Near Miss: injection tests for answers that stay on task but come out wrong

Indirect prompt injection testing is already a busy space. Promptfoo and garak ship open-source plugins and probes, AgentDojo and OpenRAG-Soc are academic benchmarks, and Repello sells an enterprise platform. That leaves the plain promptfoo-plugin idea in a weak spot: promptfoo already has an indirect-prompt-injection plugin that runs against RAG context, and it could add a near-miss payload style cheaply. What I found is generally framed around catching the model obeying an attacker: going off-task, leaking data, running a payload. AgentDojo's banking tasks, like changing a payment recipient, are the closest prior art, but they live in a fixed benchmark. I did not see a product that takes a team's own documents, plants a believable change that serves the task (a different number, vendor or date), runs the real pipeline, and reports field-level differences from a clean baseline run. That integrity angle is where a new entrant could still win. The finance pack is the strongest wedge, because invoice and bank-detail fraud through hidden text is a well-understood threat that buyers already worry about, and field-level scoring of invoices and statements is concrete and easy to sell to bookkeeping-automation builders. The risks are that promptfoo or garak copy the payload style, and that small teams may not pay for a test pack. Shipping it as a CI-friendly diff harness with a curated, regularly refreshed domain attack corpus, with the promptfoo integration as a way in rather than the product, is the most defensible route.

• Promptfoo indirect-prompt-injection and RAG red-team plugins

  The most direct overlap, especially with your plugin idea. It puts payloads into a named untrusted variable (RAG context, document, email) and fails the test if the model follows them. Its RAG guide adds document-exfiltration testing. The examples I found judge whether the model obeyed the payload. I saw nothing that diffs field-level output against a clean run on the user's own corpus.

• NVIDIA garak latentinjection probes

  An open-source scanner with probes that hide injections inside context, including fact-snippet probes whose stated goal is to subvert a snippet with instructions. It is model-level and template-driven. It does not plant attacks in a team's own documents or diff outputs.

• AgentDojo

  An academic benchmark whose banking suite includes near-miss-style injection tasks, such as changing the recipient of a recurring payment or sending to an attacker's IBAN. It shows the attack class is known. It is a fixed environment, though, not a tool you run against your own pipeline.

• OpenRAG-Soc (Hidden-in-Plain-Text benchmark)

  A 2026 benchmark and harness for indirect injection and retrieval poisoning in web-facing RAG. It measures attack success at answer time. It is a research artefact, not a product.

• Rag 'n Roll

  A research framework for testing indirect manipulation end to end across RAG setups. It finds that most existing attacks are tuned to push malicious documents up the retrieval ranking.

• Repello AI ARTEMIS

  A commercial red-teaming platform. By its own account it covers document injection, retrieval manipulation and indirect injection through retrieved content in RAG deployments. Aimed at enterprises.

• IPI-proxy

  An open-source intercepting proxy from May 2026. It rewrites web responses to plant 820 known injection strings when red-teaming browsing agents. It covers the web rather than a team's own documents, and it uses generic payloads.

• Gray Swan Arena IPI competition

  A crowdsourced indirect-injection red-teaming competition relaunched in October 2026 with backing from frontier labs. It signals strong interest and produces attack data, but it is not a test pack you run in your own CI.

• VexRAG

  A research framework on PyPI that plants poisoned passages directly into a RAG retrieval index.

Checked 2026-10-26