OpenART: Scaling Agent Red Teaming via Open-Ended Environment Evolution

• URL: http://arxiv.org/abs/2608.00677v1
• Date: Sat, 01 Aug 2026 13:51:55 GMT
• Title: OpenART: Scaling Agent Red Teaming via Open-Ended Environment Evolution
• Abstract summary: AI agents operate in persistent environments where early state changes can influence decisions far into the future.<n>Current safety benchmarks often fail to capture cumulative risks because they focus on short, static tasks.<n>We introduce OpenART, an open-ended arena for scalable agent red teaming through environment evolution.
• Score: 71.06848799741152
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: AI agents operate in persistent environments where early state changes can influence decisions far into the future. Unlike conventional language-model interactions, agent behavior is mediated through a shared state that is repeatedly modified and reused across long-horizon workflows. Current safety benchmarks often fail to capture these cumulative risks because they focus on short, static tasks. To address these limitations, we introduce OpenART, an open-ended arena for scalable agent red teaming through environment evolution. OpenART provides over 10,000 validated stateful scenarios across 50 domains, drawing from a pool of more than 500,000 tools and skills. These tasks require a median of 97 tool calls and enable unified evaluation across 75 different agent-model configurations. To systematically explore these evolving attack surfaces, we propose the Evolutionary Markov Hypergraph Attack (EMHA). EMHA is a black-box policy that performs feedback-driven environment evolution by coordinating authorized state transitions without requiring parameter updates. Throughout the evaluation, task objectives remain fixed while only the environment state changes. Across all configurations, EMHA achieves a pooled Attack Success Rate (ASR) of 85.0%. Its advantage over instruction-only evolution increases from approximately 2% on simple environments to over 17% on the most complex ones, demonstrating that environment evolution increasingly exposes safety failures as task complexity grows. Furthermore, our analysis shows that the specific runtime implementation of an agent explains a significant portion of safety variation beyond the underlying model's capabilities. These results establish OpenART as a scalable foundation for studying agent safety in complex, evolving environments.

Related papers

• EnvHarness: Awakening Static Worlds for Agent Learning [58.54600450547412]
  Environment Harness wraps a static environment to reshape its behavior without modifying the underlying logic.<n>EnvHarness applies across diverse domains while ensuring every reshaped environment retains its original verifier.<n>EnvRigger treats the target policy as a black box, observing its execution trajectories to synthesize EnvHarness components targeting diagnosed flaws.
  arXiv  Detail & Related papers  (2026-08-20T10:42:06Z)
• PLATO: Pointer Learner for Agent and Task Openness [2.413584261314428]
  We introduce Pointer Learner for Agent and Task Openness (PLATO)<n>PLATO is a pointer-network-based actor combined with a centralized graph neural network (GNN) critic.<n>We demonstrate strong performance and more consistent zero-shot generalization than state-of-the-art baselines in OASYS.
  arXiv  Detail & Related papers  (2026-07-27T21:20:13Z)
• EvoArena: Tracking Memory Evolution for Robust LLM Agents in Dynamic Environments [100.23277774720928]
  EvoArena is a benchmark suite that models environment changes as sequences of progressive updates across terminal, software, and social domains.<n>EvoMem is a patch-based memory paradigm that records memory evolution as structured update histories.
  arXiv  Detail & Related papers  (2026-06-11T17:59:59Z)
• DecodingTrust-Agent Platform (DTap): A Controllable and Interactive Red-Teaming Platform for AI Agents [121.77550256034]
  DecodingTrust-Agent Platform (DTap) is a controllable and interactive red-teaming platform for AI agents.<n>DTap-Red is the first autonomous red-teaming agent that explores diverse injection vectors and autonomously discovers effective attack strategies.<n>Through DTap, we conduct large-scale evaluations of popular AI agents built on various backbone models.
  arXiv  Detail & Related papers  (2026-05-06T11:59:48Z)
• The World Won't Stay Still: Programmable Evolution for Agent Benchmarks [44.36372545284675]
  LLM-powered agents fulfill user requests by interacting with environments, querying data, and invoking tools in a multi-turn process.<n>Most existing benchmarks assume static environments with fixed schemas and toolsets, neglecting the evolutionary nature of the real world and agents' robustness to environmental changes.<n>We propose ProEvolve, a graph-based framework that makes environment evolution programmable.
  arXiv  Detail & Related papers  (2026-03-06T04:56:18Z)
• Autonomous Continual Learning of Computer-Use Agents for Environment Adaptation [57.65688895630163]
  We introduce ACuRL, an Autonomous Curriculum Reinforcement Learning framework that continually adapts agents to specific environments with zero human data.<n>Our method effectively enables both intra-environment and cross-environment continual learning, yielding 4-22% performance gains without forgetting existing environments.
  arXiv  Detail & Related papers  (2026-02-10T23:06:02Z)
• NAAMSE: Framework for Evolutionary Security Evaluation of Agents [1.0131895986034316]
  We propose NAAMSE, an evolutionary framework that reframes agent security evaluation as a feedback-driven optimization problem.<n>Our system employs a single autonomous agent that orchestrates a lifecycle of genetic prompt mutation, hierarchical corpus exploration, and asymmetric behavioral scoring.<n>Experiments on Gemini 2.5 Flash demonstrate that evolutionary mutation systematically amplifies vulnerabilities missed by one-shot methods.
  arXiv  Detail & Related papers  (2026-02-07T06:13:02Z)
• MOSS: Enabling Code-Driven Evolution and Context Management for AI Agents [7.4159044558995335]
  We introduce MOSS (llM-oriented Operating System Simulation), a novel framework that integrates code generation with a dynamic context management system. At its core, the framework employs an Inversion of Control container in conjunction with decorators to enforce the least knowledge principle. We show how this framework can enhance the efficiency and capabilities of agent development and highlight its advantages in moving towards Turing-complete agents.
  arXiv  Detail & Related papers  (2024-09-24T14:30:21Z)
• HAZARD Challenge: Embodied Decision Making in Dynamically Changing Environments [93.94020724735199]
  HAZARD consists of three unexpected disaster scenarios, including fire, flood, and wind. This benchmark enables us to evaluate autonomous agents' decision-making capabilities across various pipelines.
  arXiv  Detail & Related papers  (2024-01-23T18:59:43Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.