- Category
- Cybersecurity
- Rank
- No. 953Tools index
Previous survey · No. 942 ·
- Pricing
- Open Source
- Type
- TOOL
- Builder
- google-research
- GitHub
- 385 stars
- Date
About
Reference implementation of CaMeL, a design-time defense system against LLM prompt injection attacks.
What it does
CaMeL asks a privileged model to produce restricted Python code for tool-based tasks. Its interpreter wraps values with source, reader, and dependency metadata. Policy checks then decide whether tool actions may use those values, while a quarantined model converts unstructured data into typed results.
Why it's ranked here
The project exposes a concrete security architecture, not merely a prompt template. It combines constrained execution, data-flow tracking, policy enforcement, and AgentDojo evaluation across several task suites. However, its authors explicitly describe it as an unsupported research artifact that may crash or remain insecure.
What's good
The implementation makes trust decisions inspectable. Wrapped values retain metadata and dependency chains, policies default to denial when nothing matches, and state-changing tools can be blocked when they depend on private values. The benchmark runner can compare CaMeL, original tool calling, AgentDojo defenses, attacks, and policy replays.
Tradeoffs
The authors warn that the interpreter likely contains bugs, may throw uncaught exceptions, and might not be fully secure. Running it also requires external model API keys and provider dependencies. Model support uses explicit provider branches and maintained model-name lists rather than a provider-neutral discovery layer.
How to use it well
Use CaMeL to reproduce the paper, inspect design-time prompt-injection defenses, or benchmark policy-aware agents in AgentDojo. It best suits security researchers and engineers prototyping controlled tool execution. It does not cover the adjacent need for a maintained, supported, production-ready agent security product.
Technical notes+
main.py uses Cyclopts to run AgentDojo suites with or without injections and reports aggregate utility and security results. src/camel/models.py constructs Google, OpenAI, or Anthropic pipelines, selecting original tool calling, CaMeL execution, or policy replay. src/camel/interpreter/value.py wraps Python values with capabilities and dependency chains. src/camel/capabilities/utils.py recursively derives readers and sources. src/camel/security_policy.py allows no-side-effect tools, rejects state-changing calls that depend on non-public values, and defaults to denial when no policy matches. src/camel/quarantined_llm.py uses Pydantic AI schemas and an explicit insufficient-information signal for structured extraction. src/camel/system_prompt_generator.py renders tool signatures and Pydantic or enum definitions into the code-generation prompt.
Observed
- License
- Apache License 2.0 headers appear in the supplied source files.
- Primary language
- Python
- Python requirement
- Python 3.10 or newer
- Packaging
- Hatchling build backend with project metadata in pyproject.toml
- Install and run surface
- Dependencies are managed with uv; the documented entry point runs main.py through uv.
- Interface
- Command-line benchmark runner plus importable Python modules
- Model providers
- Google, OpenAI, and Anthropic client integrations
- Evaluation surface
- AgentDojo workspace, banking, travel, and Slack suites
Read from README.md, pyproject.toml, main.py, src/camel/models.py, src/camel/__init__.py, src/camel/chat_turn.py, src/camel/custom_yaml.py, src/camel/count_tokens.py, src/camel/quarantined_llm.py, src/camel/security_policy.py, src/camel/conditional_cache.py, src/camel/system_prompt_generator.py, src/camel/interpreter/value.py, src/camel/capabilities/utils.py, src/camel/interpreter/result.py.
What it can do
Detect prompt injection attacks in LLM inputs
Text prompts or queries → Attack detection results
Analyze prompt structure for malicious patterns
User prompts → Security analysis report
Filter potentially harmful prompts before LLM processing
Raw user prompts → Sanitized or blocked prompts
Implement design-time defense mechanisms
LLM application configuration → Protected application with defense layers
Classify prompt injection attack types
Suspicious prompts → Attack classification labels
Tags
Tech Stack
Comments (0)
No comments yet
Editorially curated, with community endorsements as a secondary signal. Corrections welcome.