ResearchBenchmarksData Exfiltration via Indirect Prompt Injection on Indirect Prompt Injection Dataset 1.0 (test)For AI assistantsMarkdownContent indexData Exfiltration via Indirect Prompt Injection on Indirect Prompt Injection Dataset 1.0 (test)Follow72.4Data Exfiltration Success Ratex-ai/grok-4-2.89616.65236.255.748Oct 10, 2025Evaluation resultsMethodMethodLinksData Exfiltration Success Ratex-ai/grok-42025.1072.4inception/mercury2025.1029.1qwen/qwen3-235b-a22b-2507parameters=235.0Bparameters=235.0B2025.1028.3meta-llama/llama-4-scoutparameters=109.0Bparameters=109.0B2025.1014.8meta-llama/llama-4-maverickparameters=402.0Bparameters=402.0B2025.1010.1qwen/qwen3-32bparameters=32.8Bparameters=32.8B2025.108.2x-ai/grok-code-fast-12025.108.2anthropic/claude-3-haiku2025.106nousresearch/hermes-4-70b2025.106qwen/qwen-2.5-72b-instructparameters=72.7Bparameters=72.7B2025.105.2meta-llama/llama-3.3-70b-instructparameters=70.6Bparameters=70.6B2025.105x-ai/grok-3-mini2025.104.5z-ai/glm-4-32bparameters=32.0Bparameters=32.0B2025.104.2deepseek/deepseek-chat-v3.1parameters=685.0Bparameters=685.0B2025.101.9google/gemini-2.5-flash-lite2025.101.4deepseek/deepseek-chat-v3-0324parameters=685.0Bparameters=685.0B2025.101.4openai/gpt-4.1-nano2025.101.2openai/gpt-oss-20bparameters=21.0Bparameters=21.0B2025.101mistralai/mistral-small-3.2-24b-instructparameters=24.0Bparameters=24.0B2025.100.7google/gemini-flash-1.5-8bparameters=8.0Bparameters=8.0B2025.100.3google/gemini-2.0-flash-0012025.100.2nousresearch/hermes-4-405bparameters=406.0Bparameters=406.0B2025.100.1openai/gpt-oss-120bparameters=117.0Bparameters=117.0B2025.100openai/gpt-5-nano2025.100amazon/nova-micro-v12025.100google/gemini-2.0-flash-lite-0012025.100anthropic/claude-sonnet-42025.100amazon/nova-lite-v12025.100