做LLM智能体安全或SaaS集成开发的团队，终于有了一个能真实反映生产环境威胁的测试基准和可用的防护模型，建议直接看论文和开源代码。
LLM智能体通过工具调用访问第三方服务（如Gmail、Salesforce）时，面临间接提示注入攻击的威胁，但现有基准测试覆盖不足。研究者推出AgentRedBench，包含215个跨24种企业集成的微妙授权攻击场景，覆盖9个功能家族和5种攻击类型。在8个模型（Anthropic、OpenAI、Google）上，无防护的攻击成功率（ASR）从32%（Claude Sonnet 4.6）到81%（Gemini 3 Flash）不等。同时发布AgentRedGuard防护模型，在集成多样化的对抗性工具响应内容上训练，将ASR从69.9%降至2.4%，误报率仅0.37%，显著优于所有开源基线。该工作为智能体安全提供了更真实的评估基准和有效防御方案。
AgentRedBench: Dynamic Redteaming and Integration-Aware Defense for LLM Agents over SaaS Integrations
Indirect prompt injection in tool-use agents is a concrete production threat: LLM agents read from integrations (third-party services such as Gmail, Salesforce, or Jira accessed through tool calls) whose response content the user neither writes nor controls. Existing benchmarks under-measure the threat: most cover only a handful of integrations with the same attack payload replayed across runs, and open-source guards are trained on chat-style data rather than tool-response content. We introduce AGENTREDBENCH, a dynamic LLM-driven redteaming benchmark of 215 subtle underspecified authorization (attacks at the boundary of what the user's request authorises) scenarios across 24 enterprise integrations in nine functional families and five attack types. Across an eight-model panel (Anthropic, OpenAI, Google), no-guard ASR (attack success rate) ranges from 32% (Claude Sonnet 4.6) to 81% (Gemini 3 Flash). To keep the scenario set out of training corpora and preserve headline ASR meaning over time, we release the codebase, integration schemas, and AGENTREDGUARD model openly; the canonical scenarios are evaluated through a maintainer-mediated channel with immutable versioning. We release AGENTREDGUARD alongside the benchmark: a guard trained on an integration-diverse corpus of adversarial tool-response content. AGENTREDGUARD cuts panel ASR from 69.9% to 2.4% at 0.37% false-positive rate, outperforming every open-source baseline with non-trivial detection (Llama Guard, PromptGuard 2, ProtectAI) on both axes. Cross-integration and cross-attack type holdouts both confirm the gain transfers beyond the training subset.