Evidence and limits
Finding: Tool-using agents failed many ordinary tasks and remained vulnerable to prompt injection from untrusted tool data. Security and task utility must be evaluated together.
Impact: Strengthen instruction-data separation and adversarial evaluation. Reject successful tool execution as evidence of safe delegation.
Boundary: The benchmark is simulated and cannot enumerate future attacks. Next: how should a governed workflow preserve provenance and authority when retrieved content contains instructions?
Flags: simulated content and tools; defense coverage changes quickly
Record State: Catalog review recorded; not a performance endorsement
What was reviewed: Structure and relevance screened; not a full evaluation