AgentXploit: Autonomous Repository-to-Runtime Red-Teaming for AI Agents

Weida Liang; Shi Qiu; Zhun Wang; Simon Sure; Xiaoyuan Liu; Tianneng Shi; Zhaorun Chen; Wenbo Guo

cs.CRSep 25, 2026

AgentXploit: Autonomous Repository-to-Runtime Red-Teaming for AI Agents

Authors: Weida Liang, Shi Qiu, Zhun Wang, Simon Sure, Xiaoyuan Liu, Tianneng Shi, Zhaorun Chen, Wenbo Guo,

Organizations: National University of Singapore · University of North Carolina at Chapel Hill · University of California, Berkeley · University of Chicago ·

Abstract

AI agents combine language models with external data and tools that can modify files, call APIs, or execute code. Security failures can arise when adversarial content changes an agent's tool use or when the surrounding software contains vulnerabilities such as path traversal or command injection. We study authorized white-box pre-deployment auditing, where the auditor has access to the target repository and a controlled runtime, but successful attacks must still act through the task-defined attacker interface and be confirmed by an external verifier. We present AgentXploit, a two-role auditing system that separates repository-level attack-path discovery from runtime exploitation. The Analyzer Agent traces attacker-controlled inputs to sensitive operations and records code-supported candidate attack paths; the Exploiter Agent turns these paths into concrete attacks and revises them using runtime feedback. We also introduce AgentXploit-Bench, containing 72 reproducible vulnerabilities across 12 open-source AI-agent systems and frameworks. Across three runs, AgentXploit reaches 59.3% end-to-end success, compared with 38.4% for Codex. Under a token-budget-matched comparison, Codex reaches 46.3%. On AgentDojo, where injection points are provided, the Exploiter Agent reaches 79.2% attack success versus 52.7% for AgentVigil. These results highlight repository discovery and runtime exploitation as distinct challenges in end-to-end agent security auditing.

Figures & tables

Figure 1: Overview of AgentXploit. The Analyzer Agent searches the repository and records candidate attack paths with supporting code evidence. The evaluation harness launches an isolated target, and the Exploiter Agent tests those paths only through the attacker interface. An external deterministic verifier, rather than the agent, checks the specified security outcome.

Capability	Analyzer	Exploiter	Verifier
Inspect repository artifacts	Yes	Yes	No
Send attacker-controlled input	No	Yes	No
Read protected target state	No	No	As needed
Determine benchmark success	No	No	Yes

Table 1: Separation of audit access, runtime action, and success checking.

Mode	Input	Measures
Analysis-only	Repository; no target execution	Recovery of the ground-truth attack path
Exploit-only (oracle)	Vulnerability specification and runtime	Exploit construction when the attack path is known
End-to-end	Repository and runtime; no vulnerability specification	Discovery and runtime exploitation

Table 2: Evaluation modes in AgentXploit-Bench. The first two are diagnostics; end-to-end is the primary task.

Framework/System	Instances	Share
AgentScope	9	12.5%
AutoGPT	3	4.2%
DB-GPT	2	2.8%
GPT_Academic	22	30.6%
GPT-Researcher	2	2.8%
LangChain	8	11.1%

Table 3: Framework distribution in AgentXploit-Bench.

Path	#	Analysis	Exploit-only	AgentXploit end-to-end	Codex 1 $\times$	Codex matched
Direct	59	74.6 $\pm$ 2.9	91.5 $\pm$ 1.7	59.3 $\pm$ 2.9	40.7 $\pm$ 3.4	48.0 $\pm$ 2.0
Indirect	13	59.0 $\pm$ 7.7	71.8 $\pm$ 4.4	59.0 $\pm$ 8.9	28.2 $\pm$ 7.7	38.5 $\pm$ 4.4
All	72	71.8 $\pm$ 3.2	88.0 $\pm$ 0.8	59.3 $\pm$ 2.1	38.4 $\pm$ 2.9	46.3 $\pm$ 1.6

Table 4: Pass@1 on the 72-instance AgentXploit-Bench, reported as mean

\pm

sample standard deviation over three runs. Values are percentages. Exploit-only receives the oracle specification.

Task	Path	WAF	Utility
RCE via eval()	Direct	No	3/3 $\rightarrow$ 3/3
VectorSQL eval() injection	Direct	Yes	3/3 $\rightarrow$ 3/3
PAL code injection	Indirect	Yes	3/3 $\rightarrow$ 3/3
Config file disclosure	Direct	No	3/3 $\rightarrow$ 3/3
safe_eval bypass RCE	Indirect	Yes	3/3 $\rightarrow$ 3/3
Path-traversal sandbox escape	Direct	Yes	3/3 $\rightarrow$ 3/3

Table 5: Scoped attack-quality diagnostics. Utility reports successful benign requests before and after the attack.

Method	Bank	Slack	Travel	Work	All
Handcrafted	0.326	0.924	0.307	0.308	0.415
AgentVigil	0.604	0.905	0.233	0.479	0.527
Exploiter Agent	0.750	1.000	0.754	0.742	0.792

Table 6: Attack success rates on AgentDojo.

Path	Total	End-to-end fail.	Analysis miss	Exploit fail.
Direct	59	24	15	9
Indirect	13	5	5	0
Overall	72	29	20	9

Table 7: Failure-stage breakdown for the initial AgentXploit-Bench run.

Figure 2: AgentDojo attack success over optimization rounds for the full system and ablations.

Repository	Run 1	Run 2	Run 3	Mean $\boldsymbol{\pm}$ std.
Original	13/20	15/20	15/20	71.7 $\pm$ 5.8%
Mutated	13/20	14/20	14/20	68.3 $\pm$ 2.9%

Table 8: Analysis recovery on original and mutated repositories.

