0.00% Prompt-Injection Breaches and 92.13% Suite Solvability on Lightweight Flash Models
How compiled Turn-0 capability boundaries eliminated all 949 indirect prompt-injection attacks in AgentDojo v1.2.2 (-0.53 pp utility cost) while lifting a Flash-class terminal agent to 76.40% Pass@1 and 92.13% Pass@5 across 445 Terminal-Bench 2.0 containers.
Enterprises face two blockers when scaling autonomous agents: indirect prompt injections that hijack tool calls (email, messaging, banking, travel) and runaway compute bills from relying on heavyweight flagship reasoning models. Across 1,526 live public-benchmark evaluations on lightweight Gemini Flash inference, compiled Nomos v4.17 governance held AgentDojo v1.2.2 Attack Success Rate at 0.00% (0 of 949 attacks) at 85.04% utility under attack (-0.53 percentage points vs. benign execution), while driving Terminal-Bench 2.0 k=5 to 76.40% Pass@1 (340 of 445 trials) and 92.13% Pass@5 (82 of 89 tasks solved) with 0 API transport failures.
1. Resolving the Prompt-Injection Dilemma Without Breaking Enterprise Workflows
Every CISO asks the same question before approving autonomous email, CRM, Slack, or financial workflows: what stops a poisoned external invoice or webpage from hijacking an agent with real credentials? Conventional prompt guardrails try to lecture the language model after attacker instructions have already entered its context window, sacrificing benign completion while failing under adversarial framing.
Nomos v4.17 mints least-privilege capability sets strictly from the trusted initial operator request at Turn 0, intercepts out-of-scope tool calls at a compiled runtime boundary before execution, and isolates untrusted tool payloads inside cryptographic nonces. On all four official AgentDojo v1.2.2 suites (1,081 traces), that architecture blocked 949 of 949 attack payloads with zero crashes while losing barely half a percentage point of benign completion.
2. Frontier Terminal Reliability From Lightweight Flash Silicon Economics
Equally significant for CFOs and VPs of Engineering, the exact same compiled execution harness ran 445 live Docker containers across all 89 tasks of Terminal-Bench 2.0 (k=5) on lightweight Flash-class inference. By enforcing loop circuit breakers and deterministic recovery prompts inside each sandbox, prefix stability reached 91.20% cached prompt tokens, Pass@1 hit 76.40%, and Pass@5 solved 82 of 89 complex systems tasks.
Through a fixed-scope 14-Day AI Governance and Seam Charter Pilot ($15,000 - $25,000 USD), Gantlett Systems deploys these same Turn-0 capability boundaries, telemetry ledgers, and verification gates underneath your engineering teams existing coding and workflow agents.
1,526 Public Evaluations (AgentDojo v1.2.2 + Terminal-Bench 2.0): Ungoverned vs. Nomos v4.17
| Governance Dimension | Advisory Rulebooks + Unit Tests | Deterministic Control Layer |
|---|---|---|
| Indirect Prompt Injection (949 Poisoned Tool Runs) | Prompt spotlighting trades 20 to 40 pp of usefulness yet still leaks rogue tool actions | 0.00% Targeted ASR (0/949 breaches) at 85.04% Utility Under Attack (-0.53 pp vs. 85.57% benign) |
| Authorized Tool Competence (35 Sensitive Tasks) | Aggressive keyword blockers reject legitimate transfers, invites, and emails | 85.7% solved legitimately (100% on Slack and banking) when authorized at Turn 0 |
| Complex Terminal Engineering (445 Containers, k=5) | Published lightweight Flash CLI baseline reaches 47.4% (stock Opus 4.6 at 58.0%) | 76.40% Pass@1 (340/445) and 92.13% Pass@5 (82/89 tasks solved) with 48 deterministic 5/5 solves |
| Cache Stability & Runtime Reliability | Ad-hoc retry loops burn uncached tokens and trigger API throttling across long jobs | 91.20% cached prompt tokens across 1.58B input tokens and 0 API errors over 20h 13m |
Install Deterministic Boundaries Underneath Your Existing AI Tools
Isolate one high-friction repository seam in 14 calendar days ($15,000 to $25,000 USD fixed fee, 2 principal-led slots/month) without changing your developers IDEs or coding agents.
Inspect the 14-Day Seam Charter Pilot →Inspect the Reproducible Lab Benchmark
Forward the underlying open-core configuration reference, raw episode telemetry, and reproducible test suite from our SophiaLabs R&D division.
Field Dispatch D-13 & D-12: Terminal-Bench 2.0 k=5 (76.40% Pass@1 / 92.13% Pass@5) & AgentDojo v1.2.2 (0.00% ASR) ↗