A self-improving red-teamer took Claude Opus 4.8 from 4% to 24% injection success on computer-use tasks.

SIR composes stealthy OS-level injections from a small plain-language library of reusable principles, then diagnoses failed trajectories to distill new named strategies and reapply them (arXiv 2608.30207). Scored with a deterministic oracle checking filesystem, service and permission state rather than an LLM judge, it also took Gemini 3.5 Flash from 0% to 28%, with the benign task still completing. Principles discovered against one model transferred to a different architecture with no additional feedback. Fixed hand-written injection benchmarks understate real exposure.