Garm: an open benchmark for prompt injection in scheduled AI agents
Garm is an open benchmark for AI agents that do scheduled back-office work on records an outsider can change. For each defence it measures attacks stopped, honest updates wrongly blocked and the approvals a person has to give.
What is cross-run prompt injection?
An agent that triages a shared inbox every hour and runs Thursday's payment batch has to act on what outsiders send, and a later job acts on whatever an earlier one wrote. So an attacker doesn't need to steer the session the input arrives in: something planted in the company's records in one run can fire in a later one. Most injection benchmarks score a single session; Garm keeps the record between runs and scores each defence across them.
A finance back office is a good place to test this, because outsiders are supposed to change its records. Business email compromise, often a "we've changed our bank details" message, was the second-costliest category in the FBI's 2025 Internet Crime Report, at about US$3.05 billion across 24,768 complaints.
What is a laundered attack?
Garm's hardest attack follows the company's own handbook. The attacker writes from a real vendor's compromised mailbox and first changes the vendor's phone number, which the handbook allows, then asks for new bank details. Staff call the number on file, reach the attacker, and record a genuine verification. The bank change arrives with a genuine-looking callback, so honest and hostile changes leave the same trail.
What Garm found
- 94 to 100% of honest vendors' phone-then-bank changes were blocked under per-field authority labels by AI reviewers reading the approval card, because they look the same as hijacks. The same reviewers let through at most 3% of laundered attacks.
- Calling the number on file from before any recent change stopped the laundered attack in 8 of 8 episodes, without blocking honest vendors, as long as their old number still worked.
- Per-field authority labels needed 0 approvals per 100 routine tasks, against 102 to 163 per 100 for the other gated defences, partly because the labels gate fewer kinds of action.
- Templated direct injections steered an action in 0 of 1,260 runs: a null result. Either the attacks are too weak or the models resist them.
The full grid ran on Claude Haiku 5.5: six defences, 124 episodes, three attempts each, 2,232 runs. Claude Sonnet 5.5 repeated a smaller check, judged approval cards as a reader, and played the adaptive attacker.
The defences it compares
| Defence | |
|---|---|
| D0 | None: a tool-calling agent with the company handbook |
| D1 | Prompt rules plus spotlighting of external text |
| D2 | A tool permission gateway: consequential actions go to an approval queue |
| D3 | D2 plus a monitor model that reviews every consequential action |
| D4 | Drafts only (plan-then-execute): the model has no tools, and code checks each proposal before it runs |
| D5 | D4 with per-field authority labels computed from the provenance log |
| D6 | A known-good callback: staff call the number on file before any recent change. It changes the staff process, so it combines with any of D0 to D5 |
What it doesn't show
Small samples, templated attacks and modelled human approvers, all stated in the README. Every run used Anthropic models. It has not been peer reviewed. Its write-up was checked by 11 models from 7 vendors, OpenAI and open-weight models among them, so no one model family graded its own work: see how I evaluate.
Code and data
- github.com/nesteazy-rishabh/garm: code, episodes and the README with every result (MIT licence)
- Release v0.1.2: the run data behind every number
- How the outside review ran
Named for the hound that guards the gate of Hel in Norse myth. Related notes: the lethal trifecta and approval fatigue.