OpenRouter tests Armor against prompt-injection attacks
OpenRouter evaluated 25 prompt-injection attacks against four models using a document-summarizing assistant, comparing configurations with defenses enabled and disabled. Its Armor tool-call filter reduced successful attack emails from 73 of 1,440 attempts to zero, while labeling documents as data alone left 13 of 720 attempts successful. Armor allowed nearly every explicitly requested email but blocked one legitimate request because the user had not named the recipient address.
OpenRouter’s results indicate that application-level rules for tool calls can prevent indirect prompt injection from causing tool-enabled agents to take unwanted actions, although the vendor-published evaluation included a false positive.
How to Prevent Prompt Injection: 13 Attacks, Tested
OpenRouter ·10/29/2026
If your app has a model read documents, emails or web pages, anyone who can write in those can try to give the model instructions. That is prompt injection. The worst case is an agent that uses its tools because a document told it to, for example by sending your data to an outside address.
To prevent prompt injection, mark untrusted content as data, limit which models and how much spend a key can reach, and check every tool call against rules the model can’t change. We ran 13 attacks from our own set plus 12 written by other models against four current models, with each defense on and off. With Armor checking tool calls, attack emails went from 73 of 1,440 attempts to 0. Armor let through almost every email a user asked for. The exception was a user approving a request in the document without naming the address.
#OpenRouter#OpenRouter Armor#Claude Haiku 5.5#GPT-6 Luna#DeepSeek V4.1 Flash#GLM 5.3 Flash#DocBot