OpenART: 85% attack success, and the harness is the vulnerability
OpenART is a red teaming framework for agents that starts from a premise most safety evals ignore: agents live in persistent environments, and a state change made in turn three can steer a decision in turn ninety. 10,000-plus stateful scenarios across 50 domains, 159 upvotes on HuggingFace today.
The attack method is called Evolutionary Markov Hypergraph Attack, and the design is nastier than a prompt-injection corpus. EMHA is a black-box policy that evolves the environment itself through feedback, coordinating state transitions that are all individually authorized. Nothing it does is a violation. It just arranges the world so the agent's own reasoning arrives somewhere bad. Attack success rate is 85.0% across configurations, and it beats instruction-only attacks by 2 to 17 points depending on task complexity, with the gap widening as tasks get harder.
The finding worth carrying around is that runtime implementation affects safety independently of model capability. Same model, different harness, materially different safety outcome. Which is the same lesson the capability side learned a year ago and has been repeating ever since. Your model card tells you approximately nothing about how the deployed thing behaves, because the sandbox policy, the tool surface, and what the loop lets persist between turns are doing at least as much work as the weights.
Line this up with Anthropic's multi-agent findings published the same day and the shape gets clearer. Both papers conclude that the interesting failures are not in the model, they're in the system the model runs inside, and neither is visible to a single-turn eval on a static prompt set. The evaluation stack we all rely on was built for a different object than the one we're now shipping.
arXiv 2608.00677, Yunhao Chen and colleagues, CC BY 4.0. No public repo listed yet.
← Back to all articles
The attack method is called Evolutionary Markov Hypergraph Attack, and the design is nastier than a prompt-injection corpus. EMHA is a black-box policy that evolves the environment itself through feedback, coordinating state transitions that are all individually authorized. Nothing it does is a violation. It just arranges the world so the agent's own reasoning arrives somewhere bad. Attack success rate is 85.0% across configurations, and it beats instruction-only attacks by 2 to 17 points depending on task complexity, with the gap widening as tasks get harder.
The finding worth carrying around is that runtime implementation affects safety independently of model capability. Same model, different harness, materially different safety outcome. Which is the same lesson the capability side learned a year ago and has been repeating ever since. Your model card tells you approximately nothing about how the deployed thing behaves, because the sandbox policy, the tool surface, and what the loop lets persist between turns are doing at least as much work as the weights.
Line this up with Anthropic's multi-agent findings published the same day and the shape gets clearer. Both papers conclude that the interesting failures are not in the model, they're in the system the model runs inside, and neither is visible to a single-turn eval on a static prompt set. The evaluation stack we all rely on was built for a different object than the one we're now shipping.
arXiv 2608.00677, Yunhao Chen and colleagues, CC BY 4.0. No public repo listed yet.
Comments