What is AgentThreatBench?

The OWASP Top 10 for Agentic Applications lists the main risks for AI agents, the Open Worldwide Application Security Project's follow-on to its LLM Top 10. AgentThreatBench is a small, focused suite that turns some of those risks into tests: does the agent do its job while resisting manipulation hidden in tool outputs, memory and multi-step workflows.

It runs three tasks, each with its own command.

• Memory poison (ASI06, memory and context poisoning): inspect eval inspect_evals/agent_threat_bench_memory_poison. The agent answers questions from a memory store containing adversarial entries: override instructions, contradictory facts, fake system authority, formatting tricks that break context boundaries. Easier cases append the poison next to real data; harder cases replace the data entirely, modelling an attacker with write access.
• Autonomy hijack (ASI01, agent goal hijack): an email-triage agent reads an inbox in which messages carry hidden commands, gradual goal drift or fake security directives.
• Data exfiltration (ASI01): a customer-support agent looks up a record whose free-text fields tell it to send Social Security and account numbers to an unauthorised recipient.

Each task includes clean cases with no attack, so false positives are measured too.

Utility and security are scored separately, which gives four outcomes. High utility and high security is the goal. High utility with low security means the agent works but can be steered. Low utility with high security means it is so cautious it refuses real work. Low on both means it fails either way.

The suite is small, with 6 to 10 samples per task, so treat it as a quick check for these specific OWASP risks rather than a full measurement.

Treat memory as untrusted input: record where each entry came from, restrict who can write to it, and expire it. Keep instructions and data separate, so text inside an email or customer record is never read as a command. For exfiltration, enforce recipient allow-lists and redact sensitive fields in code before the model sees them, rather than asking the model not to leak. See excessive agency, MCP tool poisoning and vector and embedding weaknesses.