NUWA Evidence record
DeepSeek R1-0528
AgentDojo · Evidence record
Source snapshot, chart and review scope →
Original source charts and materials
Recorded measurements
- Hijacking attempted-task frequency
- 37%
Per-result sample size not disclosed
Harness not specified · Budget not specified
Assessment provenance
Evaluation of DeepSeek AI Models → · External report
Actual evaluation: NIST / CAISI · Model record →
Method and scope
Targeted attack success and user-task utility in a tool-use environment.
- Evidence type
- Benchmark
- Assessment subject
- Defender agent under injected tool output
- Primary dimension
- Behavior
- Evidence snapshot
- 2026-10-29.1
Primary dimension follows the source’s measured construct. Metric-level interpretations may differ.
Source finding
Hijacking attempted-task frequency: 37 percent. Conditions are retained from the source.
Limitations
Attack success must be read alongside benign utility and the tested attack setup.
Counts attempted action even if unsuccessful; not whole malicious-task success. Excludes trajectories that did not encounter injection; denominator not disclosed by cell. 30 benign tasks, five samples per task per injection; not an adaptive attack/red-team study.
Related research questions
Cybersecurity / Agent compromise through untrusted input →
The source directly measures the stated construct under its protocol.
References
- [1] Edoardo Debenedetti, Jie Zhang, et al.. AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents. 2024-11-24. v3 ; Author affiliations on the original paper title page
- [2] Evaluation of DeepSeek AI Models. 2025-09-30. 30 September 2025 ; p. 17, key findings, Credential exfiltration