{
  "schema": "lri.ai-security-benchmark-matrix/v1",
  "updated_at": "2026-07-23",
  "benchmarks": [
    {
      "id": "agentdojo",
      "name": "AgentDojo",
      "scope": "tool-using agents over untrusted data",
      "assets": "97 realistic tasks and 629 security test cases",
      "primary_metrics": [
        "benign task utility",
        "attack success",
        "security-property preservation"
      ],
      "fit": "dynamic prompt-injection and defense evaluation",
      "evidence_ref": "agentdojo"
    },
    {
      "id": "injecagent",
      "name": "InjecAgent",
      "scope": "indirect prompt injection in tool-integrated agents",
      "assets": "1,054 cases, 17 user tools and 62 attacker tools",
      "primary_metrics": [
        "attack success",
        "user harm",
        "private-data exfiltration"
      ],
      "fit": "broad tool/action injection coverage",
      "evidence_ref": "injecagent"
    },
    {
      "id": "agentharm",
      "name": "AgentHarm",
      "scope": "malicious multi-step agent tasks and jailbreak robustness",
      "assets": "110 tasks, 440 augmented tasks and 11 harm categories",
      "primary_metrics": [
        "refusal",
        "harmful task completion",
        "capability retained after jailbreak"
      ],
      "fit": "agent misuse and post-jailbreak capability",
      "evidence_ref": "agentharm"
    },
    {
      "id": "cyberseceval2",
      "name": "CyberSecEval 2",
      "scope": "LLM security and offensive/defensive capability",
      "assets": "prompt injection and code-interpreter abuse suites",
      "primary_metrics": [
        "attack success",
        "unsafe execution",
        "false refusal rate"
      ],
      "fit": "model/agent safety-utility tradeoff",
      "evidence_ref": "cyberseceval2"
    }
  ],
  "lri_experiment_suites": [
    {
      "id": "E1",
      "name": "Indirect-context isolation",
      "attack_surface": [
        "web",
        "email",
        "RAG",
        "tool output",
        "memory"
      ],
      "tests": [
        "goal hijack",
        "data exfiltration",
        "cross-domain instruction execution"
      ],
      "metrics": [
        "unsafe_action_rate",
        "benign_task_success",
        "exfiltration_rate",
        "false_block_rate"
      ]
    },
    {
      "id": "E2",
      "name": "Tool authorization and side effects",
      "attack_surface": [
        "MCP tools",
        "API actions",
        "code/shell",
        "business workflows"
      ],
      "tests": [
        "unauthorized tool call",
        "parameter escalation",
        "approval bypass",
        "multi-step privilege chaining"
      ],
      "metrics": [
        "unauthorized_call_rate",
        "high_risk_confirmation_coverage",
        "side_effect_integrity",
        "policy_latency"
      ]
    },
    {
      "id": "E3",
      "name": "Identity, token and scope",
      "attack_surface": [
        "OAuth",
        "service accounts",
        "user delegation",
        "multi-agent identity"
      ],
      "tests": [
        "token replay",
        "wrong audience",
        "scope inflation",
        "shared principal ambiguity"
      ],
      "metrics": [
        "token_rejection_rate",
        "scope_minimization",
        "principal_attribution",
        "non_repudiation_coverage"
      ]
    },
    {
      "id": "E4",
      "name": "Session, local runtime and supply chain",
      "attack_surface": [
        "stateful HTTP",
        "local MCP",
        "skills/plugins",
        "containers"
      ],
      "tests": [
        "session hijack",
        "async event injection",
        "malicious startup command",
        "artifact replacement"
      ],
      "metrics": [
        "session_isolation",
        "sandbox_escape_rate",
        "artifact_verification_coverage",
        "egress_violation_rate"
      ]
    },
    {
      "id": "E5",
      "name": "Audit, containment and recovery",
      "attack_surface": [
        "logs",
        "memory",
        "credentials",
        "tool registry",
        "business state"
      ],
      "tests": [
        "incident replay",
        "credential revocation",
        "memory rollback",
        "agent quarantine",
        "business compensation"
      ],
      "metrics": [
        "audit_completeness",
        "mean_time_to_contain",
        "rollback_success",
        "residual_privilege"
      ]
    }
  ],
  "required_metrics": [
    "benign_task_success",
    "unsafe_action_rate",
    "data_exfiltration_rate",
    "unauthorized_tool_call_rate",
    "false_block_or_refusal_rate",
    "privilege_blast_radius",
    "audit_completeness",
    "mean_time_to_contain",
    "rollback_success"
  ]
}