API, Linux, and self-hosted.

Is AgentDojo open source?

The project's GitHub page identifies its license as MIT.

Which model providers are documented?

Tool-calling implementations cover OpenAI, Anthropic, Google, and Cohere. The documentation also describes Llama 3 70B through TogetherAI’s API and a prompting interface for other models.

Can I add my own tests?

Yes. Users can create custom attacks, define tasks and task suites, and extend or create benchmarks.

Can I inspect evaluation runs?

Yes. Run traces, including agent trajectories, attacks, and defenses, can be inspected using Invariant Explorer.

Facts from AgentDojo's own pages

Affiliations: The listed authors are affiliated with ETH Zurich and Invariant Labs. · agentdojo.spylab.ai, 8 Oct 2026
API status: The package API is still under development and may change. · agentdojo.spylab.ai, 8 Oct 2026
Benchmark: The benchmark script runs selected models, defenses, attacks, task suites, and tasks. · agentdojo.spylab.ai, 8 Oct 2026
Contribute results: Users can submit benchmark results by opening a repository pull request that includes a brief description and an implementation. · agentdojo.spylab.ai, 8 Oct 2026
Custom attacks: Users can create and plug in custom attacks that target a pipeline, task suite, user task, and injection task. · agentdojo.spylab.ai, 8 Oct 2026
Custom benchmarks: Users can define task suites and tasks to extend the provided benchmarks or create a new benchmark from scratch. · agentdojo.spylab.ai, 8 Oct 2026
Custom pipelines: Pipeline components can be combined into custom agent pipelines, including defense components. · agentdojo.spylab.ai, 8 Oct 2026
Defense research: The results page reports model, defense, and attack combinations and says it is not a leaderboard because not all combinations were tested. · agentdojo.spylab.ai, 8 Oct 2026
Function runtime: Its functions runtime defines and runs Python functions for use with function-calling LLMs, including functions that operate on stateful environments. · agentdojo.spylab.ai, 8 Oct 2026
Install: The quickstart installs AgentDojo with `pip install agentdojo`. · agentdojo.spylab.ai, 8 Oct 2026
License: The project's GitHub page identifies its license as MIT. · github.com, 8 Oct 2026
Makers: The project page lists authors affiliated with ETH Zurich and Invariant Labs. · agentdojo.spylab.ai, 8 Oct 2026
Model integrations: Documented tool calling LLM implementations include OpenAI GPT, Anthropic Claude, Google Gemini, Cohere Command, and a prompting interface for other models. · agentdojo.spylab.ai, 8 Oct 2026
Model providers: Documented tool-calling LLM implementations support OpenAI, Anthropic, Google, and Cohere; the docs also describe using Llama 3 70B through TogetherAI’s API. · agentdojo.spylab.ai, 8 Oct 2026
Pipeline components: Agent pipelines combine elements such as system messages, LLMs, tool execution, and defense components. · agentdojo.spylab.ai, 8 Oct 2026
Prompt injection detector: The prompt injection detector requires installing the `transformers` extra. · agentdojo.spylab.ai, 8 Oct 2026
Purpose: AgentDojo is a dynamic environment for evaluating prompt injection attacks and defenses for LLM agents. · agentdojo.spylab.ai, 8 Oct 2026
Research use: The project asks research users to consider citing its 2024 paper. · agentdojo.spylab.ai, 8 Oct 2026
Results limitation: The results page says its results are not a leaderboard because not all models were tested with all attacks and defenses. · agentdojo.spylab.ai, 8 Oct 2026
Tool runtime: Its functions runtime registers and runs Python functions for use with function calling LLMs, including functions that use stateful environments. · agentdojo.spylab.ai, 8 Oct 2026
Trace inspection: The results page says users can inspect run traces, including agent trajectories, attacks, and defenses, using Invariant Explorer. · agentdojo.spylab.ai, 8 Oct 2026
Use case: The documentation presents AgentDojo as a framework for researchers to evaluate attacks and defenses and build benchmarks. · agentdojo.spylab.ai, 8 Oct 2026

Where AgentDojo stands on Freedom251

AI Security Testing Tools#10 of 29