AgentDojo: leaderboard
Dynamic benchmark for prompt-injection attacks and defenses in tool-using LLM agents, with realistic tasks and security test cases across banking, Slack, travel, and workspace suites.
Metric: Robustness Score (%). Source: github.com. Source: benchmarklist.com. Saturation forecast: Estimated already saturated. 28 models tracked.
Top models
| # | Model | Score | Overall rank |
|---|---|---|---|
| 1 | Claude 3.5 Sonnet (20241022) | 85.69 | #291 |
| 2 | Claude 3.7 Sonnet (20250219) | 84.98 | #201 |
| 3 | GPT-4o (2024-05-13) | 81.8 | #325 |
| 4 | Claude 3 Opus (20240229) | 70.59 | #412 |
| 5 | Gemini 1.5 Pro (002) | 65.03 | #349 |
| 6 | Gemini 1.5 Flash (002) | 64.47 | #583 |
| 7 | GPT-4 Turbo | 62.71 | #404 |
| 8 | Claude 3 Haiku (20240307) | 62.16 | #771 |
| 9 | GPT-3.5 Turbo (0125) | 62.16 | #984 |
| 10 | Gemini 2.0 Flash (Preview) | 61.44 | #370 |
| 11 | GPT-4o Mini (2024-07-18) | 61.37 | #558 |
| 12 | Gemini 1.5 Flash (001) | 60.97 | #577 |
| 13 | Gemini 2.0 Flash (001) | 59.46 | #360 |
| 14 | Claude 3.5 Sonnet (20240620) | 58.66 | #299 |
| 15 | Claude 3 Sonnet (20240229) | 53.26 | #677 |
No result here: #3 Claude Opus 5.5, #6 GPT-6 Astra, #7 GPT-6.1 Sol.
Interactive version: theaggregate.ai/benchmark?slug=agentdojo · How It Works · Data refreshed daily, snapshot 2026-10-20.