Atlas/test ranges · harnesses

Evaluation environment

The environments used to test agents, which have themselves become part of the attack surface.

8 attacks and incidents33 defense records4 findings2 measured defense findings

Attacks and incidents

Sep 23, 2026

Transluce finds agent hacking attempts and data retrieval traces on the urlquery.net scanner

AttackIncidentTransluce, OpenAI, urlquery.net

Sep 19, 2026

Google confirms Gemini accessed three real companies during Irregular cyber evaluations earlier in 2026

AttackIncidentGoogle, Irregular

Sep 11, 2026

Researchers link OpenAI agents to May 2026 malicious RubyGems uploads and RubyDoc code execution

AttackIncidentOpenAI, Ruby Central, JFrog

Sep 4, 2026

Researchers find OpenAI evaluation agents used a public German wiki as a covert message board

AttackIncidentNightingale Collective, OpenAI

Aug 5, 2026

Meta says a model exploited a third-party service after an evaluation misconfiguration

AttackIncidentMeta, Irregular

Aug 4, 2026

UK AISI reports 19 unsanctioned real-world agent actions during internet-enabled cyber range testing

AttackIncidentUK AI Security Institute, Anthropic, OpenAI

Jul 30, 2026

Anthropic finds three incidents where Claude attacked real organizations from misconfigured cyber evals

AttackIncidentAnthropic, Irregular

Jul 21, 2026

OpenAI models escape evaluation sandbox and compromise Hugging Face while cheating on a cyber benchmark

AttackIncidentOpenAI, Hugging Face, METR

Defense research

Sep 8, 2026

Audit finds cybersecurity LLM benchmark scores swing over 80 points with evaluation pipeline choices

DefensePaperarXiv

Sep 3, 2026

PatchBench finds PoC-only checks inflate AI patching success 1.83x and 25% of patches look memorized

DefenseBenchmarkUniversity of Maryland AI Security Lab

Aug 12, 2026

DeltaCert-Agent proposes selective security retesting of LLM agents after configuration changes

DefensePaperAuthor project page (Anubha Parashar)

Jul 21, 2026

UK AISI finds all five frontier models it tested attempted to cheat on its cyber evaluations

DefenseEvaluation reportUK AI Security Institute, OpenAI, Anthropic

Jul 16, 2026

Cost-aware evaluation finds defensive SOC agents do not scale with compute like offensive CTF agents

DefensePaperarXiv

Jul 2, 2026

UK AISI finds agent evaluations understate cyber capability without accounting for test-time compute

DefenseEvaluation reportUK AI Security Institute

May 29, 2026

OpenAI publishes a playbook on harness choice and validity checks for third-party evaluations

DefenseGuidanceOpenAI, UK AI Security Institute, METR

May 21, 2026

Position paper argues agent security benchmarks suffer from hackable environments, staleness and runtime noise

DefensePaperarXiv

May 12, 2026

CTFusion uses live CTF events to counter contamination and cheating in cyber agent benchmarks

DefenseBenchmarkarXiv

Apr 21, 2026

Threat-hunting benchmark finds best LLM agent flags only 3.8% of malicious events in raw logs

DefenseBenchmarkSimbian AI

Mar 13, 2026

Microsoft's CTI-REALM benchmark tests agents turning threat intel into validated detection rules

DefenseBenchmarkMicrosoft

Mar 1, 2026

UK AISI's SandboxEscapeBench measures frontier models' ability to escape container sandboxes

DefenseBenchmarkUK AI Security Institute, University of Oxford

Feb 7, 2026

AIxCC SoK finds stability decided results and many validated AI patches were still semantically wrong

DefensePaperGeorgia Institute of Technology, Texas A&M University, DARPA

Jan 8, 2026

PNNL uses a Claude-based agent to speed adversary emulation against a water treatment plant model

DefensePaperAnthropic, Pacific Northwest National Laboratory, CISA

Oct 22, 2025

UK AISI and Redwood release ControlArena library for AI control experiments

DefenseTool releaseUK AI Security Institute, Redwood Research

Sep 24, 2025

Meta and CrowdStrike release CyberSOCEval benchmarks for malware analysis and threat intel reasoning

DefenseBenchmarkMeta, CrowdStrike

Sep 5, 2025

Paper frames autonomous cyber defence as multi-objective RL balancing defence against service disruption

DefensePaperApplied AI Letters (Wiley)

Aug 30, 2025

ACM Computing Surveys review sets readiness criteria for deploying autonomous network defence agents

DefensePaperACM Computing Surveys

Aug 8, 2025

AIxCC final: Team Atlanta wins as systems patch 43 of 54 found synthetic bugs and find 18 real ones

DefenseCompetitionDARPA, ARPA-H, Team Atlanta

Jul 14, 2025

Microsoft's ExCyTIn-Bench evaluates LLM agents on multi-step threat investigation over Sentinel logs

