OpenART：通過開放式環境演化擴展智能體紅隊測試

摘要

AI智能體在持久環境中運作，環境中早期的狀態變化可能對遙遠未來的決策產生影響。與傳統語言模型互動不同，智能體行為是透過一個共享狀態來調節的，該狀態在長時程工作流程中被反覆修改並重用。目前的安全基準測試往往因聚焦於短暫且靜態的任務，而無法捕捉這些累積風險。為了解決這些限制，我們引入了OpenART——一個透過環境演化實現可擴展智能體紅隊測試的開放式競技場。OpenART提供了涵蓋50個領域、超過10,000個經驗證的有狀態場景，並從超過500,000個工具與技能的資源池中汲取素材。這些任務的中位數工具呼叫次數為97次，並支援跨75種不同智能體模型配置的統一評估。為了系統性地探索這些持續演化的攻擊面，我們提出了演化馬可夫超圖攻擊（EMHA）。EMHA是一種黑箱策略，透過協調授權的狀態轉換來執行回饋驅動的環境演化，無需進行參數更新。在整個評估過程中，任務目標保持固定，僅有環境狀態發生變化。在所有配置中，EMHA達到了85.0%的彙總攻擊成功率（ASR）。相較於僅指令演化，其優勢從簡單環境中的約2%擴大到最複雜環境中的超過17%，顯示隨著任務複雜度的增長，環境演化日益暴露安全缺陷。此外，我們的分析表明，智能體的具體運行時實作解釋了超出底層模型能力之外的安全變異的顯著部分。這些結果確立了OpenART作為在複雜、演化環境中研究智能體安全的可擴展基礎。

English

AI agents operate in persistent environments where early state changes can influence decisions far into the future. Unlike conventional language-model interactions, agent behavior is mediated through a shared state that is repeatedly modified and reused across long-horizon workflows. Current safety benchmarks often fail to capture these cumulative risks because they focus on short, static tasks. To address these limitations, we introduce OpenART, an open-ended arena for scalable agent red teaming through environment evolution. OpenART provides over 10,000 validated stateful scenarios across 50 domains, drawing from a pool of more than 500,000 tools and skills. These tasks require a median of 97 tool calls and enable unified evaluation across 75 different agent-model configurations. To systematically explore these evolving attack surfaces, we propose the Evolutionary Markov Hypergraph Attack (EMHA). EMHA is a black-box policy that performs feedback-driven environment evolution by coordinating authorized state transitions without requiring parameter updates. Throughout the evaluation, task objectives remain fixed while only the environment state changes. Across all configurations, EMHA achieves a pooled Attack Success Rate (ASR) of 85.0%. Its advantage over instruction-only evolution increases from approximately 2% on simple environments to over 17% on the most complex ones, demonstrating that environment evolution increasingly exposes safety failures as task complexity grows. Furthermore, our analysis shows that the specific runtime implementation of an agent explains a significant portion of safety variation beyond the underlying model's capabilities. These results establish OpenART as a scalable foundation for studying agent safety in complex, evolving environments.