Changelog
Updates
Recent releases, specification changes, and project milestones across the OASB ecosystem.
Pinned benchmark run of record on hackmyagent 0.33.2
A pinned run took hackmyagent 0.33.2 by npm version and tarball integrity, checked and recorded its other inputs, and wrote every per-sample prediction to the oasb repository. The full pipeline detects 192 of 270 attack fixtures (71.1%) and 17 of 86 DVAA scenarios (19.8%). The reference results now lead with these figures and keep the 2026-06-05 figures on hackmyagent 0.23.8 (223 of 270 fixtures, 25 of 86 scenarios) as history: those runs did not record their inputs, so they are not a baseline for the pinned run.
Library entry point, reproducible installs, contribution guide
First release published to npm through GitHub Actions Trusted Publishing (OIDC, with SLSA provenance). The npm package gains a working entry point: import the SecurityProductAdapter contract, capability helpers, worked adapters, and the scoring engine directly from @opena2a/oasb. The benchmark dependency was pinned to hackmyagent 0.23.8, the version the 2026-06-05 figures were measured on (no longer current: the main branch has since moved off 0.23.8, so a fresh clone does not reproduce those figures, and the figures of record now come from the pinned run of 2026-10-10 on hackmyagent 0.33.2), a committed release smoke gate guards the README test-count claims, and CONTRIBUTING.md invites co-authors, independent implementations, and adopters.
Benchmark scored on the v2.0 dataset (scores withdrawn 2026-08-09)
WITHDRAWN 2026-08-09. This entry originally published an F1 score and a false-positive rate for the HackMyAgent pipeline on the v2.0 dataset. The figures are withdrawn: 3,704 of the 3,881 benign samples were labeled benign by the rule "verdict=warning AND overall_score >= 70" as reported by HackMyAgent itself, so anything the scanner would have flagged was excluded from the benign class by construction and the low false-positive rate was guaranteed by the labeling rule rather than measured. The entry is kept rather than deleted so the record of what was published remains visible.
Eval remapped to 15 MITRE ATLAS techniques; OASB-2 domains renumbered
OASB Eval scenario counts were reconciled and remapped to the current MITRE ATLAS technique set: 165 of the then 222 scenarios now map to 15 ATLAS techniques (was 10), and the other 57, which test response and detection machinery, no longer carry a technique. OASB-2 behavioral governance domains were renumbered to 11-19.
SEC-021 control and NanoMind telemetry (tagged source release)
Added the SEC-021 policy-enforcement fail-closed control and NanoMind classifier telemetry to the scanner benchmark. v0.3.2 is a tagged source release in the GitHub repository and was not published to npm, where the next version after 0.3.1 is 0.4.0.
Product-agnostic adapter interface and first third-party benchmark
OASB is now fully independent of any security product. All 222 scenarios use a SecurityProductAdapter interface: implement it for your product and run the same scorecard. Includes a capability comparison: arp-guard (reference) covers every surface; llm-guard is a prompt-only scanner, so its other surfaces report N/A rather than failure. ARP renamed to arp-guard on npm.
AI-layer test scenarios added to OASB Eval
Added 40 new atomic tests covering AI-layer detection: prompt input/output scanning, MCP tool call validation, A2A message scanning, and full pattern coverage validation. Total Eval scenarios now at 222.
ARP gains AI-layer interceptors and HTTP proxy
New PromptInterceptor, MCPProtocolInterceptor, and A2AProtocolInterceptor detect prompt injection, jailbreak, data exfiltration, MCP exploitation, and A2A identity spoofing. New HTTP reverse proxy mode for inline protection of existing agents.
MCP and A2A attack modes added to HackMyAgent
HackMyAgent now supports 7 attack categories with 75 payloads: prompt injection, jailbreak, data exfiltration, context manipulation, resource exhaustion, MCP exploitation, and A2A attacks. New --target-type flag for MCP JSON-RPC and A2A protocol targets.
DVAA adds MCP JSON-RPC and A2A endpoints
Damn Vulnerable AI Agent now exposes MCP-over-HTTP (JSON-RPC 2.0) and A2A message endpoints for security testing. 7 vulnerable agent bots with configurable vulnerability levels.
Securing OpenClaw: 6 security fixes merged upstream
Contributed 6 security patches to the OpenClaw project addressing credential exposure, input validation, and dependency vulnerabilities. All patches accepted and merged.
OASB-1 specification published
Released the OASB-1 specification defining 46 security controls across 10 categories with L1/L2/L3 maturity levels for AI agent security compliance.