ContainmentBench: Trace-Based Evaluation of Post-Injection Containment in Tool-Using LLM Agents

Abstract

Tool-using LLM agents process untrusted content, maintain memory, delegate across agents, and invoke side-effecting tools. Existing prompt-injection evaluations typically summarize security with terminal attack or policy outcomes, but equal endpoints can conceal different post-exposure traces and different losses of authorized utility. We introduce ContainmentBench, a sandboxed, trace-based benchmark that separately measures benchmark-defined endpoint policy compliance, instrumented logged propa

Categories

Framework mappings

Suggested from the entry's categories.

@misc{lan2026containmentbench,
  title = {{ContainmentBench: Trace-Based Evaluation of Post-Injection Containment in Tool-Using LLM Agents}},
  author = {Wenhao Lan and Shan Li and Xinhua Lai and Meiqi Wu and Junbin Yang and Haihua Shen},
  year = {2026},
  month = jul,
  eprint = {2607.23999},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.23999}
}