Its generator builds attack environments and checks execution, including state reloaded across tasks. The authors report an effective generated-attack rate above 30% below $0.10 per successful sample. That sampling cost is not the total cost of compromising a deployed organization. Mechanism, preconditions and effects. AutoRedClaw generates injection…
Inspect the ClaimsCase · DiggingBeagle record
AutoRedClaw evaluates persistent-state attacks across agent harnesses
Scope
Author-generated attacks and selected harness/model configurations.
Assessment profile
Assessment method- Setting
- evaluation
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- not applicable
- AI role
- AGAINST AI
Basis and provenance
CLM-AUTOREDCLAW reports: AutoRedClaw reports a 330-case benchmark across seven harnesses and four models, with most tested agent systems exceeding 50% attack success. Source SRC-2026-RADAR-AUTOREDCLAW is located at 'Abstract; persistent configuration, memory and skill surfaces; RedClaw-Bench evaluation'. The distinctive mechanism begins: AutoRedClaw generates injection scenarios for persistent personal-agent runtimes with configuration, skills and memory that can be reloaded in later interactions. Classification: setting=evaluation, exploit_status=demonstrated, evidence_grade=B on the bounded original investigator/vendor or paper evidence, without independent dynamic replication. remediation_status=not_applicable; scoped control or limit: Authorize updates to persistent agent configuration and memory, preserve content origin and expire or revoke obsolete instructions. Test both planting and later reload instead of declaring a one-turn refusal a successful defense. The null impact band avoids an ungrounded cross-Case severity rating; observed damage, targeted population and controlled test outcomes cannot be exchanged as the same quantity. Where a patch is described, its availability is separate from independently tested effectiveness.
Assessed Oct 23, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-AUTOREDCLAW · AutoRedClaw preprint, arXiv 2610.27244
At a glance
No independent rerun or general production compromise rate.
Limits and uncertaintyFull account
Its generator builds attack environments and checks execution, including state reloaded across tasks. The authors report an effective generated-attack rate above 30% below $0.10 per successful sample. That sampling cost is not the total cost of compromising a deployed organization.
Mechanism, preconditions and effects. AutoRedClaw generates injection scenarios for persistent personal-agent runtimes with configuration, skills and memory that can be reloaded in later interactions. Its released RedClaw-Bench contains 330 cases covering seven harnesses and four models, with reported attack and trigger success varying substantially by runtime. Unlike a single-page jailbreak, a planted instruction in AGENTS.md or long-term memory has a chance to be reintroduced without the original attacker participating in each later turn.
Comparison and evidence limits. The reported sub-dollar evaluation economics and greater-than-50% success in several tested systems do not estimate real intrusions, nor do they mean all seven harnesses are equally useful at legitimate work. This work and Carryover both measure persistence, but they use different tasks and denominators that cannot be averaged.
Timeline
- Oct 19, 2026disclosure
Public disclosure
Claims & evidence
CLM-AUTOREDCLAWAutoRedClaw reports a 330-case benchmark across seven harnesses and four models, with most tested agent systems exceeding 50% attack success.supported
Basis: reported finding
- supportsAutoRedClaw preprint, arXiv 2610.27244primary disclosure
Abstract; persistent configuration, memory and skill surfaces; RedClaw-Bench evaluation
Controls and mitigations
- Authorize updates to persistent agent configuration and memory, preserve content origin and expire or revoke obsolete instructions. Test both planting and later reload instead of declaring a one-turn refusal a successful defense.
Unknowns and contradictions
- No independent rerun or general production compromise rate.
Sources and citation
Material revision history
- Oct 23, 2026 · Canonical change recorded · new in release · revision 183