SPILLWAY

_{AgentDojo v1.2.2, three backbones × four suites. The judge is enabled in these results and off by default in the library. Values and conditions. Open the interactive page.}

SPILLWAY, a prompt-injection defense for tool-using agents: structure decides where an agent acts, a model reviews refusals.

Text in an email or a web page can steer an agent to an attacker's address. SPILLWAY checks recipients against the user's task and the typed fields of tool returns.

Woosang Lim^1,2,* · Yeseul Chang³ · Jaewoo Lee^3
1SAINT Machines · ²KAIST · ³Chung-Ang University
* Corresponding author

Demo · Try it · Results · Project page · App integration · Paper (PDF) · Reproduce · Cite · MUSTER

An earlier version was accepted at the Third Workshop on Agents in the Wild: Safety, Security, and Beyond (NeurIPS 2026).

pip install git+https://github.com/saintmachines/[email protected]

See it work

_{Source: AgentDojo v1.2.2 Workspace, user task 19 with injection task 2, on gpt-4o-mini. The seven runs are seven of the eight behind Table 1. This episode was picked because the other defenses shown fail on it in different ways. ROPE's run, the eighth, is not shown. It also does all three: its invite call was blocked and both to-dos ran. Open the interactive demo to read each run's calls.}

SPILLWAY's run, call by call

Results

Every number below is from the paper. SPILLWAY's rows use the judge, which the library leaves off by default.

Table A. AgentDojo breadth grid, twelve-cell means (Table 2 of the paper)