cs.CROct 2, 2026

EvoRiskBench: An Evolving Benchmark for Runtime Security Risks in Workspace Agents

Authors: Shiyi Kuang, Xuemei Luo, Kun Liu, Junhai Li, Rui Tian, Feng Shi, Bo Shen, Nianyu Li, 

Organizations: Novo Ordo for AI · Fudan University · Zhongguancun Laboratory

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

Workspace agents combine large language models with execution harnesses to perform stateful, multi-step tasks that access or modify external resources. Existing benchmarks leave gaps in executable coverage of their runtime security risks, while evolving model capabilities, harnesses, tools, and threats motivate benchmark evolution. We introduce EvoRiskBench, an evolving benchmark organized around the EP-Path-EF framework, which links an initial risk entry point to a one-hop technical effect through an agent-mediated risk path. The framework defines nine entry-point categories and five effect categories; a 20-participant study supports their interpretability and classification consistency on representative cases. Guided by this framework, an automated end-to-end workflow constructs and executes risk cases in isolated environments and independently verifies outcomes using runtime traces and environment states. The benchmark provides a reproducible dataset of 450 adversarial tasks across six scenarios. We evaluate nine model-harness configurations spanning three models (GPT-5.6 Sol, DeepSeek-V4-Pro-0813, and Claude Opus 5) and three harnesses (Claude Code, Codex, and OpenClaw). Our results reveal substantial vulnerabilities across systems. The most vulnerable configuration, Codex with DeepSeek-V4-Pro-0813, reaches a 68.44% attack success rate (ASR), indicating that configuration of workspace agent is insufficient to ensure secure autonomous execution. ASR varies more across models than harnesses, and harness differences depend on the model. The benchmark cases and evaluation platform will be released after completion of artifact safety and reproducibility checks.

Figures & tables

BenchmarkRisk Entry PointRisk Effect
 SMKRCEFIONAPACSADMCPSSIIDUADTSDRE
1×\times∘\circ×\times∘\circ∘\circ×\times×\times×\times×\times∘\circ∘\circ∘\circ∘\circ×\times
6×\times✓∘\circ∘\circ✓×\times×\times×\times×\times✓✓✓×\times×\times
30×\times✓∘\circ∘\circ✓×\times×\times×\times✓✓∘\circ∘\circ✓×\times
31✓✓✓✓✓×\times×\times×\times✓✓✓✓✓∘\circ
10✓✓✓✓✓×\times×\times×\times✓✓✓✓∘\circ×\times
Table 1: Comparison of representative agent security benchmarks across risk entry points and risk effects in EvoRiskBench. ✓ denotes explicit executable coverage, ∘\circ denotes partial or incidental coverage, and ×\times denotes no identified coverage. Risk Entry Point abbreviations: SM = Session Memory, KR = Knowledge Retrieval, CE = Command Execution, FIO = File I/O, NA = Network Access, PAC = Peer-Agent Communication, SAD = Subagent Delegation, MCPS = MCP Service, and SI = Skill Invocation. Risk effects : ID = Information Disclosure, UA = Unauthorized Access, DT = Data Tampering, SD = System Destruction, and RE = Resource Exhaustion.
Figure 1: Overview of EvoRiskBench framework.
Attack SurfaceEPRepresentative Adversarial Payload
Memory & RetrievalSMPersistent instructions that redirect behavior in subsequent tasks.
 KRPrompt-injection instructions embedded in retrieved content.
Tool & ExecutionCEInstructions that steer subsequent actions in a command-based workflow.
 FIOFile-embedded instructions that alter task execution or file processing.
 NARemote instructions that redirect agent actions or request disclosure.
Multi-Agent & CollaborationPACInstructions that misdirect the receiving agent.
Table 2: Risk entry points in EvoRiskBench with representative adversarial payloads.
CIARisk EffectTechnical Outcome
CIDProtected information reaches an unauthorized recipient or channel.
IUAA resource beyond the task’s authorization boundary is accessed or used.
DTUnauthorized changes alter authoritative data or persistent state.
ASDA critical asset is deleted or corrupted, causing asset or functional loss.
REA resource or quota is exhausted, causing legitimate operations to fail or degrade.
Table 3: Risk effects in EvoRiskBench, grouped by CIA security properties.
Figure 2: EP–EF ASR under nine Model ×\times Harness configurations. Each cell reports the number of successful attacks among ten benchmark cases for the corresponding EP–EF pair, while color intensity encodes the resulting ASR.
HarnessGPT-5.6 SolDeepSeek-V4-Pro-0813Claude Opus 5Overall
OpenClaw63.1162.8930.0052.00
Codex68.8969.3326.8955.04
Claude Code77.3372.2273.3374.30
Overall69.7868.1543.4160.44
Table 4: Task Success Rate (TSR, %) across Model ×\times Harness configurations.
Figure 3: AI-judged harm severity across risk entry points and risk effects.
Appendix figures & tables5 assets

Supplementary material from the paper’s appendix.

Appendix

DimensionEntry PointsRisk Effects
Clarity ∗4.244.51
Distinctiveness ∗3.914.18
Coverage: Agree/Strongly Agree100.00%95.00%
No obvious missing category75.00%85.00%
Appendix
Table 5: Subjective evaluation of the proposed runtime-risk taxonomy.
EP Classification ScenarioP1P2P3P4P5P6
Agreement (%)90.0090.00100.00100.0095.00100.00
EF Classification ScenarioE1E2E3E4E5 
Agreement (%)90.0075.0085.0095.0095.00 
Appendix
Table 6: Majority agreement in blind case classification.
Figure 4: Configuration-specific Harm Scores by risk entry point.
Figure 5: Configuration-specific Harm Scores by risk effect.
HarnessVersionUpdate date
Claude Code2.1.2682026-09-10
OpenClaw2026.9.42026-09-11
Codex CLI0.154.02026-09-09
Appendix
Table 7: Harness versions and update dates recorded for the testbed.
More in this topic

AI Agent Security

Artificial intelligence agent security studies attacks and safeguards for tool-using, persistent, and collaborative systems across digital and physical settings.

See all 491 papers

Explore similar work

CardsList

  1. ActBench: Self-Evolving Benchmark of Behavioral Safety in Cowork Agents

    Aug 10, 2026Hongwei Yao, Yiming Liu, Meihui Chen +6AI Agent SecurityAI Agent Safety

    City University of Hong Kong, Hong Kong · Zhejiang University, China · Xiaomi Corporation, China +1

  2. HarnessRisk: A Lifecycle-Oriented Benchmark for Agent Harness Safety

    Aug 18, 2026Yajing Bai, Jinhao Duan, Jie Peng +4AI Agent Safety BenchmarksLLM Agent Safety

    University of North Carolina at Chapel Hill · University of Central Florida · Michigan State University

  3. GuardianAgentBench: Where Agents Fail and How to Guard Them

    Jul 23, 2026Vishal Ishwar Naik, Chenyu Xu, Donna Dong +5AI Agent ReliabilityLLM Guardrails

    Vectara, Inc., Palo Alto, CA, USA · Iowa State University, Ames, IA, USA