AI agents operate in persistent environments where early state changes can influence decisions far into the future. Unlike conventional language-model interactions, agent behavior is mediated through a shared state that is repeatedly modified and reused across long-horizon workflows. Current safety benchmarks often fail to capture these cumulative risks because they focus on short, static tasks. To address these limitations, we introduce OpenART, an open-ended arena for scalable agent red teaming through environment evolution. OpenART provides over 10,000 validated stateful scenarios across 50 domains, drawing from a pool of more than 500,000 tools and skills. These tasks require a median of 97 tool calls and enable unified evaluation across 75 different agent-model configurations. To systematically explore these evolving attack surfaces, we propose the Evolutionary Markov Hypergraph Attack (EMHA). EMHA is a black-box policy that performs feedback-driven environment evolution by coordinating authorized state transitions without requiring parameter updates. Throughout the evaluation, task objectives remain fixed while only the environment state changes. Across all configurations, EMHA achieves a pooled Attack Success Rate (ASR) of 85.0%. Its advantage over instruction-only evolution increases from approximately 2% on simple environments to over 17% on the most complex ones, demonstrating that environment evolution increasingly exposes safety failures as task complexity grows. Furthermore, our analysis shows that the specific runtime implementation of an agent explains a significant portion of safety variation beyond the underlying model's capabilities. These results establish OpenART as a scalable foundation for studying agent safety in complex, evolving environments.
Alex: Welcome to another episode of ResearchPod. Today, we're looking at a study that asks a pointed question: are we actually testing AI agents correctly? We've been treating them like static chatbots, but they actually live in dynamic, shifting worlds.
Sam: So we've been testing these agents as if they only answer one question at a time. But this paper argues the real risks appear when an agent interacts with a system over a long period?
Alex: Exactly. Think about it this way: imagine you hired someone to manage your house while you were away. You wouldn't just test them by asking one question at the door. You'd want to know how they behave over days, when things get complicated, when small decisions start to stack up. Safety failures in AI agents work the same way — they're often properties of the whole interaction, not any single moment. If an agent manages a cloud server, a perfectly safe command today might quietly create a vulnerability for tomorrow.
Sam: That's like a slow-moving trap. So this paper introduces a testing system that evolves the environment itself, rather than just changing what the user asks?
Alex: Correct. The approach is called "red teaming" — which is a term borrowed from military and cybersecurity practice, where a team deliberately tries to find weaknesses in a system before a real adversary does. The researchers built a framework called OpenART that generates over ten thousand validated scenarios where the environment itself shifts, forcing the agent to navigate risks that standard, one-shot tests would never expose.
Sam: How does it force those changes without breaking the task the agent is supposed to be doing?
Alex: That's the key design challenge. They use a feedback-driven method they call the Evolutionary Markov Hypergraph Attack — EMHA for short. Let me unpack that piece by piece, because the name is dense but the idea is actually fairly intuitive.
Sam: Please do. Start with the "hypergraph" part.
Alex: Sure. You probably know what a regular graph is — points connected by lines, like a map of cities linked by roads. A hypergraph is more flexible: a single connection can link many points at once, not just two. The researchers use this structure to model how different states of the environment depend on each other in complex, overlapping ways. It's less like a road map and more like a web where pulling one thread can affect several others simultaneously.
Sam: Okay — a richer map of dependencies. And the "evolutionary" part?
Alex: That's where it gets interesting. The system doesn't just set up a scenario and leave it. It actively tweaks the environment — say, quietly changing a file permission, or altering what data the agent can see — and then watches whether the agent slips up. If the agent handles it safely, the system tries a slightly different variation. It's constantly refining its approach, like a coach who keeps adjusting drills based on where a player keeps making mistakes.
Sam: So the agent thinks it's doing the same task, but the ground beneath it is shifting. Does this actually work better than just throwing unexpected prompts at the agent?
Alex: The study found it does — meaningfully so. Simple instruction-based attacks, where you just change what you ask the agent, miss risks that only emerge over time. This approach exposes vulnerabilities that grow as the task gets longer and the environment accumulates small changes. The danger isn't always in the first step; sometimes it only becomes visible after many steps have compounded.
Sam: That's a genuinely important distinction. If a failure only shows up after a hundred interactions, a standard single-question test would never catch it. What was the most notable thing they found when they actually ran these tests?
Alex: Something that shifts where we should be looking. They found that an agent's "runtime implementation" — meaning the specific software interface and tools the agent uses to interact with the world — matters more than previously assumed. Even when two agents were built on the exact same underlying AI model, they showed meaningfully different vulnerabilities depending on how they were set up to act in the world.
Sam: So it's not just the "brain" of the AI that determines how safe it is. It's also the "body" — the interface, the tools, the way it reaches out and does things.
Alex: That's a useful way to put it. And it has a practical implication: you can't just evaluate the model in isolation and call it safe. You have to evaluate the whole system — the model, its tools, and the environment it operates in — together. By shifting from static prompts to evolving environments, this research offers a more realistic way to measure whether these agents can remain safe in the complex, real-world systems they're increasingly being trusted to manage. That's a meaningful step toward understanding what AI safety actually looks like in practice.
Sam: And it sounds like the answer is considerably more complicated than a single test could reveal.
Alex: Considerably. Thanks for listening to ResearchPod.