Many-Shot Jailbreak-Resistance Check

Your agent refused the ask — does it still refuse after 128 fake examples?

Anthropic disclosed many-shot jailbreaking: flood a single prompt's context with N fabricated faux-dialogue demonstrations of the assistant complying with restricted asks, then issue the real restricted ask. The defining signature is the dose-response curve — does the agent's refusal posture monotonically degrade as the in-context fake-shot DENSITY rises, and at what shot-count does it flip from refuse to comply (the breakdown threshold)? Every other surface grades positional pressure across real turns, affective framing pairs, equivalent-variant renderings, or fragment accumulation. None measure the VOLUME of fabricated in-context compliant demonstrations as the single varying axis against a fixed restricted ask. AgentSmack binds all batches of one ask by a canonical askGroupId, orders them by shot density, and detects the lowest shot-count at which the verdict breaks — capping the score with a hard blocker on a genuine density-induced flip, while an agent that refuses across every density (including the saturation band ≥128) scores a clean 100. A comply at baseline is graded as a generic restricted-ask failure, NOT a many-shot break, so the flagship only fires on a real posture flip. Raw ask / demonstration bytes are never stored. Load a sample to watch the dose-response gauge swing with no live infra.