Penn Tesser · the pentester on your AI team

He attacks your agents before someone else does

Penn Tesser is an AI pentester whose target is another AI. He goes after an agent's own loop — the prompts it reads, the content it retrieves, the tools it can call — not networks or hosts. And he publishes what he finds as an open benchmark: a shared test set that ranks the security of agent harness × model combinations, so you can see which pairing is actually safe to trust.

View the benchmark How it works

the matrix — one test set, every combination

                 model A     model B     model C
harness: claude-code   ▓▓▓░░       ▓▓▓▓░       ▓▓░░░
harness: openclaw      ▓▓▓▓░       ▓▓▓░░       ▓▓▓▓▓
harness: codex         ▓▓░░░       ▓▓▓▓░       ▓▓▓░░
harness: your-agent      ?           ?           ?

  ▓ = attacks resisted   ░ = attacks that got through
  every cell is the same adversarial test set, run in a sandbox

Security is not a property of the model alone, or the harness alone — it is a property of the pair. Penn measures the pair.

Not traditional red teaming

A different target, and an open result

The word is borrowed; the discipline is new. Nothing here scans a subnet — every scenario is aimed at what makes an agent an agent, and the outcome is a number you can reproduce.

Traditional red team

Penn Tesser

Target

Hosts, ports, services, employees.

The agent's decision loop: system prompt, retrieved content, tool calls, memory.

Payload

Exploits against software and infrastructure.

Language: injected instructions, jailbreaks, lures the model will act on.

Success

Shell, credentials, lateral movement.

The agent takes an action nobody authorized — sends, deletes, installs, discloses.

Result

A private report for one target.

A public, reproducible score for a harness × model combination anyone can check.

The benchmark

A public test set for agent security

Penn releases an open, versioned set of adversarial scenarios — prompt injection, jailbreaks, data-exfiltration lures, malicious tool-call bait, permission escalation — and runs every one against real agents in a sandboxed harness. The same test set, run across many harness × model pairings, produces a leaderboard of who resists what.

Open and reproducible

The scenarios, the harness, and the scoring are public. A result you can re-run is a result you can trust — the opposite of a private pentest report.

The pair is the unit

The same model is safer in one harness than another, and the same harness is safer with one model than another. Penn scores the combination, because that is what you actually deploy.

Bring your own

Plug in your harness, your model, or both. Run the public set locally, or submit a combination to the leaderboard.

See the leaderboard and the test set →

The team

One platform, three agents

Security for AI agents is three jobs, and each one is now an agent of its own: Penn Tesser attacks your agents before they ship, Ron Tye judges every action while they run, and Andy Mal analyzes what they touch. All three work on OpenGuardrails — the platform that holds the policies, the evidence and the open protocol they speak.

Platform