Skip to content
Apart Research
Apart Research
Contact us
Sprint projectNov 23, 2025Spain

Actions speak louder than words: Evaluating Tool Usage Risk in Open-Weight AI for Defensive Deployment

Ana Belen Barbero Castejon, Carlos Vecina Tebar · Team Actions speak louder than words

Submitted to Defensive Acceleration Hackathon. Sprint projects are early-stage work by participants, not Apart Research publications.

Read the report

Report: Actions speak louder than words: Evaluating Tool Usage Risk in Open-Weight AI for Defensive Deployment

Open in a new tab (opens in new tab)
Code (opens in new tab)More on ow-ai-cyber-bio-actions-eval.streamlit.app (opens in new tab)
Share

Open-weight language models are increasingly deployed in agentic workflows where they can invoke external tools, creating new attack vectors beyond traditional text generation. We present a systematic evaluation framework that measures how model tampering affects tool-usage behavior across cybersecurity, bioengineering, and decision-making domains. Evaluating 10 model variants (5 base + 5 tampered) across 125 scenarios, we find statistically significant that tampering increases harmful tool invocation rates, with effects varying significantly by domain. Our framework, released as open-source with an interactive dashboard, provides a foundation for monitoring AI agent behavior in production deployments and highlights tool-usage / MCP security as a critical defensive intervention point. (https://github.com/AnaBelenBarbero/OW-AI-cyber-bio-actions-eval)

Keywords: AI tools security, open-weight models, model tampering, agentic AI

Reviews

Judging this Sprint?

Review this project

Your public critique appears on this page without your name. Your private critique is not published; only the Apart team reads it. If you agree below, we share your review with grantmaking.ai (opens in new tab) and the Transformative AI Fund so strong projects can be funded.

Not shown on this page.

Shown on this page, without your name.

Only the Apart team reads this, and funders if you agree below.

Share my name publicly on grantmaking.ai *
Share my private critique with funders *

Does this reduce AI-related catastrophic or existential risks?

Scoring guide
  1. 1Minimal Impact. The project has minimal relevance to AI safety. It doesn't meaningfully address risks uniquely enabled or accelerated by advanced AI systems.
  2. 2Tangential Connection. The project touches on AI safety concepts but lacks depth or specificity. The connection to AI-enabled threats (bio, cyber, or AI misuse) is weak or unclear.
  3. 3Clear AI Safety Value. The project clearly reduces AI-related risks with valuable contributions. It addresses specific threats from AI systems and engages meaningfully with biosecurity, cybersecurity, or AI safety challenges.
  4. 4Significant Impact Potential. The above, plus the project demonstrates scalable safety mechanisms or defensive approaches. It shows clear potential to buy time for solving harder problems like alignment, or creates positive externalities for the broader AI safety ecosystem.
  5. 5Major Advancement. The above, plus the project represents a significant leap forward in defensive AI safety. Judges would eagerly share this with biosecurity, cybersecurity, or AI safety researchers and expect it to influence the field.

Does this strengthen the shield against AI-enabled threats?

Scoring guide
  1. 1Minimal Relevance. The project is only tangentially related to defensive technology or societal protection. Connection to biosecurity, cybersecurity, or defensive infrastructure is unclear or missing.
  2. 2Some Relevance. The project has some relevance to defensive acceleration, but the connection is broad or generic. It touches on defense without specific focus on AI-enabled threats or protective capabilities.
  3. 3Clear Relevance. The project clearly addresses defensive gaps against AI-enabled threats. It connects to at least one track (biosecurity, cybersecurity, or defense infrastructure) and demonstrates understanding of the threat landscape.
  4. 4Strong Contribution. The above, plus the project builds on existing defensive approaches and offers novel tools, frameworks, or implementations. It explicitly explains how it strengthens defensive capabilities with realistic deployment potential.
  5. 5Breakthrough Impact. The above, plus the project provides breakthrough insights or tools that could significantly influence defensive technology development. It identifies critical gaps and presents compelling solutions with clear paths from prototype to deployed system.

Did you build something that actually works?

Scoring guide
  1. 1Incomplete or Flawed. The project appears rushed or incomplete. Technical implementation is flawed, core functionality doesn't work, or the approach is fundamentally unsound. Little to no documentation.
  2. 2Basic Competence. The project shows reasonable effort with basic technical competence. Core functionality partially works. Documentation exists but may be incomplete. Some limitations are acknowledged.
  3. 3Solid Hackathon Project. The project is technically solid and well-scoped for 48 hours. Core functionality works and is documented. Code/methods are understandable and limitations are honestly addressed. This is what a good weekend prototype should look like.
  4. 4Impressive Implementation. The above, plus the implementation exceeds typical hackathon quality. Clear methodology, thorough documentation, and working demo. The tool/prototype is immediately useful for defenders and could realistically be built upon.
  5. 5Exceptional Execution. The project far exceeds expectations with exceptional technical execution. The implementation is elegant, fully functional, and includes something special (e.g., deployed demo, exceptional documentation, innovative architecture, or clear startup potential).

  1. This is a helpful exploration of an important set of questions: tool usage could be a key threat vector and it's great that you have put the time in to carefully evaluate this. It has clear relevance for AIS. The abliterations are welcomed, as are the coverage of multiple domains and statistical rigour. And tool usage monitoring could be the right solution here. The execution is also solid, and it was helpful to see the dashboard - the one flag here is the '-1%' success rate that appeared for GPT-OSS in two instances. Was this just a rendering issue? It would also be helpful to read more about what should be done about the results you identify - though of course that would be difficult to complete in a weekend.

    I think (low-confidence) that you're correct on looking into MCP gateways as a next step. Some other things you could do:

    - Include scenarios with subtle or implicit malicious framing that aren't just explicit instructions

    - Test on llama models

    - Add a policy engine to enforce rules based on risk levels and contexts + perhaps an alerting mechanism

    Read full reviewShow less

  2. Strong prototype and written report does a great job to shift thinking about AI risk from what models say to what models do. Also appreciate the great title and inclusion of a real-world case.

    For this project, I would appreciate seeing a short literature review just to show that this research is not repeating work happening elsewhere. I would also like a slightly firmer argument for why open-weight models are higher risk.

    Team clearly outlined application to a variety of domains. Next step would be to anchor one of those in a more realistic scenario and show how this evaluation framework would identify and quantify risk in a real setting. With such a robust report, I'd like to see an example of what a final deployment would look like.

Cite this project

@misc{castejon2025actions,
  title = {{Actions speak louder than words: Evaluating Tool Usage Risk in Open-Weight AI for Defensive Deployment}},
  author = {Ana Belen Barbero Castejon and Carlos Vecina Tebar},
  year = {2025},
  month = nov,
  note = {Submitted to Defensive Acceleration Hackathon, an Apart Research Sprint},
  howpublished = {\url{https://apartresearch.com/sprints/projects/actions-speak-louder-than-words-evaluating-tool-usage-risk-in-openweight-ai-for-defensive-deployment-g3k0}},
  url = {https://apartresearch.com/sprints/projects/actions-speak-louder-than-words-evaluating-tool-usage-risk-in-openweight-ai-for-defensive-deployment-g3k0}
}

More from Defensive Acceleration Hackathon

All 84 entriesBrowse all projects

Build something like this at the next Sprint

AI Collusion Research Sprint · Oct 23 - 25, 2026