{"schemaVersion":"nuwa-current-record-1","version":"2026-10-29.1","publication":"published","work":{"id":"agentharm","title":"AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agents","aliases":["AgentHarm"],"authors":["Maksym Andriushchenko","Alexandra Souly","Mateusz Dziemian","Derek Duenas","Maxwell Lin","Justin Wang","Dan Hendrycks","Andy Zou","Zico Kolter","Matt Fredrikson","Eric Winsor","Jerome Wynne","Yarin Gal","Xander Davies"],"primaryFunction":"evaluation","secondaryFunctions":[],"kind":"benchmark","sourceId":"agentharm","attributionSourceId":"agentharm-author-source","originalUrl":"https://arxiv.org/abs/2410.09024v3","publicationDate":"2024-10-11","updatedOn":"2026-10-25","areas":[],"scopeNote":{"en":"General safety evidence retained for context; no defensible direct link to the six NUWA risk entries was found.","zh":"保留为一般安全参考；当前无法据来源建立与六个 NUWA 风险入口的直接关联。"},"protocolIds":["agentharm"],"contributions":[{"organizationId":"grayswan","role":"research","sourceId":"agentharm-author-source","locator":"Author affiliations on the original paper title page"},{"organizationId":"aisi","role":"research","sourceId":"agentharm-author-source","locator":"Author affiliations on the original paper title page"}],"summary":{"en":"Harmful multi-step requests to tool-using agents.","zh":"面向工具型智能体的有害多步骤请求。"},"note":{"question":{"en":"Harmful task completion and refusal under specified attacks.","zh":"指定攻击下的有害任务完成和拒答表现。"},"method":{"en":"AI agent responding to harmful task requests","zh":"响应有害任务请求的 AI 智能体"},"finding":{"en":"Harmful multi-step requests to tool-using agents.","zh":"面向工具型智能体的有害多步骤请求。"},"supports":null,"limits":{"en":"Synthetic tools and task completion do not directly measure real-world harm.","zh":"合成工具与任务完成情况不直接衡量现实损害。"},"connections":null},"resources":[],"noteStatus":{"question":"limited","method":"limited","finding":"limited","supports":"limited","limits":"limited","connections":"limited"},"noteAvailability":{"en":"Existing source-specific draft sections are retained with limited review status. A complete methods, findings and limitations check remains pending; generic sections were omitted.","zh":"已有的来源相关草稿章节予以保留，审核状态为有限核查。完整的方法、发现与限制核查仍待完成；通用套话章节已省略。"},"noteSourceLocator":"Retained existing source-specific note sections; this pass audits duplicate/boilerplate structure and source availability, not complete section-level verification.","tags":[]},"reading":{"id":"agentharm","title":"AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agents","en":{"question":"Do safeguards prevent multi-step misuse without simply destroying agent capability?","design":"AgentHarm uses 110 harmful tasks, 440 with augmentations, across eleven categories, synthetic tools and task-specific grading.","findings":["In the reported comparison GPT-4o harm score increased from 48.4% to 72.7% under the tested attack.","Its refusal rate fell from 48.9% to 13.6%; these are distinct metrics (§4.2)."],"interpretation":"NUWA interpretation: nonrefusal and successful harmful tool use are different outcomes.","limits":"Grading depends on custom synthetic tools, limiting direct transfer to other tools and scaffolds (§5).","decisionRelevance":"Model recommendation: pair harmful-task completion with benign capability checks and name the exact attack condition.","takeaway":"NUWA interpretation: nonrefusal and successful harmful tool use are different outcomes.","connections":[],"scoring":"Task-rubric harmful completion and refusal rate are separate metrics.","conditions":"Custom synthetic tools; 110 base tasks or 440 augmented tasks.","statistics":"In the reported comparison GPT-4o harm score increased from 48.4% to 72.7% under the tested attack. Its refusal rate fell from 48.9% to 13.6%; these are distinct metrics (§4.2).","usage":"Model recommendation: pair harmful-task completion with benign capability checks and name the exact attack condition."