{"schemaVersion":"nuwa-current-record-1","version":"2026-10-29.1","publication":"published","work":{"id":"agent-safetybench","title":"Agent-SafetyBench: Evaluating the Safety of LLM Agents","aliases":["Agent-SafetyBench"],"authors":["Zhexin Zhang","Shiyao Cui","Yida Lu","Jingzhuo Zhou","Junxiao Yang","Hongning Wang","Minlie Huang"],"primaryFunction":"evaluation","secondaryFunctions":[],"kind":"benchmark","sourceId":"agent-safetybench-publication","attributionSourceId":"agent-safetybench-publication-author-source","originalUrl":"https://arxiv.org/abs/2412.14470","publicationDate":"2024-12-19","updatedOn":"2026-10-25","areas":[],"scopeNote":{"en":"The main dimension follows the task outcome in the original protocol. Topic relevance is documented in the parent research record; no unreviewed question-level links are inferred.","zh":"主维度依据原协议的任务结果确定。主题关联见研究档案，不推断尚未审阅的问题级关联。"},"protocolIds":["agent-safetybench"],"contributions":[{"organizationId":"tsinghua","role":"research","sourceId":"agent-safetybench-publication-author-source","locator":"Author affiliations on the original paper title page"}],"summary":{"en":"Evaluates agent safety through interactive environments and tool use, separating agent-level failures from chatbot-only tests.","zh":"通过交互环境和工具使用评测智能体安全，区分智能体层面失败与纯对话测试。"},"note":{"question":null,"method":null,"finding":null,"supports":null,"limits":null,"connections":null},"resources":[],"noteStatus":{"question":"limited","method":"limited","finding":"limited","supports":"limited","limits":"limited","connections":"limited"},"noteAvailability":{"en":"A substantive NUWA research note is not yet available. The repeated draft sections were removed pending review of the original methods, findings and limitations; use the original publication for the research account.","zh":"实质性的 NUWA 研究笔记尚未完成。重复草稿章节已移除，待核查原始方法、发现与限制；研究内容请以原始出版物为准。"},"noteSourceLocator":"No complete section-level method/results/limitations review completed for this note; cached original page and any chart audit retained as discovery evidence.","tags":[]},"reading":{"id":"agent-safetybench","title":"Agent-SafetyBench: Evaluating the Safety of LLM Agents","en":{"question":"Which safety failures arise when agents interact with environments and tools?","design":"349 environments and 2,000 cases cover eight risk categories and ten failure modes; existing cases are refined, deduplicated and standardized.","findings":["None of sixteen tested agents exceeded 60% total safety score.","Defense prompts gave limited benefits and some weaker models did not improve (§4.5)."],"interpretation":"NUWA interpretation: robustness and risk awareness are separable requirements for safe agent interaction.","limits":"Constructed scenarios and a particular scorer do not establish real deployment incident rates; higher capability is not a safety guarantee.","decisionRelevance":"Model recommendation: inspect failure-mode and helpfulness breakdowns rather than relying on total safety score.","takeaway":"NUWA interpretation: robustness and risk awareness are separable requirements for safe agent interaction.","connections":[],"scoring":"Case-level safety scores summarized by total/failure mode; helpfulness assessed separately.","conditions":"349 environments, 2,000 cases, sixteen tested agents.","statistics":"None of sixteen tested agents exceeded 60% total safety score. Defense prompts gave limited benefits and some weaker models did not improve (§4.5).","usage":"Model recommendation: inspect failure-mode and helpfulness breakdowns rather than relying on total safety score."