I benchmarked 10 open-source prompt-injection detectors; the best caught just 51%
rudra-sh · reddit · 2026-09-26
An engineer ran 629 realistic prompt-injection attacks (plus clean samples) through 10 open-source injection detectors and got sobering numbers:
- The best detector caught only 51% of attacks at a 2% false-positive rate; a few that "caught everything" also flagged 98% of normal traffic, making them unusable.
- Missed attacks look like ordinary sentences — e.g. "send payment to <account>" is only malicious because the account came from a document, not the user. Nothing in the wording to flag.
- One detector looked broken because of a miscalibrated default threshold; after retuning it caught 99%. Much "this detector is bad" is really "nobody calibrated it."
The author's takeaway: detection is a signal, not a boundary — gate the dangerous actions (allowlists, human approval, provenance checks) rather than just scanning text. The post ends by asking what defenses people actually run in production.
More from coding & agent
- Sydney Codex Community Buildathon set for Nov 14 with Cerebras-backed ultrafast compute track — paw_lean · 2026-11-11
- shadcn's improve hits 10k stars: let top models plan, cheap models execute code fixes — shadcn · 2026-11-11
- OpenAI open-sources Codex Security CLI and SDK for AI-driven vulnerability scanning and fixing — openai · 2026-11-11
- Claude Opus 5.5 runs an architecture search and finds AttnRes-Canon, a new top Transformer design — SonglinYang4 · 2026-11-11
- 5 research habits worth knowing: read papers backwards, reproduce first, wire coding agents via MCP — cneuralnetwork · 2026-11-11
- 'Adam can now do CAE': AI agent showcase in engineering simulation draws buzz — burhop · 2026-11-11