Which harness × model actually holds up?

The rows below show the shape of the board — harness × model, overall resilience, and a breakdown by attack class. Model names are placeholders; the public test set and the first real scores are being finalized. Higher is safer (share of attacks resisted).

The test set

Seven classes of attack, versioned and open

Every scenario targets the agent's loop, not its host. The set is versioned so a score always names the version it was measured against, and grows as new attack classes are found.

01  prompt injection         instructions smuggled in content the agent reads
02  jailbreak / role-play    attempts to shed the harness's own instructions
03  data exfiltration        lures that send secrets to an attacker-chosen sink
04  malicious tool-call      bait that turns a benign tool into a weapon
05  permission escalation    getting the agent to act beyond its authorization
06  multi-turn manipulation  attacks that build across several turns
07  indirect / delayed       payloads planted for a later session to obey

Take part

Submit a combination

Run the public set against your own harness, your own model, or a pairing you want on the board. During early access, submissions and access to the test set are by request.