While it’s not exactly an adversarial attack, there was a bot that could win a lot of games playing the Black Hole opening on CGOS
https://www.reddit.com/r/baduk/comments/bbh19d/speculation_about_black_hole_ai/
I think at some point one has to decide what’s actually “fair” though. Or one has to consider what adversarial really means.
You can probably consistently beat a fixed version of Katago by picking another Katago version with better hardware or more playouts etc.
Is a newer version of Katago that has a good winrate against an older version of Katago an adversary?
I mean it’s probably improving from self play anyway.