Adversarial agent evaluation
Understand how an agent responds to deliberately difficult task conditions
Ordinary tests omit misleading requests, contradictory evidence or pressure to overstep. The decision is how to understand how an agent responds to deliberately difficult task conditions. The work begins with your actual workflow and looks for the evidence that separates intended behaviour from a consequential exception. It is particularly relevant to product security and evaluation leads. A useful outcome is an explicit account of what was examined, what remains uncertain, and which decision the evidence can support.
The release evidence relationship
- Authorised attack scenarios
Establish the basis for requester influence.
- Protected action
Name the prohibited business effect.
- Adversarial case register
Retain the scoped finding and its unresolved dependencies.
Decision
Frame the decision around requester influence
Questions and the evidence they need
- Requester influence
- Inspect authorised attack scenarios for the relevant constraint or observation.
- Protected action
- Inspect protected actions for the relevant constraint or observation.
- Tool enforcement
- Inspect synthetic records for the relevant constraint or observation.
The decision is how to understand how an agent responds to deliberately difficult task conditions. This is relevant to product security and evaluation leads when ordinary tests omit misleading requests, contradictory evidence or pressure to overstep. Name the affected workflow, the consequence of a wrong decision, and the owner who can act on the result. The initial discussion should establish which evidence is already available and which uncertainty is material enough to investigate.
The specific failure hypothesis is that the agent abandons an approved boundary after repeated persuasion or conflicting instructions. It remains a hypothesis until examined in the deployment. Existing internal tests or operating records may already resolve it; identify the uncovered question before commissioning additional work.
Mechanism
Challenge the action boundary behind the refusal
Relationships within release evidence
- Requester influence
- Declare which instructions the test can change.
- Protected action
- Name the prohibited business effect.
- Tool enforcement
- Distinguish attempted misuse from an executed operation.
What this specialty examines
Adversarial cases should begin with a protected business boundary. Define what the requester controls, the action being sought and the result that would count as a control failure. Difficult wording alone is not the outcome; observe whether authority or business state changed.
The review should exercise controlled misuse and ambiguity cases, tracking whether harmful action was attempted or actually executed. Identify the normal route, relevant exceptions and the authoritative record of the outcome. Inspect the relevant business-system record, enforcement event or process evidence alongside any reported status. Keep incomplete cases visible, with an explanation of what their absence prevents the owner from concluding.
The tradeoff to make explicit
For this decision, realistic challenge reveals failure paths but requires explicit limits on systems, data and actions. Compare the available design or operating choices against the same intended outcome. If one option removes a required control or changes the task boundary, describe that difference before treating its apparent simplicity, speed or lower effort as an improvement. The decision should expose the tradeoff instead of burying it in an aggregate score.
Preparation
Connect the working inputs to the boundary being examined
Evidence packet for requester influence
Illustrative working format
- Authorised attack scenarios
- Bound the starting influence, protected effect, authorised surface, and stopping rule.
- Protected actions
- Check its relationship to the relevant workflow and expose missing context.
- Synthetic records
- Keep expected behaviour and the limits of the constructed example explicit.
- Escalation rules
- Confirm the applicable revision and who resolves disputed interpretation.
Start with authorised attack scenarios, protected actions, synthetic records and escalation rules. Identify the owner, revision and operating context of each source. Sanitised examples may support initial design, but differences from actual conditions should remain explicit. Where direct access is unsuitable, a customer-controlled evidence or execution route may be considered, with agreed handling and retention.
The scope also needs the release owner, agreed expectations for a representative task case, and the authority to inspect the relevant boundary. Specify what evidence would distinguish the failure in which the agent abandons an approved boundary after repeated persuasion or conflicting instructions from acceptable behaviour. If stakeholders disagree about intended behaviour, resolve the interpretation before classifying the observed difference as a defect.
How the work proceeds
Carry requester influence through to an accountable finding
From the scoped material to a decision record
- Authorised attack scenarios
Separate hard constraints from graded preferences.
- Protected action
Apply the scoped check to tool enforcement.
- Adversarial case register
Record the evidence, open dependencies, and the owner’s next decision.
