--- title: New Archestra's OpenAPPA Saturates Two Major Security... description: Archestra released OpenAPPA, an open-source security engine that enforces deterministic information-flow policies outside an AI agent's execution loop to stop... canonical: https://daily.dev/posts/new-archestra-s-openappa-saturates-two-major-security-benchmarks-with-a-0-attack-success-rate-uneavqqlp twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: New Archestra's OpenAPPA Saturates Two Major Security Benchmarks with a 0% Attack Success Rate | daily.dev og:description: Archestra released OpenAPPA, an open-source security engine that enforces deterministic information-flow policies outside an AI agent's execution loop to stop... og:url: https://daily.dev/posts/new-archestra-s-openappa-saturates-two-major-security-benchmarks-with-a-0-attack-success-rate-uneavqqlp og:image: https://api.daily.dev/og/posts/UneAVqqlP.png og:image:alt: New Archestra's OpenAPPA Saturates Two Major Security Benchmarks with a 0% Attack Success Rate og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # New Archestra's OpenAPPA Saturates Two Major Security Benchmarks with a 0% Attack Success Rate **[InfoQ](https://daily.dev/sources/infoq)** · 5 min read · 0 upvotes · 0 comments ## Summary Archestra released OpenAPPA, an open-source security engine that enforces deterministic information-flow policies outside an AI agent's execution loop to stop data exfiltration from prompt injection or hallucination. It uses an Agentic Permissions Policy Algebra (APPA) with lattice-based labels for audience and trust, configured via an appa.toml file, plus recovery mechanisms like sanitizers, human-authority approval, and disposable child branches. On the Bench-Corp and AgentThreatBench benchmarks, OpenAPPA achieved a 0% attack success rate with 89% task completion, compared to 10% attack success / 90% completion for Claude Code's auto mode and 31% attack success / 41% completion for Microsoft FIDES. The underlying research is published on arXiv, and AgentThreatBench was recently merged into the UK AI Safety Institute's inspect_evals repository. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What attack success rate did OpenAPPA achieve on the Bench-Corp and AgentThreatBench security benchmarks compared to Claude Code's auto mode? OpenAPPA achieved a 0% attack success rate with 89% task completion on both Bench-Corp and AgentThreatBench, compared to Claude Code's auto mode which had a 10% attack success rate with 90% task completion, and Microsoft FIDES which had 31% attack success with only 41% completion. The benchmarks test sensitive data sharing, prompt injection, approval ordering, and tenant isolation. _Developers comparing agent security engines can track benchmark results like these on daily.dev._ ### How does OpenAPPA's Agentic Permissions Policy Algebra (APPA) prevent data exfiltration in LLM agents? APPA runs a pluggable policy engine outside the agent's prompt and execution loop, so the language model cannot inspect, negotiate with, or bypass rules. It labels data with audience (authorized consumers) and trust (verification level) using monotonic lattice algebra, so labels only become more restrictive as data flows through tool calls, configured in a single appa.toml file. _Teams designing agent permission systems can follow architecture breakdowns like this on daily.dev._ ### What happens to task completion rate when recovery strategies are disabled in OpenAPPA's agent security model? Task completion fell to 35.0% when remedy plans were completely disabled, according to ablation experiments in the APPA research paper, compared to 89% completion with recovery mechanisms like sanitizers, human-authority routing, and disposable child branches enabled. This shows recovery semantics are critical to maintaining agent utility alongside strict security enforcement. _Engineers balancing agent safety and utility can follow research like this on daily.dev._ ## Similar posts on daily.dev - [Frontier AI Application Security: Every Second Counts](https://daily.dev/posts/frontier-ai-application-security-every-second-counts-0bexwxsr3) · JFrog · 0 upvotes · 0 comments - [AI agents are accelerating vulnerability discovery. Here’s how AppSec teams must adapt.](https://daily.dev/posts/ai-agents-are-accelerating-vulnerability-discovery-here-s-how-appsec-teams-must-adapt--ebdd7j4rz) · The New Stack · 0 upvotes · 0 comments --- Tags: [#ai-security](https://daily.dev/tags/ai-security), [#claude-code](https://daily.dev/tags/claude-code), [#prompt-injection](https://daily.dev/tags/prompt-injection) [View this post on daily.dev](https://daily.dev/posts/new-archestra-s-openappa-saturates-two-major-security-benchmarks-with-a-0-attack-success-rate-uneavqqlp) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"New Archestra's OpenAPPA Saturates Two Major Security Benchmarks with a 0% Attack Success Rate","url":"https://daily.dev/posts/new-archestra-s-openappa-saturates-two-major-security-benchmarks-with-a-0-attack-success-rate-uneavqqlp","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/new-archestra-s-openappa-saturates-two-major-security-benchmarks-with-a-0-attack-success-rate-uneavqqlp"},"datePublished":"2026-10-03T23:46:35.585Z","dateModified":"2026-10-15T02:22:33.179Z","description":"Archestra released OpenAPPA, an open-source security engine that enforces deterministic information-flow policies outside an AI agent's execution loop to stop...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/1a0e494a92e86d4797e08f024bb5510c?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/1a0e494a92e86d4797e08f024bb5510c?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"InfoQ","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"InfoQ","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/afc3bced3e1e4b188dd9127017a60e0c","url":"https://daily.dev/sources/infoq"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/new-archestra-s-openappa-saturates-two-major-security-benchmarks-with-a-0-attack-success-rate-uneavqqlp","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"ai-security,claude-code,prompt-injection","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"InfoQ","item":"https://daily.dev/sources/infoq"},{"@type":"ListItem","position":3,"name":"New Archestra's OpenAPPA Saturates Two Major Security Benchmarks with a 0% Attack Success Rate"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/new-archestra-s-openappa-saturates-two-major-security-benchmarks-with-a-0-attack-success-rate-uneavqqlp#faq","mainEntity":[{"@type":"Question","name":"What attack success rate did OpenAPPA achieve on the Bench-Corp and AgentThreatBench security benchmarks compared to Claude Code's auto mode?","acceptedAnswer":{"@type":"Answer","text":"OpenAPPA achieved a 0% attack success rate with 89% task completion on both Bench-Corp and AgentThreatBench, compared to Claude Code's auto mode which had a 10% attack success rate with 90% task completion, and Microsoft FIDES which had 31% attack success with only 41% completion. The benchmarks test sensitive data sharing, prompt injection, approval ordering, and tenant isolation. Developers comparing agent security engines can track benchmark results like these on daily.dev."}},{"@type":"Question","name":"How does OpenAPPA's Agentic Permissions Policy Algebra (APPA) prevent data exfiltration in LLM agents?","acceptedAnswer":{"@type":"Answer","text":"APPA runs a pluggable policy engine outside the agent's prompt and execution loop, so the language model cannot inspect, negotiate with, or bypass rules. It labels data with audience (authorized consumers) and trust (verification level) using monotonic lattice algebra, so labels only become more restrictive as data flows through tool calls, configured in a single appa.toml file. Teams designing agent permission systems can follow architecture breakdowns like this on daily.dev."}},{"@type":"Question","name":"What happens to task completion rate when recovery strategies are disabled in OpenAPPA's agent security model?","acceptedAnswer":{"@type":"Answer","text":"Task completion fell to 35.0% when remedy plans were completely disabled, according to ablation experiments in the APPA research paper, compared to 89% completion with recovery mechanisms like sanitizers, human-authority routing, and disposable child branches enabled. This shows recovery semantics are critical to maintaining agent utility alongside strict security enforcement. Engineers balancing agent safety and utility can follow research like this on daily.dev."}}]} ```