SEAL treats lower-trust retrieved content as data requiring its own processing boundary before the main agent consumes it. The study reported an attack-success reduction from 34.6 percent to 0.1 percent in its selected AgentDojo evaluation conditions. Those figures are relative to a particular benchmark, agent configuration and attack set; they do not…
Inspect the ClaimsCase · DiggingBeagle record
SEAL reduced selected AgentDojo injection successes under a local sanitizer
A controlled study reported large prompt-injection reductions when untrusted input was sanitized before agent reasoning.
Scope
Controlled AgentDojo evaluation; no claim of universal robustness, new attacks, live deployments or complete utility preservation.
Assessment profile
Assessment method- Setting
- evaluation
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- mitigation available
- AI role
- AGAINST AI
Basis and provenance
The paper reports benchmark performance under selected setups, not a certified universal security control or observed customer protection rate. Impact remains unrated because the scoped record does not establish a calibrated severity-to-impact-band mapping.
Assessed Oct 31, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-C26-SEAL-AGENTDOJO-1 · SEAL: local sanitation before agent tool decisions
At a glance
The attack metric alone cannot establish operational utility; task completion and adaptive attacks need independent comparison.
Read the implicationsPerformance under adaptively generated attacks against the sanitizer itself requires follow-up. Practical end-to-end utility costs across heterogeneous tools are not yet established.
Limits and uncertaintyFull account
SEAL treats lower-trust retrieved content as data requiring its own processing boundary before the main agent consumes it. The study reported an attack-success reduction from 34.6 percent to 0.1 percent in its selected AgentDojo evaluation conditions. Those figures are relative to a particular benchmark, agent configuration and attack set; they do not represent a measured reduction in real-world incidents.
The security question is whether the sanitizer preserves the information needed for authorized work while removing attacker-controllable instructions. A system that always declines or discards useful content can obtain attractive attack metrics but still fail its purpose. For production transfer, both task completion and effect-level unauthorized actions must be measured on inputs not seen by the authors during selection or tuning.
Mechanism and trust boundary
- 01
Step
- 02
Step
- 03
Step
Timeline
- Oct 30, 2026disclosure
Public disclosure
Claims & evidence
CLM-C26-SEAL-AGENTDOJO-1The SEAL paper reports a reduction from 34.6 percent to 0.1 percent attack success in a selected AgentDojo configuration using a local input sanitizer.supported
Basis: reported finding
- supportsSEAL: local sanitation before agent tool decisionsprimary disclosure
SEAL paper, experimental AgentDojo results and benign task tradeoff
Implications
The attack metric alone cannot establish operational utility; task completion and adaptive attacks need independent comparison.
Controls and mitigations
- Keep sanitization separate from tool permissions, check benign-task retention and test against unseen obfuscated injection styles.
Unknowns and contradictions
- Performance under adaptively generated attacks against the sanitizer itself requires follow-up.
- Practical end-to-end utility costs across heterogeneous tools are not yet established.
Sources and citation
Material revision history
- Oct 31, 2026 · Canonical change recorded · new in release · revision 208