},"zh":{"question":"智能体与环境、工具交互时有哪些安全故障？","design":"349环境、2,000案例覆盖八风险类及十故障模式，细化、去重并统一既有案例。","findings":["16个受测智能体总安全分均未超60%。","防御提示收益有限，部分弱模型没有改善（§4.5）。"],"interpretation":"NUWA 解读：稳健性与风险意识是安全交互的不同要求。","limits":"构造场景及特定判分不等于部署事故率，高能力也不保证安全。","decisionRelevance":"模型建议：查看故障模式与帮助性明细，不只看总分。","takeaway":"NUWA 解读：稳健性与风险意识是安全交互的不同要求。","connections":[],"scoring":"案例安全分按总分及故障模式汇总，帮助性另测。","conditions":"349环境、2,000案例、16智能体。","statistics":"16个受测智能体总安全分均未超60%。 防御提示收益有限，部分弱模型没有改善（§4.5）。","usage":"模型建议：查看故障模式与帮助性明细，不只看总分。"},"assertionPolicy":{"question":"source-research-question","design":"source-finding","findings":"source-finding","interpretation":"nuwa-interpretation","limits":"source-limit-or-explicit-editorial-scope-limit","connections":"source-supported-relationship-only","decisionRelevance":"model-recommendation-not-source-conclusion"},"sourceRefs":[{"sourceId":"agent-safetybench-publication-author-source","url":"https://arxiv.org/html/2412.14470","locator":"Abstract","version":"Selected original resource https://arxiv.org/html/2412.14470; sha256:d75e5fb230a89a9ffa0484fbfe694ac609b7b5de3aa59204cadf73b473737338; archived source capture; exact capture time not independently established","artifactSha256":"d75e5fb230a89a9ffa0484fbfe694ac609b7b5de3aa59204cadf73b473737338"},{"sourceId":"agent-safetybench-publication-author-source","url":"https://arxiv.org/html/2412.14470","locator":"§3.2.2 Refine Existing Datasets","version":"Selected original resource https://arxiv.org/html/2412.14470; sha256:d75e5fb230a89a9ffa0484fbfe694ac609b7b5de3aa59204cadf73b473737338; archived source capture; exact capture time not independently established","artifactSha256":"d75e5fb230a89a9ffa0484fbfe694ac609b7b5de3aa59204cadf73b473737338"},{"sourceId":"agent-safetybench-publication-author-source","url":"https://arxiv.org/html/2412.14470","locator":"§4.2 Main Results","version":"Selected original resource https://arxiv.org/html/2412.14470; sha256:d75e5fb230a89a9ffa0484fbfe694ac609b7b5de3aa59204cadf73b473737338; archived source capture; exact capture time not independently established","artifactSha256":"d75e5fb230a89a9ffa0484fbfe694ac609b7b5de3aa59204cadf73b473737338"},{"sourceId":"agent-safetybench-publication-author-source","url":"https://arxiv.org/html/2412.14470","locator":"§4.5 Discussion on Defense","version":"Selected original resource https://arxiv.org/html/2412.14470; sha256:d75e5fb230a89a9ffa0484fbfe694ac609b7b5de3aa59204cadf73b473737338; archived source capture; exact capture time not independently established","artifactSha256":"d75e5fb230a89a9ffa0484fbfe694ac609b7b5de3aa59204cadf73b473737338"}],"publication":{"state":"published","publishedOn":"2026-10-29","authorizationReference":"user-authorized-global-index-publication-2026-10-29","reviewedCandidateId":"local-6efe31bc4a0c0f37"},"review":{"state":"published-note","sourceScope":"full-text","availableScope":null,"readingCoverage":"selected-source-sections; not a complete section-by-section paper audit","completePaperAudit":false,"independentEvidenceReview":"pending-human-review","bilingualEditorialReview":"pending-human-review","authorship":"model-assisted-research-note","preparedFingerprint":"1d5a1630900264243a41790dcfb165b1ca684469e34297aec289e06dc996b9b6"}},"sources":[{"id":"agent-safetybench-publication","title":"Agent-SafetyBench: Evaluating the Safety of LLM Agents","url":"https://arxiv.org/abs/2412.14470","version":"arXiv:2412.14470v2","publicationDate":"2024-12-19","datePrecision":"day","type":"paper","verifiedOn":"2026-10-25","documentId":"arxiv:2412.14470","authors":["Zhexin Zhang 1 1 1 Equal contribution.","Shiyao Cui 1 1 1 Equal contribution.","Yida Lu 1 1 1 Equal contribution.","Jingzhuo Zhou 1 1 1 Equal contribution.","Junxiao Yang"],"aliases":["https://doi.org/10.48550/arXiv.2412.14470","https://arxiv.org/abs/2412.14470","https://arxiv.org/pdf/2412.14470"]}]}