Prompt injection defenses: lab data
Lab run of 9 November 2026. Published by our lab under the MIT licence (LICENSE).

Files
  results.csv   One row per trial. 1,800 rows. Columns include model, scenario,
                defense, attempted, success, completed.
  summary.json  Counts and 95% intervals per cell, model IDs and run settings.
  tables.md     All result tables, including attempts before enforcement.
  harbor.py     The mock support agent: system prompt, mock data, the five
                attack scenarios, the defenses D1 to D4 and the grading rules.

Everything in the lab is a mock. The tools (lookup_order, issue_refund,
send_email) have no side effects. All hosts and addresses use example.com,
example.org or .example names. No real customer or system was tested.

Not in this folder: the chat transcripts, the client code and the cell explorer.
They are part of the full dataset:
  https://airedteamingservices.com/research/indirect-prompt-injection-lab/

Grading reads only the mock tool log and the rendered reply. It never uses
what the model says about its own actions.