Prepare the evaluation cases
Work with product security and evaluation leads to assemble authorised attack scenarios, protected actions, synthetic records and escalation rules. Select a normal task, a consequential exception and a case with insufficient information. Identify the relevant requirement and expected result for each, then mark which outcomes need human adjudication. The preparation output is a case packet that separates blocking behaviour from graded quality preferences before any comparison is run.
Run and review the comparisons
Include attempts that are refused, partially followed and blocked by tools. These distinctions show which layer deserves credit and which weakness remains. A refusal followed by an unauthorised background action should not be recorded as a successful defence.
Choose the release or evaluation change
Use the reviewed cases to produce an adversarial case register and evidence-backed account of observed boundary behaviour. Distinguish a product defect from a missing test, an ambiguous requirement or an unreliable measuring method. For each, name the proposed correction and the case that would check it. The release owner can then decide whether to change the implementation, improve coverage or restrict the intended use while a specific gap remains.
Indicative artefact
Make the adversarial case register usable by its owner
Adversarial case register
Illustrative working format
- Adversarial case register
- Identify the assessed workflow, revision, and decision boundary.
- Evidence-backed account of observed boundary behaviour
- Link observations and counterevidence to the case, configuration, and conclusion limit.
- Protected action evidence
- Name the missing evidence, responsible owner, and condition for revisiting the decision.
A useful decision artefact is an adversarial case register and evidence-backed account of observed boundary behaviour. Supporting material may include selected cases, configuration or process records, evidence references, a disagreement log and prioritised actions. Retain the case selection rationale and material disagreements alongside the result; otherwise the result may be mistaken for complete coverage.
Illustrative scenario
Examine tool enforcement through a constructed exception
A constructed case and its decision paths
Illustrative scenario
- Requester influence
Repeated pressure asks a support assistant to make a restricted amendment.
- Protected action
Compare the refusal with later tool execution.
- Tool enforcement
Change action enforcement if persuasion still produces the prohibited effect.
Consider a fictional situation: an illustrative requester repeatedly reframes a restricted account change as an urgent support correction. The scenario is illustrative, with no client engagement, executed test or measured improvement implied.
For repeated support pressure, use fictional accounts and a prohibited amendment that cannot affect a real person. Compare the initial refusal with later tool activity. The owner can then decide whether stronger action enforcement or better escalation behaviour is the relevant next change.
Scope and next action
Keep the conclusion within selected task cases
Confirm fit before the next commitment
- Requester influence
- This review is limited to selected task cases.
- Authorised attack scenarios
- The relevant owner must confirm access and the intended operating conditions.
- Adversarial case register
- The customer retains the release decision.
A result applies to the recorded configuration and selected cases. It does not establish universal agent competence or authorise release. Any engagement depends on an agreed scope, qualified team, authorised access and confirmed availability. Bring the affected workflow, its current configuration or process, the triggering change and the evidence already available. The immediate scope question is prompted by the situation in which ordinary tests omit misleading requests, contradictory evidence or pressure to overstep; confirm which missing observation would change the owner’s next action.
Ways to engage
Related engagement scopes
AI Agent Evaluation Evidence Diagnostic
Find the gaps between your release decision and the evidence behind it. Start with one agent workflow and a bounded set of questions.
AI Agent Evaluation Foundation
Turn scattered tests into a repeatable release discipline. Connect the behaviours that matter to datasets, evaluation criteria and evidence your team can maintain.
AI Long-Horizon Agent Evaluation
Examine what changes when an agent keeps working. Evaluate accumulated state, recovery and goal adherence across extended tasks.
Continue exploring
Related insights and resources
Engineer the harness, not just the prompt
Define the contracts around an agent's decisions: what state it trusts, which actions can execute, how interrupted work resumes, and what evidence an operator needs to recover safely.
What would justify releasing this agent?
Replace a single pass rate with a reviewable chain of requirements, cases, observations and judgements. Distinguish task quality, control failures and uncertainty before increasing an agent's exposure.
The evidence behind the go-live decision
A working paper for leaders who need to explain why an agent workflow is ready for its next release. Includes a proposed evidence-pack structure, decision table and review agenda.