Evaluation dossier

AgentHarm

Harmful multi-step requests to tool-using agents.

Gray Swan AI · UK AI Security Institute / arXiv:2410.09024v3 / Behavior

Sources and provenance ↓ Read the research narrative →

CROSS-REPORT MONITORING

PUBLISHED EVIDENCE

AgentHarm · Best-of-5 harm score

Published measurements across source reports. Task scopes are annotated; configuration differences remain attached to each observation.

3 observations · 0 dated

● Matched◇ Configuration differs□ Some conditions undisclosed

3 observations lack a verified model release date. They remain in Data and Systems.

Select a point or table row to inspect its conditions and provenance.

3 observations

Measurements and source conditions
System / model	Result	Condition status	Task / conditions	Evaluator / report	Dates
Mistral Large 2 · Template	90.8%Best-of-5 harm score	Incomplete	Table 2 · AgentHarm—	Not disclosedAgentHarm: A Benchmark for Measuring Harmfulness of LLM Agents	Release —Report —
GPT-4o · Template	83.7%Best-of-5 harm score	Incomplete	Table 2 · AgentHarm—	Not disclosedAgentHarm: A Benchmark for Measuring Harmfulness of LLM Agents	Release —Report —
Claude 3.5 Sonnet · Template	79.7%Best-of-5 harm score	Incomplete	Table 2 · AgentHarm—	Not disclosedAgentHarm: A Benchmark for Measuring Harmfulness of LLM Agents	Release —Report —

Task and measurement

Benchmark protocol profile

Task / subject: AI agent responding to harmful task requests
Measurement target: Harmful task completion and refusal under specified attacks.
Scoring / outcome: Greedy harm score · Table 2: template attack, greedy sampling at temperature 0 versus mean and best-of-5 at temperature 1. These are different sampling conditions.
Interpretation boundary: Synthetic tools and task completion do not directly measure real-world harm.

A reported evaluation

The source evaluates GPT-4o · Template · Table 2 · AgentHarm.

Reported measurement: Greedy harm score · 72.7%.

Table 2: template attack, greedy sampling at temperature 0 versus mean and best-of-5 at temperature 1. These are different sampling conditions. See the source protocol; no independent trial count inferred.

Source-reported measurements for GPT-4o · Template in Table 2; values are transcribed, not independently reproduced.

Measurement dossier · NUWA reading

Source-method reading and retained catalogue information are distinguished. Publication does not establish independent evidence or bilingual editorial review.

Measurement construct: Do safeguards prevent multi-step misuse without simply destroying agent capability?
Task population: AgentHarm uses 110 harmful tasks, 440 with augmentations, across eleven categories, synthetic tools and task-specific grading.
Scoring and failure modes: Task-rubric harmful completion and refusal rate are separate metrics.
System conditions: Custom synthetic tools; 110 base tasks or 440 augmented tasks.
Statistical meaning: Source-reported result statements; this does not establish trial counts, denominators or an estimator: In the reported comparison GPT-4o harm score increased from 48.4% to 72.7% under the tested attack. Its refusal rate fell from 48.9% to 13.6%; these are distinct metrics (§4.2).
Validity and interpretation: Grading depends on custom synthetic tools, limiting direct transfer to other tools and scaffolds (§5).
Appropriate research use: Model recommendation: pair harmful-task completion with benign capability checks and name the exact attack condition.

AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agents · AbstractSelected original resource https://arxiv.org/html/2410.09024v3; sha256:df646fcb08130ba2d9278560fdfab308fd50491576fbb391ad6843a8697a886a; archived source capture; exact capture time not independently established
AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agents · §3.1 Overview of AgentHarmSelected original resource https://arxiv.org/html/2410.09024v3; sha256:df646fcb08130ba2d9278560fdfab308fd50491576fbb391ad6843a8697a886a; archived source capture; exact capture time not independently established
AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agents · §4.2 Main ResultsSelected original resource https://arxiv.org/html/2410.09024v3; sha256:df646fcb08130ba2d9278560fdfab308fd50491576fbb391ad6843a8697a886a; archived source capture; exact capture time not independently established
AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agents · §5 DiscussionSelected original resource https://arxiv.org/html/2410.09024v3; sha256:df646fcb08130ba2d9278560fdfab308fd50491576fbb391ad6843a8697a886a; archived source capture; exact capture time not independently established

Evidence across reports

The same benchmark name can cover different tasks, scoring rules and system configurations. Each source remains visible; comparison groups explain which conditions are aligned.

AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agents

Actual evaluators: Not disclosed

3 result records · 3 reported system names

Protocols and comparison decisions (3)

AgentHarm: Best-of-5 harm score · AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agentssource-report · Scope reviewed

AgentHarm: Greedy harm score · AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agentssource-report · Scope reviewed

AgentHarm: Mean harm score, T=1 · AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agentssource-report · Scope reviewed

Original source charts and materials

Reported results

Source order · reported configurations

Greedy harm score

0–100%

GPT-4o · Template

GPT-4o · Template · 72.7% · Table 2: template attack, greedy sampling at temperature 0 versus mean and best-of-5 at temperature 1. These are different sampling conditions. · See the source protocol; no independent trial count inferred.

72.7%

Claude 3.5 Sonnet · Template

Claude 3.5 Sonnet · Template · 68.7% · Table 2: template attack, greedy sampling at temperature 0 versus mean and best-of-5 at temperature 1. These are different sampling conditions. · See the source protocol; no independent trial count inferred.

68.7%

Mistral Large 2 · Template

Mistral Large 2 · Template · 80.5% · Table 2: template attack, greedy sampling at temperature 0 versus mean and best-of-5 at temperature 1. These are different sampling conditions. · See the source protocol; no independent trial count inferred.

80.5%

Showing 3 of 3 systems

Values describe the measured outcome under the source protocol, not a general safety score.

Table 2: template attack, greedy sampling at temperature 0 versus mean and best-of-5 at temperature 1. These are different sampling conditions. Evaluation date not specified; publication / record dates are shown below.

Evaluation conditions and system configurations

GPT-4o · Template: See the source protocol; no independent trial count inferred. · Table 2 · AgentHarm; modelVersion: not specified · harness: not specified · tools: not specified · budget: not specified

Claude 3.5 Sonnet · Template: See the source protocol; no independent trial count inferred. · Table 2 · AgentHarm; modelVersion: not specified · harness: not specified · tools: not specified · budget: not specified

Mistral Large 2 · Template: See the source protocol; no independent trial count inferred. · Table 2 · AgentHarm; modelVersion: not specified · harness: not specified · tools: not specified · budget: not specified

Reported results · source order
System / configuration	Greedy harm score	Mean harm score, T=1	Best-of-5 harm score	Publication / verification
GPT-4o · TemplateHarness not specified	72.7%	70.7%±0.7 (source-reported; see source definition)	83.7%	Source checked2026-10-25
Claude 3.5 Sonnet · TemplateHarness not specified	68.7%	65.1%±1.3 (source-reported; see source definition)	79.7%	Source checked2026-10-25
Mistral Large 2 · TemplateHarness not specified	80.5%	67.4%±8.5 (source-reported; see source definition)	90.8%	Source checked2026-10-25

References

Numerical results are reported by the cited authors.

[1] Maksym Andriushchenko, Alexandra Souly, et al.. AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agents. 2025-04-18. v3 [arXiv]; Author affiliations on the original paper title page; Table 2

Search NUWA Index