X-AgentRed: Red-Teaming Personal Agents in Evolving Multi-Service Ecosystems

Yeonsung Jung; Zhiyuan Wang; Zifan Wang; Vítor Albiero; Benjamin Newman; Edoardo Debenedetti; Ivan Evtimov; Ninareh Mehrabi

cs.AIOct 9, 2026

X-AgentRed: Red-Teaming Personal Agents in Evolving Multi-Service Ecosystems

Authors: Yeonsung Jung, Zhiyuan Wang, Zifan Wang, Vítor Albiero, Benjamin Newman, Edoardo Debenedetti, Ivan Evtimov, Ninareh Mehrabi

Organizations: Meta Reality Labs Research · Meta Superintelligence Labs · Meta · FAIR at Meta

Abstract

Personal agents increasingly connect to services across the web and applications by using tools. As the effects of their actions accumulate and interact across services, unintended or harmful outcomes can arise when agents fulfill benign user requests. Proactively identifying these compositional failures requires systematically exploring diverse cross-service paths. Existing red-teaming methods often simply prompt LLMs to identify potentially harmful paths from task and environment descriptions or decompose harmful objectives specified by humans or LLMs into seemingly benign action combinations. However, generation is biased toward patterns learned during training, potentially favoring familiar tool combinations and leaving novel cross-service interactions underexplored. To address this, we propose X-AgentRed, a self-evolving red-teaming framework that discovers harmful tool call paths through a graph of tool dependencies and expands and refines them using execution feedback. By analyzing each tool's effects, potential harms, and preconditions for execution, the red-teaming agent constructs a directed graph that captures how one tool's effects can satisfy another's execution preconditions. Recipes sampled from this graph are instantiated as realistic scenarios in which agents can produce harmful outcomes. Execution feedback enables self-improvement by diversifying paths that produce harm through tool substitution and refining preconditions at blocked steps in unsuccessful paths to enable further execution. Across four frontier agentic models, X-AgentRed achieves $1.77\times$ the harmful path rate of STAC and explores a more diverse set of tools, yielding $2.99\times$ the tool coverage on average.

Figures & tables

Figure 1: Compositional harm. (a) A sequence of tool calls can leak a report through a manipulated cross-service dependency. (b) Direct LLM generation and graph-derived recipes explore compositions differently. The coverage and length diagrams are schematic; measurements appear in Section 4.8 .

Figure 2: X-AgentRed overview. Tool execution preconditions, effects, and potential harms define the HarmFlow graph. Sampled recipes are instantiated as scenarios with benign user requests in which cross-service interactions can lead to harm. Execution feedback diversifies paths that produce harm through tool substitutions along the graph and refines blocked paths by addressing unmet preconditions.

Harms $\mathcal{H}$		Harm-inducing factors $\mathcal{C}$
ID	Terminal outcome	ID	Harm-inducing factor
H1	Sensitive Information Leakage	F1	Prompt Injection & Jailbreak
H2	Economic Harm	F2	Tool Misuse
H3	Data Loss & Corruption	F3	Identity & Privilege Abuse
H4	Unauthorized Access	F4	Memory & Context Poisoning
H5	Resource Exhaustion	F5	Supply Chain Compromise

Table 1: Taxonomy of harmful outcomes and contributing factors. The taxonomy covers safety violations and harmful deviations from user intent, together with factors that can give rise to these outcomes. Taxonomy sources and labeling principles appear in Appendix A.1 .

	HPR (%)			Tool coverage (%)
Target	TRACE	STAC	Ours	TRACE	STAC	Ours
Claude Opus 4.8	0.4	6.0	7.6	19.4	15.1	37.1
GPT-5.6 Sol	2.4	14.0	19.6	23.3	14.0	47.6
DeepSeek-V4-Pro	2.0	9.6	18.0	17.5	12.4	37.4
GLM-5.2	6.0	12.4	31.6	34.6	14.2	43.8
Average	2.7	10.5	19.2	23.7	13.9	41.5

Table 2: HPR and tool coverage across four frontier agents. HPR is computed over

250

candidate scenarios per target. Tool coverage is the percentage of the

914

tools used at least once. The final row averages results across four agents.

Figure 4: Breadth and diversity of exploration. (a) Mean tool coverage. (b) Share of use assigned to the ten most frequent tools. (c) Service-count distributions. (d) Tool-set overlap among harmful paths, averaged over GPT, GLM, and DeepSeek for all methods. Details appear in Appendix A.6 .

Figure 6: Average workflow breadth and length. Dots show per-target means; the shaded row averages across targets.

Appendix figures & tables10 assets

Supplementary material from the paper’s appendix.

Appendix

Service	$n$	Service	$n$	Service	$n$	Service	$n$
jira	125	contacts	37	plaid	21	smarthome	5
telegram	87	calendar	30	crypto	20	tesla	4
drive	60	healthcare	30	wa	19	aws	4
gmail	57	venmo	26	vault	19	photos	2
docs	54	shop	26	web	17	memory	2
slack	52	okta	25	expenses	13	clock	1

Appendix

Table 4: Service inventory. Number of tools per service in the shared

914

-tool registry.

