What it is
An open-ended benchmark and black-box attack for red-teaming stateful AI agents by evolving the environment instead of only changing prompts. Instead of testing agents on short static tasks or prompt-only attacks, it evolves shared environment state over long-horizon workflows. A black-box policy, EMHA, coordinates authorized state transitions to expose failures without updating agent parameters.
Key results
- 85.0% pooled strict ASR across 75 agent-model configurations
- Beats instruction-only evolution by 17.2-17.6% on complex environments
- Target-agent identity explains +7.6% ASR variation beyond model/capability
State evolution is a stronger lever than prompt-only attacks for exposing safety failures in complex, persistent agent environments.