Sign InOpen Brain
arXivPaperNeeds Review

RedEvoAgent: Automatic Red-Teaming Agent with Experience-Driven Skill Evolution

RedEvoAgent turns prior jailbreak trajectories into a compact attack skill, then keeps only validated improvements. It offers a more interpretable way to probe tool-using agents for unsafe actions.

arXiv · Aug 27, 2026
Open Source Open MarkdownOpen JSON
Source Summary

RedEvoAgent is a **black-box red-teaming agent** that distills attack trajectories into a concise skill. Tool-effectiveness profiling and **Deciding-Tool Attribution** determine how that skill changes, while a validation ratchet rejects regressions.

Practical Implication

Builders should test agent harnesses for harmful tool calls and persistent state changes, not just unsafe text. Compact, inspectable attack skills may also be easier to audit and cheaper to reuse than full trajectory retrieval.

Agent-Ready Context
RedEvoAgent is a **black-box red-teaming agent** that distills attack trajectories into a concise skill. Tool-effectiveness profiling and **Deciding-Tool Attribution** determine how that skill changes, while a validation ratchet rejects regressions.

Builders should test agent harnesses for harmful tool calls and persistent state changes, not just unsafe text. Compact, inspectable attack skills may also be easier to audit and cheaper to reuse than full trajectory retrieval.

The abstract reports gains across multiple benchmarks, models, and execution harnesses but provides no figures here. Transfer claims and operational cost still need inspection in the full paper.
Connected Context · Feed7 Judgment

This operationalizes skill evaluation for security: attack experience is compressed into an inspectable reusable skill, updated according to tool effects, and protected by a validation ratchet. It broadens red-teaming from unsafe text to harmful calls and persistent state changes, but the supplied abstract does not quantify gains, transfer, or operating cost, so deployment claims remain provisional.

Don't Ship Skills Without Evals — Philipp Schmid, Google DeepMindThe validation ratchet directly implements the candidate’s requirement to regression-test skills across real harness behavior rather than trust manual inspection.The Regression Tax: Decomposing Why Skills Help and Hurt LLM AgentsThe candidate identifies that skills can erase prior capabilities; RedEvoAgent’s rejection of regressions is a concrete safeguard against that failure during skill evolution.Teaching AI to Find Real Vulnerabilities — David Brumley, BugcrowdTool-effect attribution complements deterministic exploit oracles by explaining which action produced an effect, while the oracle remains necessary to verify that the security outcome is real.Vending-Bench: Long-Horizon Agent Evals — Lukas Petersson, Andon LabsTesting persistent state changes responds to the candidate’s evidence that long-horizon behavior can drift or exploit incentives beyond what static prompt evaluations reveal.
Context Map
benchmarksecurity#agent-evals#agent-reliability#skills
Uncertainty
The abstract reports gains across multiple benchmarks, models, and execution harnesses but provides no figures here. Transfer claims and operational cost still need inspection in the full paper.