Yunhao Chen, Xin Wang, Yixu Wang, Yi Liu, Jie Li, Yan Teng, Xingjun Ma, Xia Hu, Yu-Gang Jiang
5 min
Abstract
AI agents operate in persistent environments where early state changes can influence decisions far into the future. Unlike conventional language-model interactions, agent behavior is mediated through a shared state that is repeatedly modified and reused across long-horizon workflows. Current safety benchmarks often fail to capture these cumulative risks because they focus on short, static tasks. To address these limitations, we introduce OpenART, an open-ended arena for scalable agent red teaming through environment evolution. OpenART provides over 10,000 validated stateful scenarios across 50 domains, drawing from a pool of more than 500,000 tools and skills. These tasks require a median of 97 tool calls and enable unified evaluation across 75 different agent-model configurations. To systematically explore these evolving attack surfaces, we propose the Evolutionary Markov Hypergraph Attack (EMHA). EMHA is a black-box policy that performs feedback-driven environment evolution by coordinating authorized state transitions without requiring parameter updates. Throughout the evaluation, task objectives remain fixed while only the environment state changes. Across all configurations, EMHA achieves a pooled Attack Success Rate (ASR) of 85.0%. Its advantage over instruction-only evolution increases from approximately 2% on simple environments to over 17% on the most complex ones, demonstrating that environment evolution increasingly exposes safety failures as task complexity grows. Furthermore, our analysis shows that the specific runtime implementation of an agent explains a significant portion of safety variation beyond the underlying model's capabilities. These results establish OpenART as a scalable foundation for studying agent safety in complex, evolving environments.
Sam: So the agent thinks it's doing the same task, but the ground beneath it is shifting. Does this actually work better than just throwing unexpected prompts at the agent?
Alex: The study found it does — meaningfully so. Simple instruction-based attacks, where you just change what you ask the agent, miss risks that only emerge over time. This approach exposes vulnerabilities that grow as the task gets longer and the environment accumulates small changes. The danger isn't always in the first step; sometimes it only becomes visible after many steps have compounded.
Sam: That's a genuinely important distinction. If a failure only shows up after a hundred interactions, a standard single-question test would never catch it. What was the most notable thing they found when they actually ran these tests?
Alex: Something that shifts where we should be looking. They found that an agent's "runtime implementation" — meaning the specific software interface and tools the agent uses to interact with the world — matters more than previously assumed. Even when two agents were built on the exact same underlying AI model, they showed meaningfully different vulnerabilities depending on how they were set up to act in the world.
Sam: So it's not just the "brain" of the AI that determines how safe it is. It's also the "body" — the interface, the tools, the way it reaches out and does things.
Alex: That's a useful way to put it. And it has a practical implication: you can't just evaluate the model in isolation and call it safe. You have to evaluate the whole system — the model, its tools, and the environment it operates in — together. By shifting from static prompts to evolving environments, this research offers a more realistic way to measure whether these agents can remain safe in the complex, real-world systems they're increasingly being trusted to manage. That's a meaningful step toward understanding what AI safety actually looks like in practice.
Sam: And it sounds like the answer is considerably more complicated than a single test could reveal.
Alex: Considerably. Thanks for listening to ResearchPod.