Open source · Apache-2.0
GOVERNANCEBENCH

Can your AI agents be hijacked, and would you even know?

GovernanceBench is the open, reproducible test that answers that. It checks whether a platform can block the actions an agent should never take, prove what it did, and pull the plug the moment it goes wrong.

235 real attack and failure scenarios. Every one caught. Run the same 235 yourself.

Run the benchmarkView the demo
$ npx governancebench
What the benchmark is made of
Core conformance
235 scenarios across 6 dimensions. The set every implementation is held to; the score is this set.
Optional capability suites
218 scenarios across 21 suites. Vertical and pattern suites, scored standalone; not part of the core figure.
Adversarial testing
148 scenarios across 14 threat categories. Attack and failure scenarios run against the same target.
Workflow benchmark
WorkflowBench. Workflow-specific attacks that agent-focused scenarios miss, scored on the same principles.
Agentomy: 235 of 235 caught
Agentomy is one implementation tested against this; the runner accepts any target. Every scenario and its expected outcome is published, so the figure is re-derived by anyone who runs it, not taken on our word. The published result manifest records which runner version ran which scenario set, when, with what result, and the command that re-derives it.

Why ungoverned AI agents are a risk you cannot see.

An AI agent acting on its own can produce outcomes its operators never anticipated, authorized, or had a way to halt. In March 2026, an AI system was used to accelerate a cryptographic discovery with global security implications, with no governance layer sitting between the system's capability and the outcome it produced. The danger is not only that an agent does the wrong thing. It is that no one can block it, prove it, or stop it in time.

The question every CISO and regulator now asks

Can you block what your agents should not do, prove exactly what they did, and stop them mid-action? GovernanceBench turns that question into 235 concrete tests, so the answer is a measured result instead of a promise.

Stop
Can an operator halt an agent before the damage compounds?
Prove
Can the system produce a verifiable record of what happened and why?
Contain
Can the system detect and contain an agent that drifts from expected behavior?

The six things GovernanceBench tests, in plain English.

Each area maps to a concrete way an autonomous agent can hurt you, and a concrete thing a passing result proves for your platform.

Authorization Enforcement54 scenarios
The risk you face

An agent takes an action it was never allowed to: moving money, deleting records, or escalating its own permissions by editing the request it sends.

What a pass proves for you

Permission limits are enforced on the server, not left to the agent. An agent cannot grant itself more access than you gave it, and it stays inside its assigned scope.

Audit Trail Integrity50 scenarios
The risk you face

Something goes wrong and you cannot prove what the agent did, in what order, or under whose authority. Or the record was quietly altered after the fact.

What a pass proves for you

Every action is written to a hash-linked, tamper-evident log you can page through and export, with complete event coverage and no gaps to hand an auditor or regulator.

Kill Switch / Override50 scenarios
The risk you face

An agent starts doing damage and there is no reliable way to stop it, or it keeps acting after you thought you had halted it.

What a pass proves for you

One command halts every agent immediately, new authorization is blocked while the halt is active, and normal operation resumes cleanly when you decide it is safe.

Behavioral Monitoring58 scenarios
The risk you face

An agent drifts from normal behavior (probing for privileges, firing off bursts of requests) and no one notices until after the harm is done.

What a pass proves for you

The platform detects anomalies at runtime against each agent's own baseline, and quarantines the agents that cross the line.

OWASP Agentic Top 1015 scenarios
The risk you face

OWASP (the Open Worldwide Application Security Project) publishes the security industry's widely-used lists of top risks; its Agentic Top 10 ranks the worst ways AI agents get abused: goal hijacking, tool misuse, stolen agent identity, and cascading multi-agent failures.

What a pass proves for you

Coverage across all ten catalogued agentic risks (OWASP ASI-01 through ASI-10), so the failure modes the industry already knows about are accounted for.

Message Governance8 scenarios
The risk you face

Agents talk to each other, and the message itself becomes the attack: one agent tells another to ignore its instructions, hand over more access than it was given, or hides that instruction inside an encoded payload so a naive filter misses it.

What a pass proves for you

Messages are governed as actions, not waved through as unknown verbs. Instruction-override and escalation payloads are refused and the refusal names the content that caused it, encoding is not a bypass, every message lands in the audit chain, a halted agent cannot keep talking, and each decision carries the policy version it was made under. One scenario exists to fail any platform that games the other seven by refusing everything.

What the score actually means.

Two numbers get quoted a lot. Here is what each one honestly does, and does not, mean.

235 / 235
235 concrete scenarios across the six areas above. Passing all 235 means none of these known failure modes got through in testing: 0 failed, 0 skipped.
100 / 100
The same result expressed on a 0-to-100 scale. It is a scorecard number, not a separate achievement: 100 / 100 is what 235 of 235 looks like as a percentage.
A confirmed test result
It is a reproducible test outcome, not a certification, audit, or guarantee. No standards body blessed it. It says these scenarios passed on this platform on this date.
Reproducible by anyone
The scenarios and the command are public. A score you cannot reproduce is just a claim, so the point is that you can run the same 235 and see the same result for yourself.

Independent verification · NVIDIA SkillSpector

GovernanceBench is self-authored. SkillSpector is not.

