WhitzardNUWA Lab ↗
NUWANUWA INDEX

Search NUWA Index

Research · Benchmarks · Findings · Perspectives

中文
← Library

Risk Evaluation · Benchmark

AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agents

NUWA research note · independent review pending

First published: Source checked: 2026-10-25
Original source ↗Cite this record ↓
NUWA Research NoteResearch questionDesign and assumptionsSource findingsNUWA interpretationLimits and contrary evidenceResearch and decision relevanceInstitutions and rolesOriginal resources

Model-assisted reading · Selected sections of the original full text or official article; a complete section-by-section audit remains pending.

At a glance

NUWA interpretation: nonrefusal and successful harmful tool use are different outcomes.

Research question

Do safeguards prevent multi-step misuse without simply destroying agent capability?

Design and assumptions

AgentHarm uses 110 harmful tasks, 440 with augmentations, across eleven categories, synthetic tools and task-specific grading.

Source findings

In the reported comparison GPT-4o harm score increased from 48.4% to 72.7% under the tested attack.

Its refusal rate fell from 48.9% to 13.6%; these are distinct metrics (§4.2).

NUWA interpretation

NUWA interpretation: nonrefusal and successful harmful tool use are different outcomes.

Limits and contrary evidence

Grading depends on custom synthetic tools, limiting direct transfer to other tools and scaffolds (§5).

Research and decision relevance

Model recommendation: pair harmful-task completion with benign capability checks and name the exact attack condition.

Precise source locations

Source checking, extraction, editorial approval and replication are recorded separately. Methodology →

Institutions and roles

Research by Gray Swan AIUK AI Security Institute

Authors (14)

Maksym Andriushchenko · Alexandra Souly · Mateusz Dziemian · Derek Duenas · Maxwell Lin · Justin Wang · Dan Hendrycks · Andy Zou · Zico Kolter · Matt Fredrikson · Eric Winsor · Jerome Wynne · Yarin Gal · Xander Davies

Evaluation protocols

AgentHarm →

Cite and reuse

Cite the original publication for its findings. Cite this NUWA record separately for its explanation and retained snapshot.

BibTeX ↓RIS ↓Record + source metadata · JSON ↓Reading coverage · JSONSuggest a correction
Original publication · BibTeX
@misc{agentharm,
  title = {AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agents},
  url = {https://arxiv.org/abs/2410.09024v3},
  author = {Maksym Andriushchenko and Alexandra Souly and Mateusz Dziemian and Derek Duenas and Maxwell Lin and Justin Wang and Dan Hendrycks and Andy Zou and Zico Kolter and Matt Fredrikson and Eric Winsor and Jerome Wynne and Yarin Gal and Xander Davies},
  year = {2024},
  date = {2024-10-11},
  version = {arXiv:2410.09024v3},
  note = {arXiv:2410.09024v3}
}
NUWA record · BibTeX
@misc{agentharm-nuwa,
  title = {AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agents — NUWA research record},
  url = {https://whitzard.tech/en/nuwa/whitzard-index/work/agentharm/},
  version = {2026-10-29.1},
  organization = {NUWA Frontier AI Safety Lab},
  howpublished = {Retained note edition: https://whitzard.tech/nuwa/whitzard-index/data/record-editions/2026-10-29.1--agentharm.json},
  note = {NUWA research note. Source-reading scope and independent review status are stated on the record. Snapshot 2026-10-29.1. Retained note edition: https://whitzard.tech/nuwa/whitzard-index/data/record-editions/2026-10-29.1--agentharm.json.}
}

Evidence snapshot 2026-10-29.1 · Index updates · RSS

References

  1. [1] Maksym Andriushchenko, Alexandra Souly, et al.. AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agents. 2025-04-18. v3 [arXiv]; Author affiliations on the original paper title page; Abstract; §3.1 Overview of AgentHarm