Two studies from July 19 reveal the conditions that make it dangerous for an agent to read external content. The RadLE 2.0 benchmark from CRASH Lab at Ashoka University tested 16 models on 200 radiology cases: the models fail with total confidence and don’t know when to stop. Human radiologists scored 988.7 points out of 2,000; the best model scored 758. Separately, Epoch AI demonstrated that AI text detectors fail when the model imitates the style of a real author: up to 48% of passages generated in academic settings go undetected.

Why should you care? An agent reading a PDF, email, or webpage doesn’t check what’s inside. If that content hides instructions (the technique we call indirect prompt injection), the agent executes them. The two studies show two conditions that make this attack hard to stop. First: models don’t know how to say “I don’t know” even when they’re wrong, so they don’t stop at unusual input. Second: manipulated content is statistically indistinguishable from legitimate content, so no detector catches it.

If your agent works on documents you didn’t write yourself, you must assume that part of that content could be hostile. The playbook on how to defend against prompt injection starts from real cases.

In detail

RadLE 2.0: models don’t know what they don’t know.

The CRASH Lab at Ashoka University released the second version of “Radiology’s Last Exam”, a benchmark that measures three things together: diagnostic accuracy, the model’s safety level, and its ability to admit uncertainty. The test covers 200 cases across 16 models, compared against a panel of radiologists.

The scoring system is the heart of the method. Answering correctly with high confidence earns full points. Answering incorrectly with high confidence loses points. Saying “I don’t know” gives zero but doesn’t penalize. This reward structure exposes the core problem: models trained only on accuracy learn to guess, and in medicine a wrong diagnosis made with confidence is more dangerous than an admission of uncertainty.

The numbers speak clearly. Human radiologists scored 988.7 points out of 2,000. The best model, Anthropic’s Claude Fable 5, stopped at 758. Google’s Gemini 3 Pro had the highest raw accuracy but lost points for overconfidence. Meta Muse Spark 1.1 was best at knowing when to pass the case to a human, but only because it refuses to answer more often. Open-weight models and those trained for medical use performed worst: they attempt nearly every case and fail frequently, with medium to high confidence.

The takeaway for those building agents: calibration (knowing when you don’t know) is an unsolved problem, and it gets worse when the model receives input you don’t control.

Epoch AI: manipulated text is invisible.

Epoch AI tested three detectors (Pangram, GPTZero, Originality.ai) on three text categories: human, AI generated from simple prompts, and AI imitating the style of a real author. The corpus includes 495 passages from 99 human authors, all written before November 2022 to exclude contamination.

With simple prompts, detectors are nearly perfect: false negative rate below 0.7%. But when the model receives five writing samples from an author and is asked to imitate their style, the false negative rate rises to 13% on average. For academic writing, the figure worsens dramatically: Pangram misses 25% of texts, GPTZero 24%, Originality.ai 29%. In the worst case, Pangram fails to detect 48% of academic passages generated by Gemini.

Epoch AI’s conclusion: a low false alarm rate on human text says nothing about how many AI texts actually slip through. The three detectors use different methods (neural network, predictability of lexical choices, statistical patterns), but they all show the same weakness.

What this means for agent users.

The two studies don’t explicitly discuss prompt injection. But they show its preconditions. When an agent reads external content, two things can go wrong: the content can contain hidden instructions that the model executes, and the model lacks the calibration to recognize that something is off. Detectors aren’t a reliable remedy, because manipulated text passes through.

Practical defenses come down to architecture: separate system instructions from read content, limit the actions the agent can take autonomously, verify output manually when results seem questionable. The calibration problem remains: no tested model knows how to say “I don’t know” at the right moment, whether in radiology or when reading an email. Until LLM metacognition improves, the responsibility for stopping the agent falls on the person using it.