Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-08-11 · high
ActBench ran 24,000 attack trajectories across 15 models and six harnesses; no harness pushed success below 73.7%.
Why now: ActBench's code and trajectories went public on GitHub on August 10, giving teams a way to test their own agent stack before trusting the wrapper.
ActBench ran 24,000 attack trajectories against 15 models and six open-source cowork agent harnesses, and the model mattered more than the harness, per the August 10 benchmark.
That gap matters for anyone assuming a well-built agent wrapper keeps them safe. Attack success held between 73.7% and 94.4% no matter which harness ran the task; swapping the model alone pushed it down to 10.1%.
ActBench pairs 600 test cases across 213 scenarios with a benign task and an adversarial twin. Each twin keeps the same instructions, config, and starting state but slips in a payload the agent can reach through its own tools. It spans 15 risk behaviors, six execution spaces, and 48 web-service APIs. It scores what the agent does at each step of a trajectory, before the final response ever lands.
No harness tested got anywhere close to zero attack success, which undercuts the idea that scaffolding and permission checks are the primary safety layer. A related benchmark on the same thread argues the fix is splitting safety logic into separate pieces, not hardening the harness as one block.
Teams picking a coordination framework for safety are optimizing the wrong layer. This data says the model underneath decides whether an injected payload executes, and a harness swap won't move that number much. ActBench's code went public on GitHub on August 10, so any team running cowork agents can rerun the same 600 cases before trusting the wrapper.
Each link below shares sources, entities, or timing with this story.
HarnessRisk ran 128 sandboxed attacks across 14 model/harness setups and found configs that flagged the risk over 90% of the time still let it execute.
The attack hides malicious intent across separate skills that only turn dangerous when they pass work to each other, and a fix cuts success to 22.5%.
The two judges scoring these 14,560 attacks disagreed by more than 3x on how often DeepSeek's agent partially complied.
Adding a third label instead of forcing human-or-bot gives every AI agent a perfect detection score, because Playwright never generates real pointer telemetry.
A training-free fix called ChannelGuard held steady across three model backends, filter or no filter, blocking every tool-poisoning attempt.
A 4,181-problem study found confidence-based escalation beats a frozen router by 4.2 points while using 37% fewer tokens.
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.