ResearchBenchmarksData Exfiltration via Indirect Prompt Injection on Indirect Prompt Injection Dataset 1.0 (test)Follow72.4Data Exfiltration Success Ratex-ai/grok-4-2.89616.65236.255.748Oct 10, 2025Evaluation ResultsMethodMethodLinksData Exfiltration Success Ratex-ai/grok-42025.1072.4inception/mercury2025.1029.1qwen/qwen3-235b-a22b-2507parameters=235.0Bparameters=235.0B2025.1028.3meta-llama/llama-4-scoutparameters=109.0Bparameters=109.0B2025.1014.8meta-llama/llama-4-maverickparameters=402.0Bparameters=402.0B2025.1010.1qwen/qwen3-32bparameters=32.8Bparameters=32.8B2025.108.2x-ai/grok-code-fast-12025.108.2anthropic/claude-3-haiku2025.106nousresearch/hermes-4-70b2025.106qwen/qwen-2.5-72b-instructparameters=72.7Bparameters=72.7B2025.105.2meta-llama/llama-3.3-70b-instructparameters=70.6Bparameters=70.6B2025.105x-ai/grok-3-mini2025.104.5z-ai/glm-4-32bparameters=32.0Bparameters=32.0B2025.104.2deepseek/deepseek-chat-v3.1parameters=685.0Bparameters=685.0B2025.101.9google/gemini-2.5-flash-lite2025.101.4deepseek/deepseek-chat-v3-0324parameters=685.0Bparameters=685.0B2025.101.4openai/gpt-4.1-nano2025.101.2openai/gpt-oss-20bparameters=21.0Bparameters=21.0B2025.101mistralai/mistral-small-3.2-24b-instructparameters=24.0Bparameters=24.0B2025.100.7google/gemini-flash-1.5-8bparameters=8.0Bparameters=8.0B2025.100.3google/gemini-2.0-flash-0012025.100.2nousresearch/hermes-4-405bparameters=406.0Bparameters=406.0B2025.100.1openai/gpt-oss-120bparameters=117.0Bparameters=117.0B2025.100openai/gpt-5-nano2025.100amazon/nova-micro-v12025.100google/gemini-2.0-flash-lite-0012025.100anthropic/claude-sonnet-42025.100amazon/nova-lite-v12025.100