PACT-Bench evaluates agent systems on a seeded multi-agent world: can an agent serve requests across trust boundaries without leaking what it knows? Submissions are scored on safety — transitive leaks, confused-deputy resistance, cross-cluster containment — and on utility: authorized work still gets done.
First-party baselines, ranked by overall accuracy. Attack-rate columns — confused deputy, transitive leak — read lower-is-better; everything else, higher.
| # | Submission | Defense | Overall | Safety | Utility | Confused deputy ↓ | Transitive leak ↓ |
|---|---|---|---|---|---|---|---|
| 1 | Aicoo-D1 Aicoo · 2026-05-16 · 2 reps | POLICY | 74.9% | 71.5% | 78.8% | 2.0% | 77.7% |
| 2 | Aicoo-D0 Aicoo · 2026-05-16 · 2 reps | OPEN BASELINE | 55.9% | 26.6% | 88.7% | 47.0% | 96.3% |
| 3 | Aicoo-MCC-H+D1 Aicoo · 2026-05-18 · 1 rep | STRUCTURAL + POLICY | 50.7% | 77.8% | 20.6% | 0.0% | 67.0% |
| 4 | Aicoo-MCC-H Aicoo · 2026-05-18 · 1 rep | STRUCTURAL | 44.8% | 64.4% | 23.1% | 0.0% | 77.7% |
PACT-Net v2 evaluation · gpt-5.5 · 997 phase-1 tasks + 75 phase-2 dig-further tasks per condition · 25-agent world
A small contract — local TypeScript or subprocess JSON-RPC, so any language works. Your system plans a boundary (what to mount, when to escalate) and answers tasks.
Public dev tasks ship with labels so you can iterate locally. Held-out test labels stay sealed — the official runner owns task loading, world state, budgets, and scoring.
Scores land on this page through a public results PR — metadata, scores, and public traces. Every number above has an auditable trail.
Public submissions open soon. Early access for research groups and agent-platform teams — we run your system against the sealed test split and publish the trail.