New Benchmarks Expose How Easily AI Agents Get Hijacked — and One Guardrail Cuts Attacks by 75%
Enterprises spent the past year wiring AI agents into their most sensitive systems — email, CRM records, ticketing queues, calendars. A new benchmark suggests many of those agents can be talked into betraying the very users they serve, and that the fix may be simpler than the industry feared.
A research effort called AgentRedBench puts a hard number on the problem. Across an eight-model panel spanning Anthropic, OpenAI, and Google systems, agents connected to real software-as-a-service tools fell for cleverly disguised authorization attacks between 32% and 81% of the time when left undefended. The accompanying defense, AGENTREDGUARD, cut successful online attacks by roughly 75 to 77 percentage points — while flagging almost none of the legitimate work agents are supposed to do.
The threat: a confused deputy with your credentials
The vulnerability at the center of AgentRedBench is not a bug in any one model. It is structural to how agentic AI works. An LLM agent with tool access reads content from third-party integrations — a Gmail inbox, a Salesforce record, a Jira ticket — that the user did not write and does not control. When an attacker embeds instructions inside that content, the agent can read them as commands and act on them, using permissions the legitimate user granted for legitimate purposes.
Security researchers call this the "confused deputy" problem, and indirect prompt injection is its most common weapon. An agent authorized to send email on your behalf can be tricked into sending a phishing message. One authorized to update customer records can be steered into corrupting or exfiltrating them. The agent is not compromised in the traditional sense — it is doing exactly what it was told, by the wrong person.
What makes AgentRedBench distinct from earlier work is its focus on underspecified authorization: scenarios where the malicious request is subtle rather than obviously hostile, sitting in the gray zone between a reasonable task and an abuse of access. The benchmark comprises 215 such scenarios across 24 enterprise SaaS integrations and five attack types, plus 50 multi-integration chained scenarios in which an attack hops from one connected tool to another — the kind of lateral movement that mirrors how real breaches unfold.
Why the results matter
The 32%-to-81% undefended attack-success range is the headline figure, and it is damning precisely because the models tested are frontier systems. This is not a story about weak or outdated AI. It is a story about capable agents behaving as designed and being exploited through that design.
AgentRedBench sits alongside a broader 2026 wave of agent-security research that has arrived at similar conclusions. Agent Security Bench, a wider attack-defense framework testing 16 attack types across hundreds of tools, has recorded average attack-success rates as high as 84%. AgentDojo and InjecAgent, two widely cited prompt-injection testbeds, have shown frontier models failing meaningful fractions of indirect-injection tasks. OWASP's 2026 reporting put prompt injection at the top of its LLM risk list and described it as the fastest-growing category of failure in production agentic systems. The consistency across independent benchmarks is the point: no single lab is an outlier.
The guardrail that moved the numbers
Against that backdrop, AGENTREDGUARD's results stand out. The integration-aware guard reduced online attack success by 75 to 77 percentage points across three target model families — Anthropic's Haiku, OpenAI's GPT-5.4-mini, and Google's Gemini-3-flash — at a stated 0.0% false-positive rate on genuinely benign tasks. In other words, it caught the attacks without strangling the legitimate automation that justifies deploying agents in the first place.
That near-zero false-positive claim is what makes the finding operationally interesting. Guardrails that block attacks by also blocking real work tend to get switched off. The researchers report that AGENTREDGUARD outperformed every open-source baseline with non-trivial detection — including Llama Guard, PromptGuard 2, and ProtectAI — on both axes at once. To keep the benchmark from leaking into future training data and losing its meaning, the team released the codebase, integration schemas, and the guard model openly.
Two caveats belong in any honest reading. The reductions are large but not total — a 75-to-77-point drop from an 81% ceiling still leaves residual risk that matters in high-stakes settings. And benchmark performance is not production performance; real attackers adapt in ways a fixed scenario set cannot fully anticipate.
The regulatory tailwind
The timing intersects with a sharpening policy environment. In July 2026, DHS and CISA signaled a move toward mandatory minimum security standards for agentic AI in critical infrastructure, with analysis urging required prompt-injection protections and documented human-override paths. That builds on international guidance published earlier in the year — the multi-country "Careful Adoption of Agentic Artificial Intelligence Services" guide from CISA, the NSA, and allied cyber agencies — which laid out the risks and mitigation steps for deploying agents safely.
The through-line from both regulators is a structural diagnosis: organizations are dropping agents into environments where the oversight infrastructure was never built to follow them. Defenses like AGENTREDGUARD are early attempts to build that missing layer.
Why this is the gating factor
Strip away the benchmark specifics and the strategic implication is stark. Agent capability is no longer the bottleneck for enterprise deployment — trust is. A CISO cannot green-light an agent with write access to customer records and payment systems if that agent flips against the company one poisoned email out of three. Security, not raw intelligence, is now the variable that decides whether agentic AI graduates from pilot to production.
That reframes the competitive landscape. Vendors have spent two years racing on capability. The next race is on containment: least-privilege tool scoping, integration-aware guards, human-in-the-loop checkpoints for irreversible actions, and auditable override trails. Benchmarks like AgentRedBench give buyers a common yardstick to demand before they connect an agent to anything that matters.
What to watch
Three things. First, whether AGENTREDGUARD's near-zero false-positive result holds up under adaptive, real-world attack — the gap between a static benchmark and a live adversary. Second, whether DHS-CISA converts July's guidance into an actual Notice of Proposed Rulemaking, which would turn prompt-injection defenses from best practice into legal requirement for critical-infrastructure operators. And third, whether the major agent platforms ship integration-aware defenses by default, or leave enterprises to bolt on third-party guards. The benchmarks have made the risk legible. The open question is who owns the fix.