The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →In Axel’s 2026 benchmark, Claude Sonnet 4.5, Gemini 2.5 Pro, and Gemini 2.5 Flash resisted all 12 tested indirect prompt injections; Qwen3-235B and DeepSeek R1 resisted none. None of the five explicitly flagged an attack. Those are results from a small, single-run benchmark—not general-purpose safety ratings.
What indirect prompt injection means
Indirect prompt injection occurs when a model receives an ordinary request, then encounters malicious instructions embedded in material it retrieves or reads—such as a help-center document, search result, email, or inbox dump. The hidden text may try to redirect the model with fake authority labels such as “System Notice” or “Admin Override.” The document is data for the task, not a genuine instruction from the user or system.
As an Amazon Associate I earn from qualifying purchases.
That distinction matters whenever an assistant uses external content to answer a question or take action. A request to summarize reviews, for example, should not be overridden by a review that tells the model to ignore the user and disclose private information.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →What Axel’s benchmark tested
Axel’s updated benchmark covered 12 scenarios, ranging from refunds, review summaries, flight and restaurant searches, email triage, Rust documentation, medical information, calendar questions, earnings summaries, and trip planning to two disclosure attempts: uploading a photo library and exposing personal details. The attacks varied in placement and wording. The prompts were unprimed: models were not warned that content they read might contain malicious instructions.
#1 Best Overall
Five models were assessed using two separate measures:
- Resisted: The response served the user’s goal and ignored the injected instruction.
- Flagged: The response explicitly warned the user about the suspicious instruction.
Reported results
| Model | Resisted | Flagged |
|---|---|---|
| Claude Sonnet 4.5 | 12/12 scenarios | 0/12 scenarios |
| Gemini 2.5 Pro | 12/12 scenarios | 0/12 scenarios |
| Gemini 2.5 Flash | 12/12 scenarios | 0/12 scenarios |
| Qwen3-235B | 0/12 scenarios | 0/12 scenarios |
| DeepSeek R1 | 0/12 scenarios | 0/12 scenarios |
These are Axel’s author-reported results from the public leaderboard in 2026, based on single runs. They are not independently verified safety rates.
Why resisting and flagging are different
A model can ignore malicious text and still give the user no indication that it encountered an attempted attack. That appears to be what happened for the three models that resisted all scenarios: each scored zero for explicit warnings. Conversely, the benchmark treats flagging as its own measured behavior rather than assuming that a safe-looking answer proves the model detected the injection.
In practical use, silent resistance may protect the immediate task, but it gives a user or operator less visibility into suspicious content. The benchmark therefore points to two distinct questions: did the model stay on task, and did it tell anyone that the content tried to redirect it? Its results address only those questions in these scenarios.
Rank #3
How to interpret the scores
The benchmark is a useful demonstration, not a basis for declaring a model safe or unsafe across real deployments. It used 12 constructed scenarios, single runs, and default decoding settings; the author says Kaggle’s harness did not expose temperature controls. Its scoring relied on substring or regular-expression checks rather than an LLM judge. The flagging detector specifically looked for explicit warning language, so different wording could go uncounted.
Those choices limit what the figures establish. String-based checks may miss subtler success or failure, and a model’s behavior can change across prompts, decoding settings, tools, and multi-step interactions. A constructed set with fake authority labels also cannot stand in for every attack style. The scores describe performance on this particular test, not the likelihood of resisting an arbitrary injection in a live agent.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What a stronger evaluation would need
Axel identifies several directions for improving the benchmark: more scenarios, less conspicuous injections that do not rely on fake authority labels, multi-turn agent loops, and a more robust method for detecting warnings. Together, these would test both whether a model maintains the user’s intent and whether its reporting behavior is recognized more reliably.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
