Procurement Rubric for Scoring Indirect Prompt Injection Detection Across Plugins Connectors and Retrieved Documents

Indirect prompt injection detection in enterprise RAG pipelines needs more than a filter on user prompts. A procurement rubric should score inspection of retrieved content, tool-response coverage, runtime enforcement, deployment fit, and benchmark evidence separately, with priorities set by the integration surface. The strongest protection combines detection with controls that limit what an agent can do when detection fails.

Why indirect prompt injection is a procurement problem, not just a research one

An LLM processes instructions and outside data in the same natural-language context, without reliably enforcing a boundary between them. An email, customer review, or retrieved document can then serve as an instruction channel. This is a design property that follows the model into the products an enterprise buys, making assessment a responsibility for procurement, InfoSec, and third-party risk management teams.

Aim Security disclosed EchoLeak in June 2025, showing how that weakness could become a production exploit. The zero-click vulnerability in Microsoft 365 Copilot let a remote attacker steal confidential data just by sending an email, without the user doing anything. Microsoft assigned CVE-2025-32711, with a CVSS score of 9.3, and issued emergency patches. The patches addressed only the specific exploit chain.

Other attacks reached different enterprise workflows. CurXecute, CVE-2025-54135 with a CVSS score of 9.8, used a GitHub README to achieve arbitrary code execution on developer machines through Cursor IDE. In 2025, an injection in the description of a Jira task caused a silent memory wipe in Google Gemini Enterprise and earned a $15,000 Google AI VRP bounty. A generic security checklist cannot distinguish the integration surfaces involved or the defenses suited to each, so it is structurally unequipped to support an honest comparison.

The three integration surfaces that define the rubric's scope

Plugins and connectors expose both message-integrity risks and third-party content risks. Research accepted to IEEE S&P 2026 found that 8 of the 17 chatbot plugins studied, which ran on 8,000 websites, sent message history without integrity checks. That made it possible to forge high-privilege roles in network requests. The same study found that most plugins supported scraping for RAG knowledge bases but ingested first-party product descriptions and third-party customer reviews indiscriminately. Roughly one in eight randomly selected e-commerce sites in the study had already exposed its chatbot to third-party content.

MCP servers create a different permission problem. The original MCP 1.0 specification required neither mandatory authentication for server connections nor granular, per-operation permission scoping. This assessment should look at tool poisoning, rug-pull attacks, and cross-agent privilege escalation on their own, apart from the general question about malicious text. Procurement must also consider what the connected agent is permitted to execute.

Retrieved documents can bring attacks in through the knowledge base itself. PoisonedRAG research showed that even in a large collection, a small amount of poisoned content could change the outputs. Document-by-document detection has limited effectiveness when it depends on explicit instructions, because RAG attacks can disguise or imply their direction. IterInject research from Shanghai Jiao Tong University and HKU further showed that feedback-guided payload optimization substantially outperformed static baselines across multiple victim models on AgentDojo and InjectAgent.

These distinctions change what a vendor’s “yes” means. A detector may inspect user prompts but never examine retrieved chunks, or inspect documents without covering MCP tool responses. Even complete inspection does not establish enforcement.

Why classifiers alone cannot be the whole answer

Classifier performance is useful evidence, but not a containment guarantee. Researchers tested 12 published defenses and bypassed most with greater than 90% success. EchoLeak also bypassed Microsoft’s own Cross Prompt Injection Attempt classifier, known as XPIA.

IterInject substantially outperformed static payloads across four victim models, and optimized payloads achieved full success on 5 of 9 targets in Claude Code despite layered defenses. What does a high score on static examples show when attacks can adapt this way? It demonstrates performance on that test, leaving resistance to an attacker who learns from failure unproven.

Model-level alignment does not close the gap either. Probabilistic defenses need a containment layer behind them so that an incorrect verdict does not grant unrestricted action. Logging alone cannot provide that boundary. A risk score written after an agent acts records the failure.

Google DeepMind’s CaMeL framework offers an architectural contrast. It uses a custom Python interpreter to track the origin of data and instructions, enforcing capability-based security policies when tools are called without modifying the LLM. Its limitation is operational rather than incidental, because users must define those policies. Classifiers are easier to deploy but bypassable, while architectural separation is harder to operate and can provide formal guarantees. The rubric’s most important differentiator is therefore enforcement, scored separately from detection accuracy.

The five scored rubric dimensions and how to weight them by surface

Teams can score each dimension from 0–3, with zero for undocumented or absent capability, one for limited coverage, two for documented coverage with gaps, and three for demonstrated coverage of the deployment’s requirements. An unknown earns no procurement credit. Deployment fit first acts as a pass-or-fail gate, after which its score distinguishes acceptable options. The weight of each dimension should then depend on the surface being assessed.

Retrieval-layer detection takes the highest weight for RAG pipelines, followed by enforcement. Does inspection happen at chunk level before context assembly, or only on the assembled prompt? Can it identify implicit injections without recognizable command syntax? PoisonedRAG achieved a 90% success rate manipulating outputs by injecting five malicious texts into a million-entry knowledge base. Chunk-level inspection deserves a higher score than full-context classification because it can assess retrieved material before that material competes with legitimate instructions.

Tool-output and connector-response coverage takes the highest weight for plugins and MCP servers. Scoring depends on whether the tool inspects fetched content before it reaches the agent in addition to messages submitted by the user. EchoLeak entered through email content fetched into Copilot’s context. Vendors get zero for this dimension unless their documentation clearly states that they perform tool-response inspection.

