Project summary

Agents act in the world through tools: they read web pages, emails, files, calendars and API responses, then take actions with real consequences. Any of that content can contain text aimed at the agent, and sometimes the model treats it as a command (prompt injection). Everyone knows this failure exists, but there is no cheap, reproducible, developer-facing way to measure how badly a given agent setup suffers from it or which mitigations actually help. Academic benchmarks assume a lab; the small teams deploying most real agents have nothing.

What I will build

An open benchmark of about 60 agent tasks across four families I have shipped in production (email triage, web research, calendar booking, code review). Each task has a benign goal plus a tool result containing a planted request with a measurable side effect (forward a thread to an outside address, move a meeting). Success is scored automatically from logged tool calls, never from model self-report. The harness runs any model through a plain function-calling loop and compares five conditions: no defense; instruction/data separation in the system prompt; strict structured schemas around untrusted text; a small monitor model that reviews each proposed tool call against the original task and can veto it; and all three combined. Output per task family: attack-success rate, benign task completion, and monitor false-veto rate, with bootstrap confidence intervals over 5 seeds. Everything ships MIT on GitHub: benchmark, harness, raw logs, monitor checkpoint, and a written report, run on both hosted frontier models and open-weight models.

Why it matters for AI safety

Prompt injection is the concrete mechanism by which an agent with real permissions can be turned against its principal by anyone who can get text in front of it, and the risk scales with capability and autonomy. This project makes the failure measurable and cheap to test for, which is the precondition for the field converging on safe defaults. The monitor-model condition doubles as a cheap public testbed for trusted-weaker-model-supervises-untrusted-stronger-model setups, a small-scale version of the AI-control question of what oversight costs.

Budget

Minimum $2,500: $1,500 hosted-model API credits for roughly 3,000-4,000 agent runs; $800 GPU time for open-weight sweeps and monitor fine-tuning; $200 infrastructure. Up to $15,000 adds a living stipend so I can work on this full time for four months instead of between contracts (12,000) and a larger open-model sweep (500).

Track record

I build the exact systems the benchmark targets: devswarm (open-source parallel multi-agent coding swarm with human approval gates), mcpforge (three MCP servers plus a live protocol inspector that logs tool traffic), ai-caller (a voice agent that books real appointments with Google Calendar tool use), essaymentor-ai (7-agent LangGraph system with an evaluation directory), plus a paid trust-boundary security audit of a production system. Harvard B.A. in Computer Science (2022); two years teaching CS at Milton Academy; senior full-stack engineer; founder of KairosLearn, an AI SaaS built solo. Code: github.com/bilalhussainx. Portfolio: bilalhussain.dev.

Timeline

Months 1-2 benchmark and harness (task list and scoring hooks already started), months 3-4 sweeps across models and conditions, months 5-6 analysis, public write-up, and a workshop submission if results warrant. Applications for compute credits are also in with the OpenAI Researcher Access Program, Google TPU Research Cloud, and BlueDot Rapid Grants; any credits that land reduce the compute line here.