Personal agents increasingly invoke tools to interact with web services and applications. As the effects of these actions accumulate across services, benign user requests can unintentionally lead to harmful outcomes. Proactively detecting such compositional failures requires systematic exploration of diverse cross‑service paths. Existing red‑team approaches often prompt large language models to list potentially harmful paths from task or environment descriptions, or decompose harmful objectives into seemingly benign action sequences. These generations are biased toward patterns seen during training, favoring familiar tool combinations and leaving novel cross‑service interactions under‑explored. X‑AgentRed addresses this gap with a self‑evolving red‑team framework that discovers harmful tool‑call paths via a tool‑dependency graph and refines them using execution feedback. The system first analyses each tool’s effects, potential harms, and execution preconditions, building a directed graph where an edge indicates that the effect of one tool satisfies the precondition of another. Recipes are sampled from this graph and instantiated as realistic scenarios to test whether agents produce harmful outcomes. Execution feedback drives two improvements: diversifying harmful paths through tool substitution, and refining preconditions at blocked steps in failed executions to enable further progress. Across four frontier agentic models, X‑AgentRed achieves a harmful path rate $1.77\times$ that of STAC and increases average tool coverage to $2.99\times$, demonstrating broader tool exploration.
Review