In a 12-scenario benchmark reported by Axel in 2026, Claude Sonnet 4.5, Gemini 2.5 Pro, and Gemini 2.5 Flash resisted every tested indirect prompt injection. Qwen3-235B and DeepSeek R1 resisted none. None of the five explicitly warned users about an injection. These are results from one run per scenario, not general-purpose safety rates.
What indirect prompt injection looks like
Indirect prompt injection happens when instructions are hidden in content a model retrieves or receives from a tool, rather than typed directly by the user. A user might ask an assistant to summarize email, find a flight, or look up a refund. A message, search result, or help document could then contain language such as “System Notice” or “Admin Override” and try to redirect the assistant.
The central test is whether the model continues serving the user’s request instead of treating that retrieved text as an authority. The benchmark’s prompts did not warn models in advance that tool output might contain malicious instructions; Axel describes them as unprimed, simulating an agentic turn.
Which models resisted the injections?
Axel’s 2026 report gives separate scores for resistance and flagging. “Resisted” means the model served the user’s goal and ignored the injected instruction. “Flagged” means it explicitly warned about the suspicious instruction.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →#1 Best Overall
| Model | Resisted | Flagged |
|---|---|---|
| Claude Sonnet 4.5 | 12/12 | 0/12 |
| Gemini 2.5 Pro | 12/12 | 0/12 |
| Gemini 2.5 Flash | 12/12 | 0/12 |
| Qwen3-235B | 0/12 | 0/12 |
| DeepSeek R1 | 0/12 | 0/12 |
These figures are Axel’s benchmark results, not independently verified safety rates. The reported pattern is stark within these tests: three models resisted all 12 scenarios and two resisted none. But a resistance score and a warning score measure different behaviors. A model can ignore an attack without telling the user, and a normal-looking answer does not by itself reveal whether suspicious content was encountered.
What the benchmark covered
The 12 scenarios included routine assistant tasks as well as attempts to expose information. They covered refund lookups, review summaries, flight searches, email triage, Rust documentation, restaurant searches, medical information, calendar questions, earnings summaries, and trip planning. Two disclosure scenarios attempted to upload a photo library or reveal personal details.
That variety makes the benchmark useful as a concrete demonstration of the threat: hostile instructions can appear in ordinary material an assistant is asked to process. It does not establish how a model will behave across every tool, task, or real-world agent workflow.
How to interpret the scores
The results should be read as a small benchmark observation, not a definitive ranking of model safety. Axel reports 12 scenarios, single runs, and default decoding settings. The Kaggle harness did not expose temperature controls, so the tests could not standardize that setting.
Recommended Free Tools
Scoring was deterministic and used substring or regular-expression checks rather than an LLM judge. This makes the reported outcomes reproducible against the chosen checks, but also limits what they can capture. The flagging detector searched for explicit warning language, so a model that silently resisted an attack could still score zero for flagging. Likewise, string-based checks may miss equivalent answers phrased differently or reward wording without capturing the full context.
- One run per scenario cannot show how consistently a model behaves across repeated attempts.
- Constructed scenarios do not represent the full range of injection wording or deployment environments.
- The benchmark does not establish performance against subtler attacks, paraphrased warnings, or long multi-step agent interactions.
- Results under default decoding settings may not transfer to other configurations.
Axel identifies more scenarios, less obvious injections that omit fake-authority labels, multi-turn agent loops, and a more robust flagging detector as possible next steps. Those extensions would test different and more demanding behaviors than the current 12 scenarios.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What the results mean for users
The benchmark highlights two questions worth separating when assessing an assistant: does it follow the user’s request rather than hostile retrieved text, and does it alert the user when it detects that text? In this test, the three models with perfect resistance scores did not receive flagging credit. That does not prove they never warn in other situations; it shows only that the benchmark recorded no explicit warnings in these runs.
For consequential agent tasks, a model’s benchmark result is not a substitute for safeguards around tools and sensitive actions. The results do not establish that any of these systems is safe to grant unrestricted access to email, files, calendars, or external services.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
