flaw0 · agent red teaming
Red teaming for agents, on an open benchmark
flaw0 attacks an agent's own loop — the prompts it reads, the content it retrieves, the tools it can call — not networks or hosts. And it publishes the results as an open benchmark: a shared test set that ranks the security of agent harness × model combinations, so you can see which pairing is actually safe to trust.
model A model B model C harness: claude-code ▓▓▓░░ ▓▓▓▓░ ▓▓░░░ harness: openclaw ▓▓▓▓░ ▓▓▓░░ ▓▓▓▓▓ harness: codex ▓▓░░░ ▓▓▓▓░ ▓▓▓░░ harness: your-agent ? ? ? ▓ = attacks resisted ░ = attacks that got through every cell is the same adversarial test set, run in a sandbox
Security is not a property of the model alone, or the harness alone — it is a property of the pair. flaw0 measures the pair.
Not traditional red teaming
A different target, and an open result
The word is borrowed; the discipline is new. Nothing here scans a subnet — every scenario is aimed at what makes an agent an agent, and the outcome is a number you can reproduce.
The benchmark
A public test set for agent security
flaw0 releases an open, versioned set of adversarial scenarios — prompt injection, jailbreaks, data-exfiltration lures, malicious tool-call bait, permission escalation — and runs every one against real agents in a sandboxed harness. The same test set, run across many harness × model pairings, produces a leaderboard of who resists what.
Open and reproducible
The scenarios, the harness, and the scoring are public. A result you can re-run is a result you can trust — the opposite of a private pentest report.
The pair is the unit
The same model is safer in one harness than another, and the same harness is safer with one model than another. flaw0 scores the combination, because that is what you actually deploy.
Bring your own
Plug in your harness, your model, or both. Run the public set locally, or submit a combination to the leaderboard.
Where it fits
One phase of three
An agent you can trust with real work is red-team tested before it ships, has guardrails on every action while it runs, and can analyze the hostile files it encounters. flaw0 is the first phase — the adversarial test an agent must pass before you trust it.
flaw0
The benchmark
View →
AI Runtime Security
OpenGuardrails ↗
Learn more →
AntiMalware
malware0 ↗
Learn more →