Personal agents connect to services across the web and applications through tools. As accumulated effects interact across services, unintended or harmful outcomes can arise when agents fulfill benign user requests. Proactively identifying these compositional failures requires systematically exploring diverse cross-service paths.
Limitations of Existing Red-Teaming Approaches
Existing red-teaming methods often simply prompt large language models to identify potentially harmful paths from task and environment descriptions or decompose harmful objectives specified by humans or large language models into seemingly benign action combinations. However, generation remains biased toward patterns learned during training, potentially favoring familiar tool combinations and leaving novel cross-service interactions underexplored.
X-AgentRed: Self-Evolving Red-Teaming Framework
X-AgentRed discovers harmful tool call paths through a graph of tool dependencies and expands and refines them using execution feedback. By analyzing each tool's effects, potential harms, and preconditions for execution, the red-teaming agent constructs a directed graph that captures how one tool's effects can satisfy another's execution preconditions. Recipes sampled from this graph are instantiated as realistic scenarios in which agents can produce harmful outcomes.
Self-Improvement Through Execution Feedback
Execution feedback enables self-improvement by diversifying paths that produce harm through tool substitution and refining preconditions at blocked steps in unsuccessful paths to enable further execution. This iterative process means the framework adapts as it encounters blocked or unexpected execution paths, progressively covering more tools and path combinations.
Quantitative Results Across Frontier Agentic Models
Across four frontier agentic models, X-AgentRed achieves 1.77 times the harmful path rate of STAC and explores a more diverse set of tools, yielding 2.99 times the tool coverage on average. These numbers indicate both increased detection of harmful compositions and broader exploration of the tool dependency space.
Practical Implications for Agent Safety
The directed graph of tool dependencies provides a structured view of how tool effects propagate across services, which can inform safer agent design or prompt intervention strategies. The self-evolving nature of the framework means it can be applied ongoing as new tools and services are integrated into agent ecosystems.
As personal agents expand into more service-connected workflows, the surface area for harmful compositions grows. X-AgentRed demonstrates a methodical approach to exploring this space using execution feedback and graph-structured dependency analysis. Future work could integrate these discovered failure modes into agent training or develop real-time monitoring based on the graph structure. Read the paper on arXiv