{
  "schema_version": 1,
  "builder_plan": {
    "scenario": "An agent reads external documents or tool responses that may contain malicious instructions.",
    "change": "Replay attacks and legitimate lookalikes in an isolated copy of your agent workflow.",
    "baseline": "Your existing checks with the same tasks, permissions, and tool responses.",
    "steps": [
      "Locate the paper's implementation and check its license, model support, data needs, and hardware requirements. Stop here if you cannot obtain the required artifacts.",
      "Save a small set of representative product tasks and expected outcomes. Keep evaluation tasks out of any training or tuning, and choose quality and cost limits before running.",
      "Run the baseline and the proposed change on identical inputs. Keep other settings fixed and repeat paired runs to expose variation.",
      "Save per-task outputs, failures, timings, and all usage costs. Review regressions before expanding the test."
    ],
    "measure": "Successful attacks missed, legitimate actions blocked, detection delay, and review cost.",
    "decision": "Keep the change only if it meets your preselected quality and latency limits and improves the metric you care about after setup and operating costs. Otherwise retain the baseline. This is an exploration plan, not a validated recommendation."
  },
  "builder_review": null,
  "arxiv_id": "2610.13886",
  "title": "X-AgentRed: Red-Teaming Personal Agents in Evolving Multi-Service Ecosystems",
  "summary": "X-AgentRed replaces LLM-prompted or decomposition-based red-teaming, where harmful-path generation is biased toward familiar tool combinations, with a tool-dependency graph built from tool effects, preconditions, and harms, whose sampled paths are instantiated as scenarios and iteratively refined using execution feedback. The cost is a non-trivial implementation pipeline (tool-effect analysis, graph construction, scenario instantiation, and an execution-feedback loop) plus recurring LLM call costs for analysis and scenario generation, all feasible on API access without dedicated GPU hardware. It can fail where tool documentation is incomplete or inaccurate, since the dependency graph derives from inferred preconditions and effects, and discovered harms may not transfer across model versions, tool APIs, or permission configurations as services evolve.",
  "rationale": "For a team deploying tool-using agents on constrained infrastructure, graph-guided adversarial path discovery is a practical security-evaluation method runnable via APIs, but its coverage claims require validation against the team's own tool ecosystem before adoption.",
  "technique": "Graph-guided self-evolving agent red-teaming",
  "family": "seguranca_e_guardrails",
  "recommendation": "testar",
  "published": "2026-10-09",
  "as_of": "2026-10-18",
  "editorial_status": "indexed",
  "source_url": "https://arxiv.org/abs/2610.13886",
  "independent_implementations": 1,
  "total_implementations": 2,
  "stars": 132,
  "citations": null,
  "claims": [
    {
      "claim_id": "claim-01",
      "statement": "X-AgentRed replaces LLM-prompted or decomposition-based red-teaming, where harmful-path generation is biased toward familiar tool combinations, with a tool-dependency graph built from tool effects, preconditions, and harms, whose sampled paths are instantiated as scenarios and iteratively refined using execution feedback. The cost is a non-trivial implementation pipeline (tool-effect analysis, graph construction, scenario instantiation, and an execution-feedback loop) plus recurring LLM call costs for analysis and scenario generation, all feasible on API access without dedicated GPU hardware. It can fail where tool documentation is incomplete or inaccurate, since the dependency graph derives from inferred preconditions and effects, and discovered harms may not transfer across model versions, tool APIs, or permission configurations as services evolve.",
      "basis": "inferred",
      "result": "",
      "baseline": "",
      "conditions": "",
      "source_url": "https://arxiv.org/abs/2610.13886",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "claim_id": "claim-02",
      "statement": "X-AgentRed achieves 1.77x the harmful path discovery rate of STAC and 2.99x average tool coverage across four frontier agentic models.",
      "basis": "inferred",
      "result": "",
      "baseline": "",
      "conditions": "",
      "source_url": "https://arxiv.org/abs/2610.13886",
      "source_page": null,
      "source_excerpt": ""
    }
  ],
  "exposure_map": [
    {
      "dimension": "quality",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "compute",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "latency",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "operations",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "compatibility",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "security",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "data_and_training",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "reproducibility",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    }
  ],
  "risks": [],
  "minimum_test": [],
  "open_questions": [],
  "independent_tests": [],
  "lab_reproductions": [],
  "report_available": false,
  "validation_tier": "unknown",
  "evidence_tier": "unknown",
  "infrastructure_basis": "unknown",
  "equations": [],
  "equations_status": "not_fetched",
  "core_kind": "",
  "equations_fetched_at": "",
  "equations_source_url": "",
  "equations_source_sha256": "",
  "exposures_reviewed_at": "",
  "exposures_source_sha256": ""
}