{"schemaVersion":"nuwa-current-record-1","version":"2026-10-29.1","publication":"published","work":{"id":"basharena","title":"BashArena: A Control Setting for Highly Privileged AI Agents","aliases":[],"authors":["Adam Kaufman","James Lucassen","Tyler Tracy","Cody Rushing","Aryan Bhatt"],"primaryFunction":"governance","secondaryFunctions":[{"function":"evaluation","rationale":{"en":"The work defines or applies an explicit evaluation setting in addition to its main monitoring or control contribution.","zh":"该工作除主要监测或控制贡献外，还定义或应用了明确评测设置。"}}],"kind":"benchmark","sourceId":"basharena-publication","attributionSourceId":"basharena-publication-author-source","originalUrl":"https://arxiv.org/abs/2512.15688","publicationDate":"2025-12-17","updatedOn":"2026-10-25","areas":["deception","cybersecurity"],"scopeNote":{"en":"Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.","zh":"风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。"},"protocolIds":["basharena"],"contributions":[{"organizationId":"redwood","role":"research","sourceId":"basharena-publication-author-source","locator":"Author affiliations on the original paper title page"}],"summary":{"en":"Provides a control setting for privileged agents, combining legitimate administration tasks with sabotage objectives.","zh":"为高权限智能体提供控制研究环境，将正常管理任务与破坏目标结合。"},"note":{"question":{"en":"How can control protocols be tested when useful software tasks and sabotage require overlapping privileges?","zh":"当正常软件任务与破坏行为需要重叠权限时，应如何测试控制协议？"},"method":{"en":"BashArena supplies containerized, privileged system-administration tasks with legitimate main objectives and security-failure side objectives. Honest and adversarial policies are evaluated on task tests, side-task outcomes, monitoring and sandbox restrictions.","zh":"BashArena 提供容器化、具有较高权限的系统管理任务，同时设置正常主要目标与安全失效附加目标。研究通过任务测试、附加目标结果、监测和沙箱限制评估诚实及对抗策略。"},"finding":{"en":"The experiments exhibit sabotage opportunities and a trade-off between restricting privileges and retaining main-task performance. The dataset is designed to make simple permission removal insufficient for studying useful control.","zh":"实验呈现了破坏机会，以及限制权限与保留正常任务表现之间的权衡。该数据集旨在避免仅靠移除权限就能轻易解决控制问题，使任务效用仍需被考虑。"},"supports":{"en":"This is an evaluation environment for protocol development; a successful side task is a security failure in that environment, not a real-world incident.","zh":"这是用于开发控制协议的评估环境；附加任务成功表示该环境中的安全失效，并非现实事件。"},"limits":{"en":"The paper reports few side-task types, some remaining sandboxing options, and test cases whose fraction-passed score can behave non-monotonically as a solution becomes more complete.","zh":"论文指出附加任务种类有限，仍存在部分可用的沙箱限制；个别测试的通过比例还可能随方案完整度增加而出现非单调变化。"},"connections":{"en":"The authors contrast BashArena with the narrower BashBench side task and with APPS backdooring’s single-action setting.","zh":"作者将 BashArena 与附加任务较窄的 BashBench，以及单动作的 APPS 后门设置进行比较。"}},"resources":[],"noteStatus":{"question":"verified","method":"verified","finding":"verified","supports":"verified","limits":"verified","connections":"verified"},"noteAvailability":{"en":"The substantive sections shown here were checked against the original source. Unfilled sections are omitted; source checking is not experimental replication.","zh":"此处展示的实质性章节已对照原始来源核查；未完成的章节已省略。来源核查不等于实验复现。"},"noteSourceLocator":"arXiv:2512.15688v1, §§2, 3.2, 4.1–4.4, 5–6","tags":[]},"reading":{"id":"basharena","title":"BashArena: A Control Setting for Highly Privileged AI Agents","en":{"takeaway":"Privileged administration tasks expose a control trade-off that depends on trajectory-level false alarms and attack scope.","question":"How well can agents perform useful privileged work, sabotage it, and detect sabotage in a common environment?","design":"Generated administration tasks pair with four fixed side-task families. Monitors inspect action history; attack and monitor comparisons hold different counterpart policies fixed.","findings":["The reported safety metric excludes undetected unsuccessful attacks from its denominator.","Low-false-alarm monitoring benefits from score ensembling; monitor errors often involve tracking multi-step data flows."],"interpretation":"NUWA interpretation: per-action suspicion accuracy does not directly express deployment safety or the cost of interrupting whole trajectories.","limits":"Only four sabotage families are included. Attack selection was not explored, elicitation concentrated on one model, and generated tests sometimes reward incomplete solutions.","connections":["NUWA connection: Ctrl-Z studies resampling with a narrower task/failure setting; async-control tests after-the-fact review across different environments."],"decisionRelevance":"NUWA recommendation: retain the honest calibration policy, trajectory false-positive rate and attack families when comparing control protocols."