cs.CROct 2, 2026

EvoRiskBench: An Evolving Benchmark for Runtime Security Risks in Workspace Agents

Authors: Shiyi Kuang, Xuemei Luo, Kun Liu, Junhai Li, Rui Tian, Feng Shi, Bo Shen, Nianyu Li, 

Organizations: Novo Ordo for AI · Fudan University · Zhongguancun Laboratory

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

Workspace agents combine large language models with execution harnesses to perform stateful, multi-step tasks that access or modify external resources. Existing benchmarks leave gaps in executable coverage of their runtime security risks, while evolving model capabilities, harnesses, tools, and threats motivate benchmark evolution. We introduce EvoRiskBench, an evolving benchmark organized around the EP-Path-EF framework, which links an initial risk entry point to a one-hop technical effect through an agent-mediated risk path. The framework defines nine entry-point categories and five effect categories; a 20-participant study supports their interpretability and classification consistency on representative cases. Guided by this framework, an automated end-to-end workflow constructs and executes risk cases in isolated environments and independently verifies outcomes using runtime traces and environment states. The benchmark provides a reproducible dataset of 450 adversarial tasks across six scenarios. We evaluate nine model-harness configurations spanning three models (GPT-5.6 Sol, DeepSeek-V4-Pro-0813, and Claude Opus 5) and three harnesses (Claude Code, Codex, and OpenClaw). Our results reveal substantial vulnerabilities across systems. The most vulnerable configuration, Codex with DeepSeek-V4-Pro-0813, reaches a 68.44% attack success rate (ASR), indicating that configuration of workspace agent is insufficient to ensure secure autonomous execution. ASR varies more across models than harnesses, and harness differences depend on the model. The benchmark cases and evaluation platform will be released after completion of artifact safety and reproducibility checks.

Figures & tables

BenchmarkRisk Entry PointRisk Effect
 SMKRCEFIONAPACSADMCPSSIIDUADTSDRE
1×\times∘\circ×\times∘\circ∘\circ×\times×\times×\times×\times∘\circ∘\circ∘\circ∘\circ×\times
6×\times✓∘\circ∘\circ✓×\times×\times×\times×\times✓✓✓×\times×\times
30×\times✓∘\circ∘\circ✓×\times×\times×\times✓✓∘\circ∘\circ✓×\times
31✓✓✓✓✓×\times×\times×\times✓✓✓✓✓∘\circ
10✓✓✓✓✓×\times×\times×\times✓✓✓✓∘\circ×\times
Table 1: Comparison of representative agent security benchmarks across risk entry points and risk effects in EvoRiskBench. ✓ denotes explicit executable coverage, ∘\circ denotes partial or incidental coverage, and ×\times denotes no identified coverage. Risk Entry Point abbreviations: SM = Session Memory, KR = Knowledge Retrieval, CE = Command Execution, FIO = File I/O, NA = Network Access, PAC = Peer-Agent Communication, SAD = Subagent Delegation, MCPS = MCP Service, and SI = Skill Invocation. Risk effects : ID = Information Disclosure, UA = Unauthorized Access, DT = Data Tampering, SD = System Destruction, and RE = Resource Exhaustion.
Figure 1: Overview of EvoRiskBench framework.
Attack SurfaceEPRepresentative Adversarial Payload
Memory & RetrievalSMPersistent instructions that redirect behavior in subsequent tasks.
 KRPrompt-injection instructions embedded in retrieved content.
Tool & ExecutionCEInstructions that steer subsequent actions in a command-based workflow.
 FIOFile-embedded instructions that alter task execution or file processing.
 NARemote instructions that redirect agent actions or request disclosure.
Multi-Agent & CollaborationPACInstructions that misdirect the receiving agent.
Table 2: Risk entry points in EvoRiskBench with representative adversarial payloads.
CIARisk EffectTechnical Outcome
CIDProtected information reaches an unauthorized recipient or channel.
IUAA resource beyond the task’s authorization boundary is accessed or used.
DTUnauthorized changes alter authoritative data or persistent state.
ASDA critical asset is deleted or corrupted, causing asset or functional loss.
REA resource or quota is exhausted, causing legitimate operations to fail or degrade.
Table 3: Risk effects in EvoRiskBench, grouped by CIA security properties.
Figure 2: EP–EF ASR under nine Model ×\times Harness configurations. Each cell reports the number of successful attacks among ten benchmark cases for the corresponding EP–EF pair, while color intensity encodes the resulting ASR.
HarnessGPT-5.6 SolDeepSeek-V4-Pro-0813Claude Opus 5Overall
OpenClaw63.1162.8930.0052.00
Codex68.8969.3326.8955.04
Claude Code77.3372.2273.3374.30
Overall69.7868.1543.4160.44
Table 4: Task Success Rate (TSR, %) across Model ×\times Harness configurations.
Figure 3: AI-judged harm severity across risk entry points and risk effects.
Appendix figures & tables5 assets

Supplementary material from the paper’s appendix.

