Red Teaming

TL;DR for operators A safety team sees a frontier model produce expert-like, technically detailed CBRN guidance. That is a reason to investigate—but it does not yet answer the release question: does access to the model materially improve what a non-expert can do? This study shows why the distinction matters. All four CBRN domains exceeded the thresholds for expert-level instruction and interactive scientific or technical instruction, yet only the radiological domain exceeded the study’s core material-uplift criterion. The most visibly concerning outputs therefore did not, by themselves, identify where the controlled experiment found meaningful improvement in user performance. ...

TL;DR for operators A platform can evaluate a recommender on clean historical data, observe only a small performance gap between groups, and reasonably approve it for retraining. That approval does not show how the same training process will respond when coordinated fake accounts deliberately shape the next batch of user interactions. In the reported experiments, fake profiles widened subgroup disparities even when the target recommender used fairness-aware training. Across the tested models, the paper’s SRLFA method generally produced larger disparities than the adapted attack baselines, with the largest reported effects appearing on the fairness-aware Last.fm LightGCN target. ...

TL;DR for operators A production agent can refuse a dangerous request after its tools have already changed a repository, sent a message, or altered an account. That is why the final response alone cannot establish whether the system behaved safely: stated refusal, attempted action, and persistent environmental change may point to different conclusions. ...

TL;DR for operators The reassuring headline is that both evaluated frontier models rejected most automated jailbreak attempts. The operationally useful headline is that they still produced 1,620 and 702 panel-confirmed harmful completions, respectively, across every top-level harm category in the benchmark.1 The strongest adaptive attack succeeded on 11.51% of attempts against one model and 6.10% against the other. Static encodings and familiar jailbreak templates, by contrast, were almost entirely neutralised. ...

TL;DR for operators Red teaming is not the act of finding one clever prompt that makes a model misbehave. That is a demo. Sometimes a useful demo, occasionally a terrifying one, but still a demo. The two papers here point to something more operational. RECAP shows how adversarial prompt generation can become cheaper by retrieving previously successful attack patterns rather than optimizing every new attack from scratch.1 A separate red-teaming framework shows how those attacks can be routed through a controlled attacker-target-jury workflow, with ensemble judging, task-specific criteria, and cross-linguistic analysis.2 ...

TL;DR for operators The paper’s useful message is not “LLM agents are unsafe,” which is too vague to help anyone do anything before lunch. The useful message is narrower and more operational: agents become vulnerable when untrusted content from SaaS integrations is read into the agent context and then treated as authority for a later action. ...

TL;DR for operators The paper introduces GAS-Leak-LLM, a black-box method that uses a genetic algorithm to evolve adversarial suffixes: small text sequences appended to harmful prompts to increase the chance that a model produces unsafe content.1 The important part is not that another jailbreak exists. We have enough of those. The important part is that jailbreak discovery is framed as a repeatable optimization loop using only model queries. ...

Security teams like to search for suspicious strings. That habit is understandable. Strings are visible. They can be logged, filtered, matched, scored, and proudly displayed in dashboards. A bad suffix at the end of a prompt looks like a bad suffix at the end of a prompt. Convenient. Almost too convenient. The problem is that prompts are not flat text boxes. They are transformed into token sequences, wrapped in chat templates, and passed through attention layers that do not treat every position equally. Some positions receive more influence over the model’s next-token behavior than others. Put adversarial tokens there, and the same amount of “badness” can travel farther. ...

Jailbreak Risk Needs a Stopwatch, Not Just a Scorecard For many organizations, LLM safety is still treated like a checkpoint: run a benchmark, report an attack success rate, add a few guardrails, and move on. The resulting dashboard looks reassuringly official. It may even have decimals. Unfortunately, adversarial users do not attack dashboards. They attack systems. ...

The number looked safe. Then someone ran it twice. A familiar business problem: one vendor says its model resists jailbreaks. Another red-team report says a new attack reaches a spectacular Attack Success Rate. A compliance team sees a percentage, puts it into a risk register, and moves on. Unfortunately, that percentage may be doing more acting than measuring. ...