The hype train for AgentDojo benchmarking just derailed. A security audit of the Warden flow guard, published on October 18, 2026, reveals that while the tool achieved zero successful attacks in controlled replays, it suffered from seven distinct bypass vulnerabilities. The audit, conducted by the developer alexar76, demonstrates that static detection is a fragile shield against prompt injection, necessitating dynamic checks at tool-call boundaries to truly secure Model Context Protocol (MCP) implementations.

The Illusion of Perfect Defense

Prior to the audit, Warden’s implementation through commit 2328be980 showed impressive results on the AgentDojo benchmark. In replay tests across banking, Slack, travel, and workspace suites, the guard blocked 584 attack actions that succeeded 593 times in unprotected runs. However, the audit clarified that these metrics are historical. The new findings indicate that the initial code could be tricked by shell variables hiding policy writes, trusted URLs authorizing unrelated recipients, and local files manufacturing fake contacts. These weren't just theoretical edge cases; they were active vulnerabilities in the codebase that allowed injections to slip through the cracks.

Real-Model Testing Exposes Nuance

Moving beyond deterministic replays, the team ran DeepSeek V4.1 Flash through the benchmark, costing $12.68 for 21,654 runs. The results were counter-intuitive: the model largely ignored AgentDojo's standard attacks, achieving zero successes even without the guard in most scenarios. When the model was explicitly 'hijacked' to treat injected messages as user instructions, it succeeded in 42 attack actions without protection. The hardened guard reduced this to zero, but at a significant cost to utility. The guarded agent finished only 51 of 97 user tasks, compared to 90 without the guard, with Slack tasks being particularly penalized due to frequent 'ask' interruptions.

Comparison with CaMeL and Future Releases

The audit draws a sharp distinction between Warden and Google DeepMind’s CaMeL. While CaMeL also reports zero successful attacks on AgentDojo, it utilizes a stronger design with a planner model that never sees tool output and a per-value capability system. Warden, by contrast, uses coarser tool and destination checks. The team explicitly notes that their security claims are not interchangeable with CaMeL’s. The fixes for the seven bypasses are currently unreleased source changes intended for version 0.17.0, while the checked-in package still identifies as 0.16.0. Developers are advised that the new flow-hook code is bundled locally and not yet published to npm.

Key Takeaways

  • Seven specific bypasses, including shell variable manipulation and URL authority errors, were found and fixed in the Warden MCP guard.
  • Historical AgentDojo benchmarks showing zero successful attacks are now considered pre-audit metrics and do not guarantee security for the hardened code.
  • Running the guard with DeepSeek V4.1 Flash reduced task completion rates from 90/97 to 51/97, highlighting a severe usability trade-off.
  • The updated security fixes are pending release in version 0.17.0, not currently available in the standard npm package.

The Bottom Line

Zero-day security in LLM agents is a marketing myth. If your MCP guard relies on static patterns, you are already compromised.