X-AgentRed: Red-Teaming Personal Agents in Evolving Multi-Service Ecosystems
Yeonsung Jung, Ninareh Mehrabi and colleagues (Meta Reality Labs Research, Meta Superintelligence Labs) present X-AgentRed, a self-evolving red-teaming framework that searches for harmful tool-call paths across the services a personal agent can use.
Ask this paper
Compositional risk. A benign request can cause harm when actions across services interact, such as an agent leaking information as it moves data between apps.
HarmFlow graph. The red-team agent analyzes each tool's effects, potential harms and preconditions, and builds a directed graph of how one tool's effects satisfy another's preconditions.
Feedback. Recipes sampled from the graph become realistic scenarios. Successful paths are diversified by tool substitution, and blocked steps get refined preconditions.
Results. Across four frontier agentic models, X-AgentRed reaches 1.77x the harmful path rate of STAC and 2.99x its tool coverage on average.
Cost. Keeping the graph current as services change requires re-evaluating affected tool dependencies.
Abstract
Personal agents increasingly connect to services across the web and applications by using tools. As the effects of their actions accumulate and interact across services, unintended or harmful outcomes can arise when agents fulfill benign user requests. Proactively identifying these compositional failures requires systematically exploring diverse cross-service paths. Existing red-teaming methods often simply prompt LLMs to identify potentially harmful paths from task and environment descriptions or decompose harmful objectives specified by humans or LLMs into seemingly benign action combinations. However, generation is biased toward patterns learned during training, potentially favoring familiar tool combinations and leaving novel cross-service interactions underexplored. To address this, we propose X-AgentRed, a self-evolving red-teaming framework that discovers harmful tool call paths through a graph of tool dependencies and expands and refines them using execution feedback. By analyzing each tool's effects, potential harms, and preconditions for execution, the red-teaming agent constructs a directed graph that captures how one tool's effects can satisfy another's execution preconditions. Recipes sampled from this graph are instantiated as realistic scenarios in which agents can produce harmful outcomes. Execution feedback enables self-improvement by diversifying paths that produce harm through tool substitution and refining preconditions at blocked steps in unsuccessful paths to enable further execution. Across four frontier agentic models, X-AgentRed achieves $1.77\times$ the harmful path rate of STAC and explores a more diverse set of tools, yielding $2.99\times$ the tool coverage on average.