stealthbench adds 10 EDR-guarded tasks: models' opsec behavior is abysmal

dyn___ · x · 2026-10-20

WHITEHACKSEC added 10 tasks to stealthbench, challenging models to operate on a Windows server protected by real rules from top-5 EDR vendors. Findings: nearly all models show abysmal low-recklessness, opsec-preserving behavior — full unnecessary lsass dumps, textbook process injections, repetitive actions. A GEPA-optimized prompt rerun is planned, but even a 30% improvement wouldn't make a pivoting agent scary on a defended host, the author says.

Original post →

More from Models

Models channel →