Notifications
Clear all
Topic starter
19/08/2026 3:24 pm
TL;DR: Nine frontier models tested as enterprise agents across 147 adversarial scenarios produced a mean Agent Failure Rate of 0.75, according to ActiveFence, with every model failing on more than half the scenarios and the best updated model still failing 17% of the time. The result shows that agent governance, tool access, and prompt-injection resistance remain operational controls, not theoretical concerns.
NHIMG editorial — based on content published by ActiveFence: ENT-IPI Bench, the enterprise indirect prompt injection benchmark
By the numbers:
- ActiveFence evaluated nine frontier models as enterprise agents across 147 adversarial scenarios spanning seven work domains and seven industries.
- The benchmark reported a mean Agent Failure Rate of 0.75 across all models.
Questions worth separating out
Q: How should security teams govern AI agents that can access enterprise systems?
A: Security teams should govern AI agents as non-human identities with explicit ownership, scoped privileges, and continuous monitoring.
Q: Why do indirect prompt injections create more risk than ordinary prompt errors?
A: Because the attack is embedded in content the agent is already expected to trust.
Q: What do organisations get wrong about AI agent safety at design time?
A: Organisations often assume that a safe design remains safe in production.
Practitioner guidance
- Constrain agent tool authority Limit each agent to the smallest viable set of systems, data sources, and write actions, and remove broad access that is not required for the task.
- Separate read and act paths Design workflows so an agent can ingest content without being able to execute irreversible actions from the same input path, especially for email, tickets, and vendor requests.
- Add adversarial prompt-injection testing Test enterprise agents against hidden instructions, scope-expanding prompts, and authority laundering before production approval and after every major workflow change.
What's in the full report
ActiveFence's full blog covers the benchmark setup and scenario design this post intentionally leaves at a higher level:
- The seven work domains and seven industries used to construct the 147 adversarial enterprise scenarios.
- The 0-10 security scoring approach and how the nine-judge jury of frontier models was used to assess failures.
- The sample scenario and proof-of-concept details showing how hidden instructions changed agent behaviour.
- The retest results across newer model versions, including which models improved and how much.
👉 Read ActiveFence's benchmark analysis of enterprise indirect prompt injection →
Enterprise agent prompt injection tests: what security teams need to know?
Explore further
19/08/2026 4:09 pm
Agentic AI has become an identity and access problem before it becomes an AI quality problem. Once a system can independently choose tools and act on enterprise data, it behaves like a non-human identity with delegated authority. That makes scope, permissioning, and auditability more important than raw model accuracy. Security teams should treat the agent as a governed actor, not a conversational interface.
A question worth separating out:
Q: Which controls matter most when AI agents can take response actions?
A: The key controls are graduated autonomy, full audit logging, and policy-backed approval gates for higher-impact actions. Teams should also separate read access from write authority so agents can analyse broadly without being able to change protections or trigger irreversible remediation on their own.
👉 Read our full editorial: Enterprise agent prompt injection is failing in most adversarial tests
