The problem
What needs solving
Build AI agents that can read web pages, emails and documents without being taken over by instructions hidden in them. The protection must hold against attackers who keep adapting, and still leave the agent useful.
Why it matters
An AI agent that reads the web while holding your files and accounts can be turned against you by one planted sentence. In a public contest reported in March 2026, 464 people made 272,000 attempts to hijack 13 leading AI models working as agents. Between 0.5% and 8.5% of attempts worked, and every model was fooled at least once. In 2025, researchers from OpenAI, Anthropic, Google DeepMind and others beat 12 published defences, most of them more than 90% of the time. Britain’s National Cyber Security Centre warns that such attacks may never be fully stopped.
What counts as progress
(a) In a public contest repeated for each new release, attackers who study the defence make 200 or more attempts per scenario, and none succeeds. The agent still does at least 90% of the work it does undefended. (b) A design that protects by its structure, not the AI’s judgement, loses at most 10 points of success on AgentDojo, a public test of agents under attack, or its successor, as a second lab confirms. (c) Solved when a widely used agent with such protection survives a year of public bug bounties, cash rewards for finding flaws, and independent judges find no case of hidden text steering it or leaking data.
Stater & version history
Stated by UNSOLVED editors
18 Oct 2026 — Stated by the UNSOLVED editors for the founding registry, from the research of October 2026.