Developer builds eval harness to measure prompt-injection defenses in LLM agent

A software developer created a LangGraph-based travel concierge agent and deliberately tested it against five categories of prompt-injection attacks, including RAG data poisoning and system-prompt leakage. To move beyond gut-feel assessments, they built a structured evaluation harness consisting of 35 prompts — 25 attack scenarios and 10 benign controls — paired with a two-layer judging system. The judge combines deterministic counters, such as checking whether a malicious email was actually sent, with a fallback LLM judge for attack classes that leave no direct tool trace. Results are persisted after every sample so that rate-limit interruptions on Groq's free-tier API do not force a full restart, and all runs use fixed temperature and seed for direct comparability. The exercise revealed that quantifying both attack success rates and false positives is essential, since a defense that blocks all attacks but disrupts legitimate use renders the product unusable.