flaw0 · agent red teaming

Red teaming for agents, on an open benchmark

flaw0 attacks an agent's own loop — the prompts it reads, the content it retrieves, the tools it can call — not networks or hosts. And it publishes the results as an open benchmark: a shared test set that ranks the security of agent harness × model combinations, so you can see which pairing is actually safe to trust.

the matrix — one test set, every combination
                 model A     model B     model C
harness: claude-code   ▓▓▓░░       ▓▓▓▓░       ▓▓░░░
harness: openclaw      ▓▓▓▓░       ▓▓▓░░       ▓▓▓▓▓
harness: codex         ▓▓░░░       ▓▓▓▓░       ▓▓▓░░
harness: your-agent      ?           ?           ?

  ▓ = attacks resisted   ░ = attacks that got through
  every cell is the same adversarial test set, run in a sandbox

Security is not a property of the model alone, or the harness alone — it is a property of the pair. flaw0 measures the pair.

Not traditional red teaming

A different target, and an open result

The word is borrowed; the discipline is new. Nothing here scans a subnet — every scenario is aimed at what makes an agent an agent, and the outcome is a number you can reproduce.

Target
Hosts, ports, services, employees.
The agent's decision loop: system prompt, retrieved content, tool calls, memory.
Payload
Exploits against software and infrastructure.
Language: injected instructions, jailbreaks, lures the model will act on.
Success
Shell, credentials, lateral movement.
The agent takes an action nobody authorized — sends, deletes, installs, discloses.
Result
A private report for one target.
A public, reproducible score for a harness × model combination anyone can check.

The benchmark

A public test set for agent security

flaw0 releases an open, versioned set of adversarial scenarios — prompt injection, jailbreaks, data-exfiltration lures, malicious tool-call bait, permission escalation — and runs every one against real agents in a sandboxed harness. The same test set, run across many harness × model pairings, produces a leaderboard of who resists what.

Open and reproducible

The scenarios, the harness, and the scoring are public. A result you can re-run is a result you can trust — the opposite of a private pentest report.

The pair is the unit

The same model is safer in one harness than another, and the same harness is safer with one model than another. flaw0 scores the combination, because that is what you actually deploy.

Bring your own

Plug in your harness, your model, or both. Run the public set locally, or submit a combination to the leaderboard.

Where it fits

One phase of three

An agent you can trust with real work is red-team tested before it ships, has guardrails on every action while it runs, and can analyze the hostile files it encounters. flaw0 is the first phase — the adversarial test an agent must pass before you trust it.