{
  "id": 9085691,
  "title": "Designing an eval harness for prompt-injection detection: what measuring my defenses actually taught me",
  "url": "https://urgent.news/2026/09/22/designing-an-eval-harness-for-prompt-injection-detection-what",
  "topic": "ai",
  "section": "AI",
  "published": "2026-09-22T05:08:49.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/shaarkymoo/designing-an-eval-harness-for-prompt-injection-detection-what-measuring-my-defenses-actually-ed6"
  },
  "original_language": "en",
  "account": "In this article, the author describes their experience in designing an evaluation framework to assess the effectiveness of various defenses against prompt injection attacks in a LangGraph agent. The agent is a travel concierge that retrieves hotel documents from a RAG corpus, reads a fake CRM, conducts web searches, and sends emails. The author built a golden set of 35 schema-first prompts, which includes 25 attacks from five different classes and 10 benign controls. The set is then used to test five attack classes (indirect injection, tool poisoning, system-prompt leakage, exfiltration, and RAG data poisoning) and four defenses (instruction hierarchy, tool allow-listing, a dual-LLM guard, and output sandboxing). The author measured the success rate and false positives of each defense before and after adding them, and found that while the full stack of defenses resulted in a lower overall attack success rate (20%) compared to the instruction hierarchy alone (16%), the addition of the guard and sandbox did not significantly improve the defenses and even led to a higher rate of RAG data poisoning (from 80% to 100%). The author also highlights the importance of measuring the defenses cumulatively, as a single flipped verdict can move a class rate by 20 points. The evaluation framework includes a Streamlit playground for visualizing the results and a threat model for understanding the residual risks.",
  "summary": "Designing an eval harness for prompt-injection detection: what measuring my defenses actually taught me Context I built a LangGraph agent — a travel concierge that retrieves hotel docs from a RAG corpus, reads a fake CRM, searches the web, and sends emails — and then I broke it on purpose. My testbed covers five attack classes (indirect injection, tool poisoning, system-prompt leakage, the lethal…",
  "key_points": [
    "Author designed eval harness to assess defenses against prompt injection attacks in LangGraph agent.",
    "Built golden set of 35 schema-first prompts with 25 attacks and 10 benign controls."
  ],
  "editors_take": "The author's evaluation framework reveals that adding certain defenses to a LangGraph agent does not significantly improve protection against prompt injection attacks and can even increase vulnerability to specific threats.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}