{
  "schema_version": 1,
  "builder_plan": {
    "scenario": "An agent reads external documents or tool responses that may contain malicious instructions.",
    "change": "Replay attacks and legitimate lookalikes in an isolated copy of your agent workflow.",
    "baseline": "Your existing checks with the same tasks, permissions, and tool responses.",
    "steps": [
      "Locate the paper's implementation and check its license, model support, data needs, and hardware requirements. Stop here if you cannot obtain the required artifacts.",
      "Save a small set of representative product tasks and expected outcomes. Keep evaluation tasks out of any training or tuning, and choose quality and cost limits before running.",
      "Run the baseline and the proposed change on identical inputs. Keep other settings fixed and repeat paired runs to expose variation.",
      "Save per-task outputs, failures, timings, and all usage costs. Review regressions before expanding the test."
    ],
    "measure": "Successful attacks missed, legitimate actions blocked, detection delay, and review cost.",
    "decision": "Keep the change only if it meets your preselected quality and latency limits and improves the metric you care about after setup and operating costs. Otherwise retain the baseline. This is an exploration plan, not a validated recommendation."
  },
  "builder_review": null,
  "arxiv_id": "2610.02920",
  "title": "HASTE: Evolving Agent Harnesses Against Emerging Attacks Using Sparse Evidence",
  "summary": "It replaces manual, ad-hoc updates of agent safety harnesses with an automated loop in which safety-specification generation and attack-case generation adversarially evolve the harness from sparse threat evidence such as brief reports or a few attack examples. The cost is substantial orchestration complexity and repeated LLM calls for specification generation, attack probing, and evaluation feedback, all feasible on third-party APIs but adding latency and inference spend to any defense pipeline that runs it continuously. It can fail when the sparse evidence is unrepresentative of real attacks, when the attack generator overfits to its own synthetic cases and misses novel attack classes, or when harness updates over-restrict benign behavior despite the claimed utility preservation.",
  "rationale": "The framework addresses a real production problem for agent deployments and runs on API-level models, but its robustness depends on workload-specific validation of attack coverage and utility preservation before adoption.",
  "technique": "Adversarial multi-agent harness evolution from sparse threat evidence",
  "family": "seguranca_e_guardrails",
  "recommendation": "testar",
  "published": "2026-10-02",
  "as_of": "2026-10-18",
  "editorial_status": "indexed",
  "source_url": "https://arxiv.org/abs/2610.02920",
  "independent_implementations": 1,
  "total_implementations": 2,
  "stars": 131,
  "citations": null,
  "claims": [
    {
      "claim_id": "claim-01",
      "statement": "It replaces manual, ad-hoc updates of agent safety harnesses with an automated loop in which safety-specification generation and attack-case generation adversarially evolve the harness from sparse threat evidence such as brief reports or a few attack examples. The cost is substantial orchestration complexity and repeated LLM calls for specification generation, attack probing, and evaluation feedback, all feasible on third-party APIs but adding latency and inference spend to any defense pipeline that runs it continuously. It can fail when the sparse evidence is unrepresentative of real attacks, when the attack generator overfits to its own synthetic cases and misses novel attack classes, or when harness updates over-restrict benign behavior despite the claimed utility preservation.",
      "basis": "inferred",
      "result": "",
      "baseline": "",
      "conditions": "",
      "source_url": "https://arxiv.org/abs/2610.02920",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "claim_id": "claim-02",
      "statement": "HASTE consistently reduces attack success rates across multiple backbone models, attack types, and evidence forms while preserving benign-task utility; no specific numerical factor is stated in the abstract.",
      "basis": "inferred",
      "result": "",
      "baseline": "",
      "conditions": "",
      "source_url": "https://arxiv.org/abs/2610.02920",
      "source_page": null,
      "source_excerpt": ""
    }
  ],
  "exposure_map": [
    {
      "dimension": "quality",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "compute",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "latency",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "operations",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "compatibility",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "security",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "data_and_training",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "reproducibility",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    }
  ],
  "risks": [],
  "minimum_test": [],
  "open_questions": [],
  "independent_tests": [],
  "lab_reproductions": [],
  "report_available": false,
  "validation_tier": "unknown",
  "evidence_tier": "unknown",
  "infrastructure_basis": "unknown",
  "equations": [],
  "equations_status": "not_fetched",
  "core_kind": "",
  "equations_fetched_at": "",
  "equations_source_url": "",
  "equations_source_sha256": "",
  "exposures_reviewed_at": "",
  "exposures_source_sha256": ""
}