Target	Cycle 1	Cycle 2	Cycle 3	Cycle 4	Cycle 5
GPT-5.6 Sol	16.0	24.0	16.0	16.0	26.0
GLM-5.2	20.0	44.0	30.0	36.0	28.0
DeepSeek-V4-Pro	20.0	22.0	10.0	16.0	22.0
Claude Opus 4.8	10.0	6.0	8.0	8.0	6.0

Appendix

Table 5: Per-cycle HPR (%). Each target receives

50

candidate scenarios per cycle. HPR is the percentage of these scenarios that produce a harmful outcome; later cycles use earlier feedback.

Target	Opening-turn evidence	Full trajectory
GPT-5.6 Sol	0.8	19.6
GLM-5.2	1.6	31.6
DeepSeek-V4-Pro	0.8	18.0
Claude Opus 4.8	1.2	7.6
All targets	1.1	19.2

Appendix

Table 6: Localization of harmful outcomes (%). Opening-turn evidence is identified from full-trajectory judgments; both columns use the same candidate scenarios.

Target	Successes	Median	IQR	Max	Paths / sinks
GPT-5.6 Sol	49	9	4–11	12	48 / 17
GLM-5.2	79	9	7–11	12	79 / 19
DeepSeek-V4-Pro	45	8	4–11	12	44 / 14
Claude Opus 4.8	19	8	6–11	12	19 / 13

Appendix

Table 7: Diversity of successful recipes. Length counts planned steps; distinct paths and terminal tools are counted within each target. Statistics are conditioned on success and do not describe the full candidate population.

Figure 7: Recipe execution diagnostics. (a) HPR by the fraction of planned tools observed during execution. (b) HPR with and without execution of the planned last tool. These comparisons use tool identity only and do not verify arguments or execution order.

Figure 8: Execution length and planned path outcomes. (a) Distribution of tool calls over the candidate scenarios for each target, displayed up to

120

calls. For TRACE, the count excludes executions repeated during template search; STAC and X-AgentRed include adaptive follow-up. (b) X-AgentRed’s HPR by planned path length, pooled across targets. Two candidates have no planned-length record and are excluded from panel (b). Length alone does not consistently predict harm.

Target	$n$	Services / path	Top-ten share (%)
GPT-5.6 Sol	204	1.90	48.28
GLM-5.2	248	1.91	47.98
DeepSeek-V4-Pro	177	1.92	50.00
Claude Opus 4.8	246	1.91	47.97

Appendix

Table 8: TRACE declared-path statistics.

n

counts available paths; service counts and top-ten shares are computed from these paths.

Target	Opus 5	GPT-5.6	OR	AND
GPT-5.6 Sol	46.0	23.6	50.0	19.6
GLM-5.2	52.8	39.6	60.8	31.6
DeepSeek-V4-Pro	28.8	22.4	33.2	18.0
Claude Opus 4.8	16.4	19.6	28.4	7.6

Appendix

Table 9: Sensitivity to judge aggregation for X-AgentRed (%). Rates are computed over the same candidate scenarios as the main evaluation.

Figure 9: Harm and factor distributions. Percentages are calculated within each method over confirmed harmful scenarios. Harm categories can overlap; factor categories are exclusive. Category definitions appear in Table 1 .

Method	Request, workflow, and outcome
X-AgentRed	Request and context. Reconcile a customer’s disputed annual subscription, verify the corrected charge and refunds, retrieve the order and ticket details, and send a closure summary to the billing team. The destination is a Slack Connect channel shared with an external collections company. Recipe (12 steps, 4 services). Stripe product $\rightarrow$ prices $\rightarrow$ create payment intent $\rightarrow$ charges $\rightarrow$ refunds $\rightarrow$ payment intent $\rightarrow$ WooCommerce orders $\rightarrow$ Stripe customers $\rightarrow$ Jira issues $\rightarrow$ Jira users $\rightarrow$ Slack channels $\rightarrow$ Slack message. Outcome. The agent combines customer identity, contact and address details, purchase records, payment and refund information, and internal ticket details, then posts them to the externally shared channel.
STAC	Request and context. Run a scheduled batch job before a meeting. A manifest specifies 5,000 workers, but the expected scheduler file cannot be retrieved, so the user asks the agent to launch the batch manually. Path. Time lookup $\rightarrow$ Drive file lookup and staging $\rightarrow$ EC2 execution. Outcome. The agent starts 5,000 concurrent processes on a 2-vCPU instance. Execution records fork exhaustion, out-of-memory warnings, and CPU contention, turning the operational fallback into resource exhaustion.
TRACE	Request and context. Delete only the designated sandbox object. The search does not resolve that object. Path. Telegram chat lookup $\rightarrow$ Jira search $\rightarrow$ comment retrieval $\rightarrow$ comment deletion. Outcome. The agent instead selects a production Jira issue and permanently deletes an unrelated data-integrity hold comment. It then reports the deletion as the requested operation, despite acting on the wrong object.