Appendix

DimensionEntry PointsRisk Effects
Clarity ∗4.244.51
Distinctiveness ∗3.914.18
Coverage: Agree/Strongly Agree100.00%95.00%
No obvious missing category75.00%85.00%
Appendix
Table 5: Subjective evaluation of the proposed runtime-risk taxonomy.
EP Classification ScenarioP1P2P3P4P5P6
Agreement (%)90.0090.00100.00100.0095.00100.00
EF Classification ScenarioE1E2E3E4E5 
Agreement (%)90.0075.0085.0095.0095.00 
Appendix
Table 6: Majority agreement in blind case classification.
Figure 4: Configuration-specific Harm Scores by risk entry point.
Figure 5: Configuration-specific Harm Scores by risk effect.
HarnessVersionUpdate date
Claude Code2.1.2682026-09-10
OpenClaw2026.9.42026-09-11
Codex CLI0.154.02026-09-09
Appendix
Table 7: Harness versions and update dates recorded for the testbed.
More in this topic

AI Agent Security

Artificial intelligence agent security studies attacks and safeguards for tool-using, persistent, and collaborative systems across digital and physical settings.

See all 491 papers

Explore similar work

CardsList
Aug 10, 2026

ActBench: Self-Evolving Benchmark of Behavioral Safety in Cowork Agents

Cowork agents may complete benign tasks while disclosing protected data, manipulating unauthorized state, invocate unauthorized API. We define behavioral safety and introduce ActBench, a self-evolving benchmark that evaluates such behavior risk from execution trajectories rather than final responses. Each case pairs a benign task with an adversarial variant that preserves its instruction, configuration, initial state, rating model, and trusted records while injecting a task-reachable payload. ActBench contains 600 cases from 213 scenarios, spanning 15 risk behaviors, six execution spaces, and 48 web-service APIs.To move beyond static payloads, we propose a reward-guided beam search method that jointly optimizes attack effectiveness and task utility, while reflection diagnoses failed execution checkpoint and guides payload revision. Besides, we propose a dual evidence verification mechanism that verifies agent execution safety and utility through log evidence and LLM-based trajectory evidence.We evaluate 15 LLMs and 6 open-source cowork agents over 24,000 trajectories. Under a fixed harness, attack success rates ranges from 10.1% to 94.4% across models, while under a fixed base model, they range from 73.7% to 94.4% across agents.These results show greater variation across models than agent harness, while attacks remain highly successful across all tested harnesses.Our benchmark is released at: https://github.com/zjuicsr/ActBench.

Hongwei Yao, Yiming Liu, Meihui Chen +6

City University of Hong Kong, Hong Kong · Zhejiang University, China · Xiaomi Corporation, China +1

AI Agent SecurityAI Agent SafetyPrompt Injection Attacks on AI AgentsAI Agent Safety Benchmarks
AskPDF
Aug 18, 2026

HarnessRisk: A Lifecycle-Oriented Benchmark for Agent Harness Safety

Large language models are increasingly deployed through agent harnesses that manage tools, extensions, persistent state, permissions, and external actions. Existing safety benchmarks mainly target individual attack mechanisms or a limited subset of operational settings, making it difficult to compare how safety failures emerge across different harness responsibilities. We present HarnessRisk, a lifecycle oriented benchmark that organizes agent harness safety into six operational phases including Harness Configuration, Capability Extension, Runtime Operation, State Persistence, Action Control, and Incident Recovery. HarnessRisk contains 128 sandboxed cases, each pairing a benign user objective with an adversarial instruction embedded in an untrusted workflow artifact. We evaluate each trajectory using Utility, Attack Success Rate, Persistence, and Detection. Across three harnesses, six language models, and 14 model and harness configurations, attack success ranges from 12.6% to 80.9%, while Utility remains between 75.0% and 97.6%. Harness Configuration is the most vulnerable phase across all three harnesses, showing that attacks can succeed by altering security sensitive parameters within otherwise authorized workflows. We also find that explicit risk recognition does not reliably lead to safe action, as some configurations detect risks in more than 90% of runs while retaining substantial attack success. These results highlight the need to evaluate agent safety across multiple harness responsibilities and at the level of the deployed model and harness configuration.

Yajing Bai, Jinhao Duan, Jie Peng +4

University of North Carolina at Chapel Hill · University of Central Florida · Michigan State University

AI Agent Safety BenchmarksLLM Agent SafetyLLM Agent HarnessesPrompt Injection Attacks on AI AgentsEvaluation Awareness in Language Models
AskPDF
Jul 23, 2026

GuardianAgentBench: Where Agents Fail and How to Guard Them

As large language model agents increasingly operate autonomously with access to tools and external environments, ensuring their safe and reliable behavior becomes critical. We present GuardianAgentBench (GABench), a benchmark of 580 scenarios across six domains evaluated on three production-ready frameworks: LangChain, LlamaIndex, and Vectara. The benchmark incorporates rigorous multi-stage validation and five adversarial attack modes. Experiments with six state-of-the-art models reveal that even the strongest configuration achieves only 74.8% overall accuracy and expose two distinct failure regimes: stronger models under-call required tools, while weaker models mis-select and over-call tools. Performance degrades monotonically with both tool-set size and sequential turn depth, with long-horizon planning proving the steeper bottleneck. Our guardrail implementation consistently outperforms system-prompt-based defenses across all models, recovering 19.9% of failures at a false positive rate of just 0.5%. These results demonstrate that execution-time structural intervention improves safety without disrupting correct agent behavior.

Vishal Ishwar Naik, Chenyu Xu, Donna Dong +5

Vectara, Inc., Palo Alto, CA, USA · Iowa State University, Ames, IA, USA

AI Agent ReliabilityLLM GuardrailsAI Agent SafetyRuntime Enforcement for AI AgentsAI Agent Safety BenchmarksTool-Using Language Agents+1
AskPDF