Outcome	Runs	Share
Recovered before and after	39	65.0%
Recovered only before	4	6.7%
Recovered only after	2	3.3%
Missed in both conditions	15	25.0%
Total	60	100%

Table 9: Paired outcomes over 60 mutation task-runs.

Stopping reason	Runs	Share
Verifier-confirmed success	83	38.4%
Self-declared completion without success	92	42.6%
Budget exhausted	29	13.4%
Tool or runtime error	12	5.6%
Total	216	100%

Table 10: Stopping reasons for 216 default-budget Codex runs.

Category	Time (s)	Tokens	Calls
Success	58/47	36k/34k	7.5/7
Self-declared failure	34/27	22k/20k	4.5/4
Budget exhausted	176/180	40k/40k	10.5/10
Tool/runtime error	25/16	10k/7k	2.2/2

Table 11: Diagnostics by default-run stopping category. Entries are mean/median.

System/budget	Nominal cap	Actual tokens	Wall-clock (s)	End-to-end pass@1	Successes/216
Codex 1 $\times$ default	40k	29.5k/25.8k/15.1k	61.8/37/164	38.4 $\pm$ 2.9%	83
Codex 4 $\times$	160k	92k/86k/45k	219/196/410	45.8 $\pm$ 1.4%	99
Codex token-cap matched	per task; 108k mean	76k/71k/32k	181/158/350	46.3 $\pm$ 1.6%	100
AgentXploit	task dependent	108k mean total	455 mean	59.3 $\pm$ 2.1%	128

Table 12: Model-token scaling over three runs. Token entries are mean/median/std.; time entries are mean/median/P90 where available.

Method	Direct	Indirect	All
Codex 1 $\times$	40.7 $\pm$ 3.4	28.2 $\pm$ 7.7	38.4 $\pm$ 2.9
Codex 4 $\times$	47.5 $\pm$ 1.7	38.5 $\pm$ 0.0	45.8 $\pm$ 1.4
Codex matched	48.0 $\pm$ 2.0	38.5 $\pm$ 4.4	46.3 $\pm$ 1.6
AgentXploit	59.3 $\pm$ 2.9	59.0 $\pm$ 8.9	59.3 $\pm$ 2.1

Table 13: Direct and indirect end-to-end pass@1 under higher model-token budgets.

Project	Type	Finding
AgentScope	SSRF	Unrestricted URL fetching in the web digest service
AutoGPT	Unauthorized access	Model-directed cloning of arbitrary public repositories without trust validation
GPT-Acad.	Insecure configuration	Plaintext logging of conversations, including API keys, under gpt_log/admin
GPT-Acad.	SSRF	Doc2X PDF conversion reachable with attacker-provided URLs
GPT-Acad.	Command injection	Shell command injection in the ChatGLM fine-tuning helper
GPT-Acad.	Command injection	Arbitrary command launch through unsanitized Doc2X/Markdown file paths

Table 14: Additional vulnerabilities outside the AgentXploit-Bench target set.

AI Agent Auditing

AI agent auditing examines agents’ actions, tool use, evidence, and outcomes to assess safety, compliance, reliability, and accountability.

See all 248 papers

Agent Audit: A Security Analysis System for LLM Agent Applications
Mar 24, 2026Haiyue Zhang, Yi Nian, Yue ZhaoAI Agent Auditing LLM Agent Security
University of Southern California Los Angeles, California, USA
Know Your Agent: Reconnaissance-Driven Pentesting of AI Agents
Jul 22, 2026Or Zion Eliav, Eyal Lenga, Shir Bernstien +1AI Agent Security AI Agent Security Benchmarks
Faculty of Computer and Information Science Ben-Gurion University of the Negev Beer-Sheva, Israel
CWE-bench: Refocusing Agentic Security from Exploitation to Defense
Oct 12, 2026Gonzalo Gonzalez-Pumariega, Ajay Jagannath, Adit Jain +3AI Agent Security AI Agent Security Benchmarks

Mar 24, 2026J/K move · Enter open · S save

Agent Audit: A Security Analysis System for LLM Agent Applications

Haiyue Zhang, Yi Nian, Yue Zhao

University of Southern California Los Angeles, California, USA

AI Agent Auditing LLM Agent Security Cybersecurity Static Code Analysis

Open paper AskPDF arXiv

What should a developer inspect before deploying an LLM agent: the model, the tool code, the deployment configuration, or all three? In practice, many security failures in agent systems arise not from model weights alone, but from the surrounding software stack: tool functions that pass untrusted inputs to dangerous operations, exposed credentials in deployment artifacts, and over-privileged Model Context Protocol (MCP) configurations. We present Agent Audit, a security analysis system for LLM agent applications. Agent Audit analyzes Python agent code and deployment artifacts through an agent-aware pipeline that combines dataflow analysis, credential detection, structured configuration parsing, and privilege-risk checks. The system reports findings in terminal, JSON, and SARIF formats, enabling direct integration with local development workflows and CI/CD pipelines. On a benchmark of 22 samples with 42 annotated vulnerabilities, Agent Audit detects 40 vulnerabilities with 6 false positives, substantially improving recall over common SAST baselines while maintaining sub-second scan times. Agent Audit is open source and installable via pip, making security auditing accessible for agent systems. In the live demonstration, attendees scan vulnerable agent repositories and observe how Agent Audit identifies security risks in tool functions, prompts, and more. Findings are linked to source locations and configuration paths, and can be exported into VS Code and GitHub Code Scanning for interactive inspection.

Abstract

AI Agent Auditing

Explore similar work

Agent Audit: A Security Analysis System for LLM Agent Applications

Know Your Agent: Reconnaissance-Driven Pentesting of AI Agents

CWE-bench: Refocusing Agentic Security from Exploitation to Defense