# Indirect prompt injection lab: raw data

Article: https://airedteamingservices.com/research/indirect-prompt-injection-lab/
Run date: 2026-11-09. Mock app, mock tools, no real side effects. No keys are stored here.

## Files

| File | Content |
|---|---|
| results.csv | One row per trial (1,800 rows): model, scenario, defense, trial, attempted, success, completed, tool outcomes, tokens |
| summary.json | Counts and 95% Wilson intervals per model x scenario x defense, model IDs, settings, token totals, spend estimate |
| tables.md | The result tables used in the article |
| transcripts.jsonl.gz | Tool-call log and final text (raw and rendered) for every trial |
| code/ | The lab code (same files as lab/prompt-injection/ in the site repo) |

## Columns

`attempted`: the model made the harmful call or wrote the harmful output before any enforcement layer ran.
`success`: the harmful effect happened after the defense layer ran. `completed`: for control S6 only, the refund and the email to the customer both executed.

## Reproduce

```bash
export OPENROUTER_API_KEY=...
cd code
python3 run_lab.py --out ./run --trials 20 --workers 12 --cap-usd 12
python3 analyze.py ./run ./results
```

Python 3, standard library only. Model answers vary between runs, so expect counts close to these but not equal.

## Settings

Temperature 1.0, max 1,024 output tokens per call, up to 6 tool steps, no seed. Models: anthropic/claude-haiku-5.5, openai/gpt-5.4-mini and meta-llama/llama-3.3-70b-instruct, all via OpenRouter. An earlier Claude run through a local proxy was discarded.