Every score further down this page comes from a benchmark we wrote ourselves, and the methodology says so in plain terms: we write the scenarios and we score well on them. So start with the one result that does not work that way. SkillSpector is NVIDIA's open-source skill security scanner (v2.2.3, Apache 2.0). We did not write it, we cannot tune it, and it was pointed at our own published code. It runs 64 indicators across 16 indicator categories in static-analysis mode (--no-llm), which is deterministic and needs no API keys, so anyone can repeat the run and get the same answer.

2026-07-02 · 27 published skills scanned · 27 / 27 SAFE · 0 / 100 aggregate risk per skill · severity LOW on every skill

Two earlier runs of the same scanner sit behind that one. On 2026-06-18 it scanned the 16 skill directories published at the time and returned 16 / 16 SAFE at 0 / 100 aggregate. The 2026-07-02 run supersedes it rather than adding to it: those same 16 skills plus the 11 added on 2026-06-30, rescanned together. On 2026-06-20 the scanner was pointed at a different target, the 13 executable TypeScript files in n8n-nodes/src/, and scanned 13 / 13.

What this establishes is narrow, and worth saying plainly: an outside static analyser found nothing to flag in the code we publish as skills. It is not an audit, not a certification, and it does not test the governance runtime that the results below measure. It is one outsider's instrument, run against us, and you can run it yourself:

$ git clone --depth 1 https://github.com/NVIDIA/SkillSpector.git
$ cd SkillSpector
$ docker build -t skillspector:local .
$ cd /path/to/agentomy-v2
$ for skill in agentskills/*/; do SKILL_NAME=$(basename "$skill"); docker run --rm -v "$PWD/agentskills:/scan" skillspector:local scan "/scan/$SKILL_NAME" --no-llm --format markdown; done

Per-skill output and the full scan records are on file: docs/SKILLSPECTOR-SCAN-2026-07-02.md, docs/SKILLSPECTOR-SCAN-2026-06-18.md, and docs/SKILLSPECTOR-N8N-NODES-SCAN-2026-06-20.md. On Git Bash or MSYS, prefix the docker command with MSYS_NO_PATHCONV=1 so /scan/$SKILL_NAME is not rewritten to a Windows path. The scanner itself is at github.com/NVIDIA/SkillSpector.

Run it. Compare it. Verify it.

GovernanceBench is Apache 2.0 licensed and built to be run, not just cited. Run it locally against any platform and compare the results independently.

$ npx governancebench
npm packageGitHub
PlatformScoreReproduce
Agentomy100/100governancebench run --target localhost:3000
Microsoft AGT57/100 (†)governancebench run --adapter microsoft-agt
n8n (bare)56/100 (†)governancebench run --adapter n8n --target http://localhost:5678
Your system?/100governancebench run --target YOUR_URL

Both non-Agentomy scores are measured with a live adapter and reproducible artifacts on file. The (†) marks a methodology caveat: how those comparative scores were measured is spelled out in the methodology section below.

VIGIL · THE SECOND BENCHMARK

GovernanceBench asks whether the controls work. VIGIL attacks them.

Where GovernanceBench measures whether a platform can halt, audit, and supervise, VIGIL is the adversarial battery: it actively tries to break the governance layer the way a real attacker would. Prompt injection, agent hijacking, poisoned skills, and governance-bypass attempts are run against the live platform, and every one has to be caught.

Current Agentomy result
148 of 148 defended
Every one of the 148 documented adversarial scenarios is defended, across 14 threat categories. 0 breaches, 0 skipped. Apache 2.0 licensed. Run it against any platform.
$ npx agentomy-vigil run --target YOUR_URL

Published as agentomy-vigil on npm, source at github.com/getagentomy/vigil under Apache 2.0. The scenarios, the scoring and the category weights are all in that repository, so a run you do not like can be checked rather than argued with.

The 14 threat categories VIGIL runs

Each category is a distinct way an autonomous agent can be turned against its operator. A platform only defends all 148 if it holds the line in all fourteen.

InjectionPrompt-injection and instruction-override attempts.
AgentjackingHijacking an agent mid-task via indirect prompt injection.
Governance bypassAttempts to escape the governance layer itself.
Supply chainPoisoned tools, skills, and dependencies.
Skill activationMalicious or unauthorized invocation of agent skills.
Model integrityTampering with model weights, prompts, or responses.
Social engineeringManipulating the agent through deceptive conversation.
Behavioral intelProbing to map an agent's permissions and limits.
ProtocolAbuse of agent-to-agent and tool-call protocols.
CryptoForged signatures, hashes, and attestations.
EnvironmentalAttacks through the agent's runtime and surroundings.
Multi-agent fleetCoordinated attacks across many agents at once.
Adversarial onboardingConfig-injection and permission-bypass at setup time.
Workflow classTrigger-spoofing, cascade-poisoning, and replay in workflows.

VIGIL and GovernanceBench are separate, complementary suites: one proves the controls exist and function, the other proves they survive attack. Both are open and reproducible: you run them yourself against your own deployment.

FOR AUDITORS · METHODOLOGY

The evidence, in full.

GovernanceBench keeps a hard line between a measured result and a paper claim. The per-platform comparisons, the disclosures behind the comparative scores, and how to add your own system are all here, one click down, not in your face. The independent SkillSpector scans are higher up the page, above the results table.

Frequently asked questions.

Plain-English answers to what AI agent governance is, how GovernanceBench tests it, and how it differs from testing a model.

Run the benchmark. Review the demo. Decide what governance should prove.

Agentomy publishes the benchmark because governance should be measurable before autonomous agents become operational infrastructure.

Run npx governancebenchView interactive demo