Red-Teaming the Agentic Red-Team

Source

• Source name: arXiv
• Source kind: paper
• Authors / organization: Dario Pasquini, Michal Bazyli, Taras Fedynyshyn, Artem Sorokin
• Venue: arXiv: cs.CR
• Published: 2026-06-23
• Collected: 2026-06-24
• URL: http://arxiv.org/abs/2606.24496v1
• PDF: https://arxiv.org/pdf/2606.24496v1
• DOI: UNKNOWN

Plain-Language Brief

The paper presents an in-depth security analysis of widely used agentic systems for offensive security operations. It identifies common design flaws that can allow an active adversary to compromise operator's machines, even when the agent operates inside a sandboxed container. The authors propose a cyber kill chain for such systems and suggest a robust architecture and design principles to mitigate these issues.

What the Document Says

• The use of agentic systems for offensive security operations has become common. However, the focus has been on creating more capable agents, with less attention on their security.
• The authors present a security analysis of widely used tools in this field and show that they share design flaws.
• These flaws can enable an active adversary to exfiltrate API keys, establish persistent footholds, and fully compromise the operator's machine, even within sandboxed containers.
• A cyber kill chain is introduced for agentic systems, covering initial manipulation, lateral movement, persistence, guardrail bypass, and sandbox escape.
• Based on their analysis, a robust architecture for agentic offensive-security tools is proposed along with design principles to mitigate the identified attack paths.

Key Concepts Mentioned

• agentic systems
• offensive security operations
• API keys
• persistent footholds
• sandboxed container
• cyber kill chain
• robust architecture

Claims Made by the Document

• Widely used agentic systems for offensive security operations have common design flaws.
• These flaws can be exploited by an active adversary to compromise the operator's machine.
• A cyber kill chain has been introduced for these systems.

Evidence Used

• The authors present a detailed security analysis of widely used tools in this field.

Methods / Approach

UNKNOWN

Limitations Stated by the Authors

UNKNOWN

Limitations Noted by the Agent

Agent interpretation — not from the source.

UNKNOWN

Open Questions

UNKNOWN

Notes for Future Q&A

May include interpretation. Labeled where it does.

UNKNOWN

Raw Abstract / Excerpt

The use of agentic systems to perform offensive security operations has moved from a theoretical possibility to a commoditized capability. However, while the community has focused on creating more and more capable agents, less attention has been allocated to assessing the security of those systems. In this work, we present the first in-depth security analysis of the most widely used agentic systems for offensive security operations. We show that most of these tools share common design flaws that enable an active adversary to exfiltrate API keys, establish persistent footholds, and fully compromise the operator's machine, even when the agent operates inside a sandboxed container. To support our analysis, we introduce a full cyber kill chain for such agentic systems, capturing the progression from initial LLM manipulation to lateral movement, persistence, guardrail bypass, and sandbox escape. Building on our security analysis, we derive a robust architecture for agentic offensive-security tools and propose actionable, broadly applicable design principles that mitigate the disclosed attack paths at the architectural level.