
Ajar: Measuring Open Privilege in Agent Defenses
Ajar replaces the two-axis evaluation of agent defenses (attack success and benign utility) with a third axis that directly measures privilege left open, by injecting unneeded candidate tool calls into existing benchmarks such as AgentDojo. It costs benchmark instrumentation per task and additional evaluation runs on top of the benchmark the team already uses, plus engineering to generate valid-but-unnecessary tool calls from tool schemas and reference solutions. It can fail if the generated candidate calls do not reflect realistic privilege escalation in the team's actual tool surface, or if a defense appears tight only because it over-refuses legitimate calls, a trade-off the metric exposes but does not resolve.








































