Archestra's OpenAPPA Blocks All Prompt-Injection Attacks in Two Enterprise Security Benchmarks

Archestra has released OpenAPPA, an open-source security engine built to stop AI agents from leaking sensitive data when they are manipulated by prompt injection or simply invent a plausible-looking action on their own. The company says the engine recorded zero successful attacks across two public benchmarks, a result it is presenting as a direct challenge to the guardrails shipped by larger vendors. InfoQ's Bruno Couriol reported the release.

The two tests measure different failure modes. Bench-Corp runs 20 multi-step enterprise workflows, the kind of chained tool calls an agent might execute across email, file storage and internal APIs, and checks whether an attacker can steer it into exfiltrating data along the way. AgentThreatBench focuses on adversarial inputs aimed at the agent itself. On both, OpenAPPA posted a 0% attack success rate, according to Archestra's numbers.

The comparison figures are the sharper part of the claim. Microsoft's FIDES allowed 31% of attacks through, and Claude Code's auto mode let 10% succeed. That gap matters because FIDES is a research-grade defense and Claude Code is a shipping product used by developers daily, so both represent what practitioners currently treat as reasonable protection. A 31% failure rate on multi-step workflows implies roughly one in three attempts gets through, which is not a rounding error for a company handling customer records or source code.

Archestra's pitch is architectural rather than model-based. Rather than asking the model to refuse malicious instructions, OpenAPPA sits between the agent and the tools it calls, inspecting and constraining what actions are permitted to reach the outside world. That distinction is why the project is being released as open source: the team is betting that security teams will want to audit the enforcement layer themselves rather than trust a vendor's classifier.

Benchmark results from a vendor's own testing deserve scrutiny. The headline 0% figure depends on how the attack suites were configured, how many runs each scenario was repeated, and whether the defenses were tuned against those specific benchmarks. Independent replication on a fresh workflow set would be the real test, and until that happens the FIDES and Claude Code numbers are the only externally comparable data points in the comparison.

What to watch next is whether Archestra publishes the harness and raw logs so others can rerun Bench-Corp and AgentThreatBench against OpenAPPA and against the alternatives. If the 0% holds up outside the originating lab, it shifts the conversation from prompt-level defenses to enforcement at the tool boundary, and puts pressure on vendors whose agents still fail one attempt in ten.

The open question is what happens when attackers adapt. Both benchmarks contain a fixed set of scenarios, and a defense that scores perfectly on a known suite can still miss a novel chain. Archestra has not said how often it plans to refresh the test set, which is the number that will determine whether OpenAPPA's result ages well.