I ran 356 prompt-injection trials. The workspace changed what ‘safe’ looked like

I ran 356 valid prompt-injection trials across six models and three agent harnesses. The injected instruction was hidden in a file or issue result, not the user’s request. In the depth pass I measured two concrete outcomes: whether the agent sent a planted credential and whether it fetched a cloud instance-metadata endpoint. The breaches were real, but concentrated. Under the same Mastra setup, Kimi k2.7-code exfiltrated in 24/26 valid runs while Kimi k3 did so once in 30. In the Claude Code arm, Haiku exfiltrated 18/30 and Sonnet 0/30. The Codex arm is reported separately because its prompt and tool routing were different. The part I did not expect was the workspace. The first screening workspace had no contact information. Some agents accepted the instruction and searched for a recipient, but could not finish. Adding ordinary repository contact files let the same kind of attack complete. That is a mechanism finding, not a before/after rate comparison. I also had to invalidate runs with no delivered payload or no session file. A clean zero is not evidence if the model never received a usable session. I’m sharing the benchmark for critique. What should an evaluation record to distinguish a true refusal from an attack that ran out of information?