},"zh":{"takeaway":"高权限管理任务暴露出依赖轨迹误报率和攻击范围的控制权衡。","question":"共同环境中，智能体完成有效高权限工作、实施破坏及识别破坏的表现如何？","design":"生成的管理任务配对四类固定副任务；监控读取动作历史，攻击者和监控比较分别固定另一方策略。","findings":["安全指标的分母排除了未检测到但也未成功的攻击。","低误报监控受益于评分集成，错误常涉及多步数据流追踪。"],"interpretation":"NUWA 解读：逐动作可疑度准确率不能直接表示部署安全或中断整条轨迹的成本。","limits":"仅有四类破坏目标，未探索攻击选择，能力引出集中于单一模型；部分生成测试会奖励不完整解。","connections":["NUWA 关联：Ctrl-Z 在更窄任务与失败设置中研究重采样；异步控制跨不同环境测试事后审核。"],"decisionRelevance":"NUWA 建议：比较协议时保留诚实校准策略、轨迹误报率和攻击家族。"},"sourceRefs":[{"sourceId":"basharena-publication","url":"https://arxiv.org/html/2512.15688","locator":"2 Dataset","version":"Selected original resource https://arxiv.org/html/2512.15688; sha256:d492196ad3ecd5463eb9964d4ff5a9095374673e84900d06ad7a76d8305474a0; archived source capture; exact capture time not independently established","artifactSha256":"d492196ad3ecd5463eb9964d4ff5a9095374673e84900d06ad7a76d8305474a0"},{"sourceId":"basharena-publication","url":"https://arxiv.org/html/2512.15688","locator":"4.1 Methodology","version":"Selected original resource https://arxiv.org/html/2512.15688; sha256:d492196ad3ecd5463eb9964d4ff5a9095374673e84900d06ad7a76d8305474a0; archived source capture; exact capture time not independently established","artifactSha256":"d492196ad3ecd5463eb9964d4ff5a9095374673e84900d06ad7a76d8305474a0"},{"sourceId":"basharena-publication","url":"https://arxiv.org/html/2512.15688","locator":"4.2 Sabotage results","version":"Selected original resource https://arxiv.org/html/2512.15688; sha256:d492196ad3ecd5463eb9964d4ff5a9095374673e84900d06ad7a76d8305474a0; archived source capture; exact capture time not independently established","artifactSha256":"d492196ad3ecd5463eb9964d4ff5a9095374673e84900d06ad7a76d8305474a0"},{"sourceId":"basharena-publication","url":"https://arxiv.org/html/2512.15688","locator":"4.3 Monitoring Results","version":"Selected original resource https://arxiv.org/html/2512.15688; sha256:d492196ad3ecd5463eb9964d4ff5a9095374673e84900d06ad7a76d8305474a0; archived source capture; exact capture time not independently established","artifactSha256":"d492196ad3ecd5463eb9964d4ff5a9095374673e84900d06ad7a76d8305474a0"},{"sourceId":"basharena-publication","url":"https://arxiv.org/html/2512.15688","locator":"5 Limitations","version":"Selected original resource https://arxiv.org/html/2512.15688; sha256:d492196ad3ecd5463eb9964d4ff5a9095374673e84900d06ad7a76d8305474a0; archived source capture; exact capture time not independently established","artifactSha256":"d492196ad3ecd5463eb9964d4ff5a9095374673e84900d06ad7a76d8305474a0"}],"publication":{"state":"published","publishedOn":"2026-10-29","authorizationReference":"user-authorized-global-index-publication-2026-10-29","reviewedCandidateId":"local-6efe31bc4a0c0f37"},"review":{"state":"published-note","sourceScope":"full-text","availableScope":null,"readingCoverage":"selected substantive sections of the full source body","completePaperAudit":false,"independentEvidenceReview":"pending-human-review","bilingualEditorialReview":"pending-human-review","authorship":"model-assisted-research-note","preparedFingerprint":"209e581558274422594b4c9a76f92eb8e3f41f20a93212f03d08d0135580db72"}},"sources":[{"id":"basharena-publication","title":"BashArena: A Control Setting for Highly Privileged AI Agents","url":"https://arxiv.org/abs/2512.15688","version":"arXiv:2512.15688v1","publicationDate":"2025-12-17","datePrecision":"day","type":"paper","verifiedOn":"2026-10-25","documentId":"arxiv:2512.15688","authors":["Adam Kaufman *","James Lucassen *"],"aliases":["https://doi.org/10.48550/arXiv.2512.15688","https://arxiv.org/abs/2512.15688","https://arxiv.org/pdf/2512.15688"]}]}