When Agents Optimize Attacks: What Claudini Tells Us About Automated Adversarial Research

Introduction

There is a particular kind of research result that forces you to update your priors not because the method is novel, but because it works far better than the framing suggested it should. The paper Claudini: Autoresearch Discovers State-of-the-Art Adversarial Attack Algorithms for LLMs, by Panfilov, Romov, Shilov, de Montjoye, Geiping, and Andriushchenko, is one of these. The setup is almost mundane: take an LLM agent (Claude Code), hand it the existing literature on white-box adversarial attacks as starting implementations, and let it iterate. The output is uncomfortable. The agent produced attack algorithms that reach up to 40% attack success rate (ASR) on CBRN queries against GPT-OSS-Safeguard-20B, compared to 10% or less for the 30-plus existing methods it began from.

The reason this matters is not the specific number. It is what the number implies about which categories of research are now automatable, and what that does to the economics of offense and defense in AI security.

What Claudini Actually Did

The pipeline follows the autoresearch pattern that has been circulating in the agentic-coding community: an LLM agent is given a working codebase, an evaluation harness, and an objective, and it loops through hypothesis, implementation, measurement, and revision. The seeds here were real attack implementations, most notably GCG (Greedy Coordinate Gradient) from Zou et al., 2023, alongside a large collection of subsequent white-box methods.

White-box adversarial red-teaming is a near-ideal substrate for this loop, and the authors are explicit about why. Two properties stand out:

• Strong starting points exist. The agent does not need to invent the field from scratch. It can recombine, tune, and extend a mature body of optimization-based attacks.
• The feedback is dense and quantitative. A white-box attack has an explicit loss surface. Every iteration produces a gradient-informed, numerically scored signal of whether the change helped. This is precisely the regime where automated search excels, and precisely the regime where vague or sparse reward would have stalled it.

The results span three settings reported in Figure 1 of the paper:

1. Single-model improvement. Optimizing directly against GPT-OSS-Safeguard-20B, the discovered attacks beat all baselines on held-out ClearHarm CBRN queries, reaching the 40% ASR figure.
2. Transfer. Attacks discovered on unrelated surrogate models (Qwen-2.5-7B, Llama-2-7B, Gemma-7B) on a token-forcing task with randomly sampled targets transferred directly to a prompt injection setting against Meta-SecAlign-70B (Chen et al., 2025), achieving 100% ASR versus 56% for the strongest baseline.
3. Held-out random targets. On random token-target objectives, the discovered methods again outperformed every baseline.

The transfer result is the one I keep returning to. An attack tuned on small open models, on a synthetic objective, generalizing to saturate a 70B safety-tuned model it never saw, is not the behavior of an overfit artifact. It suggests the agent found something closer to a genuinely better optimization procedure rather than a brittle exploit of one target.

Why the Feedback Structure Is the Real Story

It is tempting to read this as "AI breaks AI safety," but that framing obscures the mechanism. The paper is better understood as a statement about task structure than about adversarial attacks per se.

Consider what the agent had to work with. White-box attacks operate over a differentiable or near-differentiable objective. The agent could propose a modification to the token selection heuristic, the loss weighting, the candidate sampling strategy, or the initialization, and immediately observe ASR on a held-out set. This is a tight, low-latency, high-fidelity optimization loop. It resembles hyperparameter and algorithm search more than open-ended scientific discovery.

This connects directly to the line of work the authors cite from Carlini et al., 2025, on automating incremental security research. The Claudini result is described, accurately, as an early demonstration that incremental safety and security research can be automated. The word "incremental" is doing important work. The agent did not invent a new threat model. It pushed hard on an existing, well-instrumented one. That is exactly the kind of progress that compounds when you can run it at scale without a human in the loop on every iteration.

My inference here is that the determining factor for whether a research subfield is automatable is not its prestige or perceived difficulty, but its reward density. Subfields where you can write a scalar that correlates with progress, evaluate it cheaply, and iterate quickly are now exposed to agentic search. Subfields requiring expensive experiments, ambiguous evaluation, or theoretical insight that does not decompose into a measurable loss remain comparatively insulated, at least for now.

The Asymmetry This Creates

The practical implication, which I raised in shorter form already, deserves expansion. If offensive adversarial research has dense feedback, then offensive capability now scales with compute rather than with researcher headcount. A lab that previously needed a team of specialists to produce one improved attack per quarter can, in principle, run many parallel autoresearch loops and harvest improvements continuously.

Defense does not enjoy a symmetric advantage. Defensive evaluation is messier:

• The defender must hold up against a distribution of attacks, including ones not yet discovered.
• Robustness is harder to score with a single dense objective than attack success.
• Overfitting to a fixed attack set is a known failure mode; a defense tuned against today's attacks can collapse against tomorrow's.

There is a structural reason the attacker's loop closes faster than the defender's. The attacker's objective ("maximize ASR against this target") is concrete and immediately measurable. The defender's objective ("be robust against all future attacks") is open-ended and only partially observable. An automated loop can sharpen the former far more cleanly than the latter.

That said, the same machinery could be pointed at defense, and I expect it will be. The natural countermeasure is adversarial co-training at the algorithm level: run the attack-discovery loop and the defense-discovery loop against each other, in the spirit of self-play. The honest concern is that, as in GAN training, the equilibrium may favor whichever side has the cleaner gradient, and right now that is the attacker.

Limitations and Honest Caveats

A few caveats temper the strongest readings.

• This is white-box. The attacker needs model weights and gradients. Frontier closed models are not directly exposed to this exact pipeline, though transferability blurs that boundary.
• The strongest headline numbers are against open or open-weight safety models (GPT-OSS-Safeguard-20B, Meta-SecAlign-70B). These are reasonable, serious targets, but they are not a claim about every deployed system.
• ASR metrics depend on the judge. CBRN-query success is typically scored by a classifier or model judge, and judge calibration materially affects reported rates. The relative improvement over baselines is more trustworthy than any absolute number.
• "Discovered novel algorithms" should be read carefully. The agent recombined and tuned a rich seed set. Whether any single discovered method constitutes a conceptually new attack, versus a strong empirical configuration, is a question the released code at the project repository will let the community adjudicate.

The authors releasing all discovered attacks, baselines, and evaluation code is the right call. Reproducibility is what separates a credible automation claim from a press release, and it lets defenders study the same artifacts.

Conclusion

Claudini is less a result about jailbreaks than a result about which research loops have already crossed the automation threshold. White-box adversarial optimization has strong priors, dense feedback, and cheap evaluation, the three ingredients an agentic loop needs to outpace human iteration speed. The 40% CBRN ASR and 100% transfer ASR are evidence that, in this corner of the field, the loop already works.

The open questions are the ones worth funding now. Can defensive research be restructured to expose comparably dense feedback, so that automated defense can keep pace? What happens when attack-discovery and defense-discovery loops are run jointly at scale, and where does that equilibrium settle? And more broadly, which other safety-relevant subfields share this reward structure, and are therefore next? Defenders should assume the loop is already running against them, because the only thing the result really requires is compute and a well-instrumented objective, and both are now abundant.