Iterative prompt refinement with an attacker LLM

Tree-of-attacks with pruning

Lifelong strategy-discovery jailbreak

Gradual multi-turn escalation

Mutation-based jailbreak fuzzing

Many in-context demonstrations

Generative offensive agent tester (multi-turn)

Single-turn flip-based obfuscation

Code-encryption obfuscation jailbreak

Disguise-and-reconstruction attack

Bijection-cipher jailbreak

Foot-in-the-door multi-turn escalation

Reflective prompt evolution

Reflective prompt evolution for agent targets

Indirect prompt injection for agent targets

Memory-injection attack for agent targets

Knowledge-base / RAG corruption

Tool-control-flow hijack for agents

Environmental injection for web agents

Adaptive indirect prompt injection for agents

Byte-faithful replay of Pliny's L1B3RT4S jailbreak corpus

Self-evolving attack-tree search for multi-turn jailbreaks

Direct-request baseline (no attack)

Any LLM as a single- or multi-turn chatbot

Tool-using agent across all four AgentDojo suites

Plan-then-execute agent loop (ASB)

General inspect-ai tool-calling agent

Claude Code coding agent with execution access

OpenClaw computer-use assistant

General-purpose OpenClaw personal-assistant agent

Standardized red-teaming benchmark

Jailbreak benchmark (Souly et al., 2024)

Fine-grained safety-refusal benchmark

Harmful agent-behavior benchmark (176 behaviors)

Prompt-injection tasks + purpose-violation goals

Attack-success / utility / refusal tasks

Agent trustworthiness across 14 domains

HarmBench + SORRY-Bench + StrongREJECT combined

Malicious agent-tool generation benchmark