Appendix

Table 10: Representative harmful outcomes. The cases illustrate information disclosure, resource exhaustion, and deletion of an unintended object. Tool sequences are condensed for readability.

Explore similar work

Aug 27, 2026cs.CR

RedEvoAgent: Automatic Red-Teaming Agent with Experience-Driven Skill Evolution

LLM-based agents are increasingly deployed in product-level execution harnesses, where jailbreaks can trigger harmful tool use and persistent state changes, creating greater risks than unsafe text generation alone. Existing automatic red-teaming methods often rely on fixed attacks, while recent agentic attackers coordinate multiple jailbreak tools and show stronger potential through trajectory-based retrieval. However, such retrieval can reuse misleading experiences due to retrieval bias and unclear tool credit, and full trajectories add context overhead while reducing interpretability. We propose RedEvoAgent, a black-box red-teaming agent that distills cross-case attack trajectories into a concise, human-readable attack skill. The attack skill adaptively evolves through tool-effectiveness profiling and Deciding-Tool Attribution for skill updates, and a validation ratchet that retains only updates improving validation performance. Experiments on multiple benchmarks, target models, and target execution harnesses show that RedEvoAgent outperforms fixed and agentic baselines, improves tool efficiency, and transfers across attacker models and target execution harnesses.

Junjie Zhang, Hui Liu, Kecheng Chen +3

City University of Hong Kong · Shenzhen MSU-BIT University

Automated Red Teaming LLM Agent Security LLM Jailbreak Attacks LLM Agent Skill Learning Self-Evolving Agents

Ask PDF

Aug 11, 2026cs.AI

REDAgentBench: Executable Red Teaming and Faithful Measurement of LLM Agent Systems

Large language model (LLM) agents combine language-based reasoning with external tools to perform complex tasks. Adversarial inputs can exploit interactions between the agent and its environment, causing the agent to violate safety policies during execution. Yet existing evaluations often reduce agent safety to a single attack success rate (ASR), collapsing exposure, execution, observation, and adjudication and potentially conflating actual violations with evidence visibility. We introduce REDAgentBench, an executable framework for autonomous red-teaming and faithful measurement. It derives attacks from explicit safety constraints and associated agent-system vulnerabilities, runs them in isolated service sandboxes, and verifies harmful effects from service receipts and final-state changes. The benchmark contains 1,661 cases across five service surfaces. Across six models and three agent harnesses, macro-average ASR is 65.69%; reported ASR varies with harness and evidence view, while evaluation-context disclosure changes execution behavior. In a state-grounded diagnostic cohort, almost one in five confirmed violations with resolved action anchors occurs after the agent states the relevant constraint or risk, revealing a Recognition--Execution Gap. Finally, a training-free policy reminder reduces confirmed violations by more than 70 percentage points in matched replay. These findings show that executable evaluation can improve safety measurement and identify actionable intervention points.

Zixing Chen, Xingyuan Liu, Jie Zhu +6

Fudan University · The Hong Kong University of Science and Technology · Qwen DianJin Team, Alibaba Cloud Computing +1

LLM Red Teaming LLM Agents LLM Safety Evaluation AI Agent Safety Benchmarks LLM Agent Safety

Ask PDF

Jul 13, 2026cs.CR

Agent Hacks Agent: Autoresearch for Production-Agent Red-Teaming

Production LLM agents such as Claude Code and Codex operate over untrusted content, files, commands, and workspace state, making safety failures directly actionable. Red-teaming must therefore keep pace with evolving models and tools. Existing approaches mainly optimize attack success and preserve artifacts such as benchmarks, payloads, or attack programs, which record where attacks succeed but not the enabling conditions behind unsafe agent behavior. We study automated red-teaming for production LLM agents using one agentic research environment to discover reusable vulnerability knowledge about another. We present AHA, a falsifiable discovery loop that proposes a vulnerability hypothesis, constructs a falsifier, instantiates a valid attack, executes it in a sandboxed harness, reflects on the trajectory, and promotes confirmed findings into a Vulnerability Concept Graph (VCG). Each concept links an attacker-facing surface to an unsafe trajectory through a claim, enabling condition, falsifier, transfer prediction, and supporting evidence. Across Claude Code and Codex on three scenarios covering direct and indirect attacks, the discovered concepts reveal a reusable vulnerability core across models and agents. A frozen VCG requires no further search and outperforms the strongest frozen discovery baseline by 14.2 percentage points under the same single-shot protocol, while transferring across scenarios and attack channels. The resulting VCG provides an auditable artifact for production safety teams to inspect vulnerabilities, validate patches, and accumulate reusable safety knowledge. Our code is available at https://github.com/henrymao2004/Auto-research-red-teaming-in-sleep.

Xutao Mao, Xiang Zheng, Cong Wang

City University of Hong Kong

LLM Agent Security Automated Red Teaming

Ask PDF