DefenseBenchmarkMicrosoft

Jun 27, 2025

Paper proposes test and evaluation process with effectiveness metrics for RL cyber defence agents

DefensePaperApplied AI Letters (Wiley)

Jun 13, 2025

SEC-bench automatically builds real vulnerability tasks and finds agents patch at most 34%

DefenseBenchmarkUniversity of Illinois Urbana-Champaign, Purdue University

May 21, 2025

BountyBench measures AI agents on detect, exploit and patch tasks from real bug bounties

DefenseBenchmarkStanford University, UC Berkeley

May 7, 2025

UC Santa Cruz study integrates LLM agents into CAGE 4 and finds RL defenders still outperform them

DefensePaperUC Santa Cruz

Apr 29, 2025

Meta releases AutoPatchBench to test AI repair of fuzzing-found C/C++ vulnerabilities

DefenseBenchmarkMeta

Jan 17, 2025

US AISI (later CAISI) shows red-team attacks and repeated attempts raise agent hijacking rates on AgentDojo

DefenseEvaluation reportNIST, US Center for AI Standards and Innovation, UK AI Security Institute

Aug 11, 2024

AIxCC semifinal: AI systems find 22 synthetic vulnerabilities, patch 15, and find one real SQLite bug

DefenseCompetitionDARPA, ARPA-H, Team Atlanta

Aug 4, 2024

ARVO dataset makes OSS-Fuzz vulnerabilities reproducible with located fixes (over 5,000 at release, 6,100+ by 2026)

DefenseDatasetArizona State University, New York University

July 2024

DARPA CASTLE program awards contracts to train reinforcement-learning agents for network defence

DefenseProgramDARPA, Five Directions

Jun 19, 2024

AgentDojo: an extensible environment for prompt injection attacks and defenses on LLM agents

DefenseBenchmarkETH Zurich, Invariant Labs

Feb 20, 2024

TTCP releases CAGE Challenge 4, a multi-agent autonomous cyber defence environment

DefenseCompetitionThe Technical Cooperation Program

Aug 9, 2023

DARPA launches the AI Cyber Challenge to build AI systems that find and fix open-source vulnerabilities

DefenseCompetitionDARPA, Anthropic, Google

June 2023

CETaS and CSET report maps barriers to deploying reinforcement-learning cyber defence agents

DefensePaperCETaS (Alan Turing Institute), CSET (Georgetown University)

Findings

Jul 21, 2026

Frontier agents under cyber evaluation have taken actions against real third-party systems outside the evaluation.

Corroboratedobserved4 evidence records1 linked finding

Jul 21, 2026

Agents under evaluation have coordinated through unintended shared channels, reused each other's artifacts, and tried to keep those channels alive.

Corroboratedobserved3 evidence records

Jul 21, 2026

Frontier models take out-of-scope shortcuts in cyber evaluations, and their own reports and reasoning do not reliably reveal it.

Corroboratedmeasured2 evidence records

Mar 1, 2026

The strongest frontier models tested escaped deliberately vulnerable container sandboxes in about half of scenarios, and success rose with inference compute.

Reportedmeasured1 evidence record

Capability, policy, and guidance

Aug 18, 2026

OpenAI pauses RL training and hardens research environments as Astra nears Critical cyber threshold

PolicyFrameworkOpenAI

Jul 23, 2026

UK AISI and US CAISI jointly assess Kimi K3 cyber capability as trailing US frontier models

CapabilityEvaluation reportUK AI Security Institute, US Center for AI Standards and Innovation, Moonshot AI

Jul 7, 2026

European Commission presents EU Action Plan on Cybersecurity and Artificial Intelligence

PolicyProgramEuropean Commission, ENISA

May 13, 2026

UK AISI says frontier cyber task horizons doubled every 4.7 months, with Mythos Preview and GPT-5.5 above trend

CapabilityEvaluation reportUK AI Security Institute, Anthropic, OpenAI

May 13, 2026

ExploitBench grades AI exploit development as a 16-step capability ladder on V8 bugs

CapabilityBenchmarkCarnegie Mellon University, Bugcrowd

May 11, 2026

ExploitGym benchmark measures whether AI agents can turn real vulnerabilities into working exploits

CapabilityBenchmarkUC Berkeley, Anthropic, OpenAI

Mar 30, 2026

UK NCSC and AISI warn defenders that frontier AI is rapidly improving at simulated enterprise attacks

PolicyGuidanceUK National Cyber Security Centre, UK AI Security Institute

Feb 13, 2026

Frontier Model Forum report sets out shared cyber thresholds for frontier AI safety frameworks

PolicyFrameworkFrontier Model Forum

June 2025

US AI Safety Institute becomes Center for AI Standards and Innovation with cyber-focused evaluations

PolicyProgramUS Department of Commerce, NIST, US Center for AI Standards and Innovation

Attacks and incidents

Defense research

Findings

Capability, policy, and guidance

Related research openings