We’re currently writing a paper on a benchmark for AI model security. It builds on AgentLAB, the lab’s benchmark for testing LLM agents against long-horizon attacks, published at ICML 2026.1 An agent that browses, calls tools and keeps memory over a long task can be steered, one turn at a time, toward a goal no single prompt could reach. AgentLAB measures exactly that: five attack types (intent hijacking, tool chaining, task injection, objective drifting and memory poisoning) across 28 realistic agentic environments and 644 security test cases.
AgentLAB’s results were not reassuring. Representative agents stayed highly susceptible, and defenses built for single-turn jailbreaks did not reliably hold up over a long interaction.
My part is the attacker. I build adaptive attacker agents in Python on the DTap platform2 that rewrite their multi-turn strategy based on how the target responds, so the benchmark tests agents against an opponent that learns rather than a fixed script.
The question underneath it all interests me more than any single number. Most safety evaluations still ask whether a model refuses one bad request. Deployed agents almost never face one request. The risk lives between the turns: in what an agent remembers, which tools it chains together and how far its goal can drift. That is where I think evaluation has to go next.