Enforcement receives high weight across every surface. Can the product block, reduce permissions, revoke specific tool access, or terminate a session? A log-only detector scores zero here, even if its detection score is strong. The highest score requires multiple enforcement actions with configurable thresholds. This distinguishes a product that reports suspicious content from one that can contain its consequences.

Deployment boundary fit cannot be averaged away. A managed detection API that sends prompt content outside the enterprise boundary fails the gate where sovereign, on-prem, or air-gapped requirements prohibit that transfer. Among eligible products, scoring should reflect fully self-hosted availability, on-prem support, air-gapped operation, and feature parity with the managed service. For plugins and MCP servers, this remains a high priority after tool-output coverage and enforcement. The same gate applies to RAG deployments.

Benchmark methodology validates the other scores. AgentDojo measures attack success rate, benign utility, and utility under attack for agents that use tools. Microsoft Research’s BIPIA covers indirect-injection attack success across code, email, QA, abstract, and table tasks. Vendors should say whether their tests use adaptive payloads and report over-defense on benign content. Reproducible or third-party evidence earns more credit than an accuracy claim from an undisclosed test set.

For procurement justification, the rubric can be mapped to governance frameworks without making compliance a sixth detection dimension. Relevant mappings include OWASP Top 10 for LLM Applications 2026 LLM01, published August 2026, NIST AI RMF, NIST AI 600-1, and MITRE ATLAS AML.T0051.001. CSA AI Controls Matrix v1.1, released June 22, 2026, has 247 control objectives. These mappings support discussion with Legal, Privacy, and compliance stakeholders, but do not substitute for capability evidence.

How current detection tools score against the rubric

Azure Prompt Shields, part of Microsoft Azure AI Content Safety, evaluates the full message payload for jailbreak and indirect-injection patterns. That earns context-level detection credit, but not the highest retrieval score reserved for demonstrated chunk-level and implicit-injection coverage. EchoLeak bypassed the underlying XPIA classifier. Its standalone API returns a classification verdict and needs the application to supply enforcement logic, while its integration with Azure AI Foundry content filters has native blocking. Its cloud-hosted design fails a boundary gate that prohibits external prompt processing.

Meta Llama Prompt Guard 2 is available in two parameter-scale variants. Neither parameter scale nor the product name establishes retrieval inspection, tool-response coverage, enforcement, deployment fit, or benchmark performance. Those dimensions stay unscored until documentation is available, so they get no credit when procurement teams compare products. The available evidence leaves the presence of those capabilities unresolved.

Check Point AI Guardrails, formerly Lakera Guard and acquired October 2025, offers managed SaaS and self-hosted runtime protection. It targets prompt injection, jailbreaks, PII, data leakage, content violations, and agent behavior, providing evidence of broad protection scope. Its self-hosted option supports deployment-fit assessment. However, the documented scope does not establish chunk-level handling of implicit attacks or the full set of enforcement actions in this rubric. SOC 2 Type II certification supports compliance assessment.

CaMeL scores strongly on enforcement at the tool-call boundary and on the architectural handling of untrusted data. Its research reports 77% of tasks achieved with provable security on AgentDojo, compared with an undefended system, providing the strongest formal security evidence among these options. Yet its user-defined policies cost enterprises money to run, and it is a research framework that has yet to ship as a product with documentation for enterprise deployment support.

LLM Guard from Protect AI is permissively licensed and self-hosted, but its repository was archived July 9, 2026. It is no longer actively maintained. Procurement should exclude it from scoring as a current production security option.

Mintive Guardrails, formerly MintMCP, documents a clearer path from detection to action. Mint Guard provides centrally maintained detection for prompt injection, credentials, secrets, PII, and harmful content, with Off, Monitoring, and Enforcing modes and high-confidence blocking. Gateway Middleware supports integration templates for multiple connector types, contributing tool-output coverage evidence. These capabilities support enforcement credit, but do not establish every action needed for the highest score. SSO, SCIM, and SIEM export support operational governance, while its SOC 2 Type II audit and HIPAA compliance with a BAA available do not, by themselves, establish benchmark performance.

The comparison produces no universal maximum scorer. Context classification, self-hosted deployment, formal enforcement, and operational integration each have their own strengths. A defensible shortlist preserves those differences instead of compressing them into an unsupported claim of overall accuracy.

Turning the rubric into a vendor questionnaire and continuous monitoring program

The questionnaire should retain the rubric’s distinctions. For retrieval, it should ask where inspection occurs and how implicit payloads are handled. For connectors, it should ask which returned content, connector types, and MCP configurations are covered. Enforcement questions should request supported actions and whether they can be configured per surface or connector. Deployment questions should ask whether prompt content stays inside the enterprise boundary and whether the self-hosted option has the same features as the managed service.

Benchmark questions then test the evidence behind those answers. Which published benchmarks support the accuracy claim, including AgentDojo, BIPIA, or InjecGuard/NotInject? Were the payloads adaptive or static, and what was the over-defense rate on benign content? The answers should remain attached to the relevant scores. Otherwise, a broad claim about performance can pass for evidence that an untested integration path works.

After deployment, the same criteria need reassessment. The monitoring cadence should include major vendor updates, new integration surfaces, and new CVEs or published attack techniques that target the vendor’s architecture. Teams should also check whether the repository is still maintained. An initial assessment would not protect a team from continuing to depend on a project after its archival.

Dedicated AI risk intelligence platforms fit here as a source of change signals across vendor ecosystems. They can surface new capabilities, emerging injection techniques, and integration changes that generic TPRM workflows are not designed to track. The rubric gives procurement, InfoSec, Privacy, and Legal teams a shared way to judge what those signals mean. Assessment and monitoring are two halves of the same program, because a procurement score without reassessment is only a point-in-time snapshot of a changing attack surface.