},"zh":{"question":"防护能否阻止多步滥用，同时不只是破坏智能体能力？","design":"AgentHarm 含十一类110项恶意任务，增强后440项，采用合成工具和逐任务判分。","findings":["所报GPT-4o伤害得分在受测攻击下从48.4%升至72.7%。","拒绝率从48.9%降至13.6%，两者指标不同（§4.2）。"],"interpretation":"NUWA 解读：不拒绝与成功完成恶意工具任务是不同结果。","limits":"判分绑定定制合成工具，不能直接迁移到其他工具与框架（§5）。","decisionRelevance":"模型建议：同时核对恶意完成与良性能力，并标注具体攻击条件。","takeaway":"NUWA 解读：不拒绝与成功完成恶意工具任务是不同结果。","connections":[],"scoring":"任务量表恶意完成与拒绝率为不同指标。","conditions":"定制合成工具，110基础或440增强任务。","statistics":"所报GPT-4o伤害得分在受测攻击下从48.4%升至72.7%。 拒绝率从48.9%降至13.6%，两者指标不同（§4.2）。","usage":"模型建议：同时核对恶意完成与良性能力，并标注具体攻击条件。"},"assertionPolicy":{"question":"source-research-question","design":"source-finding","findings":"source-finding","interpretation":"nuwa-interpretation","limits":"source-limit-or-explicit-editorial-scope-limit","connections":"source-supported-relationship-only","decisionRelevance":"model-recommendation-not-source-conclusion"},"sourceRefs":[{"sourceId":"agentharm-author-source","url":"https://arxiv.org/html/2410.09024v3","locator":"Abstract","version":"Selected original resource https://arxiv.org/html/2410.09024v3; sha256:df646fcb08130ba2d9278560fdfab308fd50491576fbb391ad6843a8697a886a; archived source capture; exact capture time not independently established","artifactSha256":"df646fcb08130ba2d9278560fdfab308fd50491576fbb391ad6843a8697a886a"},{"sourceId":"agentharm-author-source","url":"https://arxiv.org/html/2410.09024v3","locator":"§3.1 Overview of AgentHarm","version":"Selected original resource https://arxiv.org/html/2410.09024v3; sha256:df646fcb08130ba2d9278560fdfab308fd50491576fbb391ad6843a8697a886a; archived source capture; exact capture time not independently established","artifactSha256":"df646fcb08130ba2d9278560fdfab308fd50491576fbb391ad6843a8697a886a"},{"sourceId":"agentharm-author-source","url":"https://arxiv.org/html/2410.09024v3","locator":"§4.2 Main Results","version":"Selected original resource https://arxiv.org/html/2410.09024v3; sha256:df646fcb08130ba2d9278560fdfab308fd50491576fbb391ad6843a8697a886a; archived source capture; exact capture time not independently established","artifactSha256":"df646fcb08130ba2d9278560fdfab308fd50491576fbb391ad6843a8697a886a"},{"sourceId":"agentharm-author-source","url":"https://arxiv.org/html/2410.09024v3","locator":"§5 Discussion","version":"Selected original resource https://arxiv.org/html/2410.09024v3; sha256:df646fcb08130ba2d9278560fdfab308fd50491576fbb391ad6843a8697a886a; archived source capture; exact capture time not independently established","artifactSha256":"df646fcb08130ba2d9278560fdfab308fd50491576fbb391ad6843a8697a886a"}],"publication":{"state":"published","publishedOn":"2026-10-29","authorizationReference":"user-authorized-global-index-publication-2026-10-29","reviewedCandidateId":"local-6efe31bc4a0c0f37"},"review":{"state":"published-note","sourceScope":"full-text","availableScope":null,"readingCoverage":"selected-source-sections; not a complete section-by-section paper audit","completePaperAudit":false,"independentEvidenceReview":"pending-human-review","bilingualEditorialReview":"pending-human-review","authorship":"model-assisted-research-note","preparedFingerprint":"3941c20ce127f01e06a25236a252d38bad23ee0c1b0e53357a75ac70e3f7424e"}},"sources":[{"id":"agentharm","title":"AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agents","url":"https://arxiv.org/abs/2410.09024v3","version":"arXiv:2410.09024v3","publicationDate":"2025-04-18","datePrecision":"day","type":"benchmark","verifiedOn":"2026-10-24","documentId":"arxiv:2410.09024","authors":["Maksym Andriushchenko","Alexandra Souly","Mateusz Dziemian","Derek Duenas","Maxwell Lin","Justin Wang","Dan Hendrycks","Andy Zou","Zico Kolter","Matt Fredrikson","Eric Winsor","Jerome Wynne","Yarin Gal","Xander Davies"],"aliases":["https://doi.org/10.48550/arXiv.2410.09024","https://arxiv.org/abs/2410.09024","https://arxiv.org/pdf/2410.09024"]}]}