Adnan KhanAdnanProduct & AI
San Francisco Bay Area
Get in touch

Source note3 min read

Agent Hacks Agent: Autoresearch for Production-Agent Red-Teaming

Source

arXiv

arxiv.org/abs/2607.11698v1

Read the source

Source

Plain-Language Brief

Researchers have developed a new method called AHA for automated red-teaming of production language models like Claude Code and Codex. This method uses one agentic research environment to discover reusable vulnerability knowledge about another. The discovered concepts reveal a common vulnerability core across models and agents, and the resulting Vulnerability Concept Graph (VCG) provides an auditable artifact for production safety teams.

What the Document Says

  • The researchers focus on Production LLM agents like Claude Code and Codex which operate over untrusted content, files, commands, and workspace state.
  • Red-teaming must keep pace with evolving models and tools due to safety failures being directly actionable.
  • Existing approaches mainly optimize attack success and preserve artifacts such as benchmarks, payloads, or attack programs.
  • The researchers present AHA, a falsifiable discovery loop that finds vulnerability hypotheses, constructs falsifiers, instantiates attacks, executes them in a sandboxed harness, reflects on the trajectory, and promotes confirmed findings into a Vulnerability Concept Graph (VCG).
  • Each concept links an attacker-facing surface to an unsafe trajectory through a claim, enabling condition, falsifier, transfer prediction, and supporting evidence.
  • The study covers three scenarios involving direct and indirect attacks on Claude Code and Codex.
  • The discovered concepts reveal a reusable vulnerability core across models and agents.
  • A frozen VCG requires no further search and outperforms the strongest frozen discovery baseline by 14.2 percentage points under the same single-shot protocol.
  • The VCG can transfer across scenarios and attack channels.
  • The resulting VCG provides an auditable artifact for production safety teams to inspect vulnerabilities, validate patches, and accumulate reusable safety knowledge.

Key Concepts Mentioned

  • Production LLM agents
  • Red-teaming
  • AHA
  • Vulnerability Concept Graph (VCG)
  • Claude Code
  • Codex
  • falsifiable discovery loop
  • attacker-facing surface
  • unsafe trajectory
  • claim
  • enabling condition
  • falsifier
  • transfer prediction
  • supporting evidence

Claims Made by the Document

  • AHA can discover reusable vulnerability knowledge about production LLM agents.
  • The discovered concepts reveal a common vulnerability core across models and agents.
  • A frozen VCG outperforms the strongest frozen discovery baseline.

Evidence Used

  • Results from the study on Claude Code and Codex across three scenarios.

Methods / Approach

  • Falsifiable discovery loop
  • Sandboxed harness
  • VCG

Limitations Stated by the Authors

The paper does not discuss potential limitations of the AHA method or Vulnerability Concept Graph.

Limitations Noted by the Agent

Agent interpretation — not from the source.

The agent may need to consider potential biases in the generated Vulnerability Concept Graph due to the limited scenarios and models tested.

Open Questions

  • What are the potential biases in the generated Vulnerability Concept Graph?
  • How generalizable is the AHA method across a wider range of production LLM agents?

Notes for Future Q&A

May include interpretation. Labeled where it does.

  • The text focuses on the findings and methods of the research, but does not discuss potential limitations or open questions.

Raw Abstract / Excerpt

Production LLM agents such as Claude Code and Codex operate over untrusted content, files, commands, and workspace state, making safety failures directly actionable. Red-teaming must therefore keep pace with evolving models and tools. Existing approaches mainly optimize attack success and preserve artifacts such as benchmarks, payloads, or attack programs, which record where attacks succeed but not the enabling conditions behind unsafe agent behavior. We study automated red-teaming for production LLM agents using one agentic research environment to discover reusable vulnerability knowledge about another. We present AHA, a falsifiable discovery loop that proposes a vulnerability hypothesis, constructs a falsifier, instantiates a valid attack, executes it in a sandboxed harness, reflects on the trajectory, and promotes confirmed findings into a Vulnerability Concept Graph (VCG). Each concept links an attacker-facing surface to an unsafe trajectory through a claim, enabling condition, falsifier, transfer prediction, and supporting evidence. Across Claude Code and Codex on three scenarios covering direct and indirect attacks, the discovered concepts reveal a reusable vulnerability core across models and agents. A frozen VCG requires no further search and outperforms the strongest frozen discovery baseline by 14.2 percentage points under the same single-shot protocol, while transferring across scenarios and attack channels. The resulting VCG provides an auditable artifact for production safety teams to inspect vulnerabilities, validate patches, and accumulate reusable safety knowledge. Our code is available at https://github.com/henrymao2004/Auto-research-red-teaming-in-sleep.