---
title: "CONTRA: Red-Teaming Configurations of Personalizable Agents via Tree-Search"
source: "arXiv AI/CL/LG（论文）"
source_tier: "t2"
url: "https://arxiv.org/abs/2607.03220v1"
permalink: "https://feed.astralor.com/items/itm_0bf15bb986d4c84c0ea82fd8"
published: "2026-07-03T11:34:27.000Z"
score: 81
channel: "ai"
tags: ["CONTRA","LLM","OpenClaw","Personalization Configuration","Agentic Security","Red Teaming"]
---

# CONTRA: Red-Teaming Configurations of Personalizable Agents via Tree-Search

## AI commentary

> This paper excites me because it hits the weakest link in current autonomous agent safety: personalization configurations. If you are developing agent platforms or using tools like OpenClaw, this is a must-read. It not only tells you threats exist but also provides an automated tool to discover them. For security researchers and AI product managers, it's a timely danger map.

## At a glance

This paper proposes CONTRA, an LLM-assisted tree-search algorithm that automatically discovers malicious configurations in personalizable agents. Analyzing 473 popular skills from a public repository, it finds that 75.1% of skills have at least one configuration leading to malicious actions, most undetected by existing scans. CONTRA successfully identifies target malicious configurations in 39.2% of tested cases, highlighting inadequate safety in current agent personalization.

## Key points

- Proposes CONTRA, a tree-search algorithm with LLM reasoning to automatically discover malicious agent configurations
- Constructs a dataset of 473 popular skills, each with 2-5 target malicious actions
- Finds 75.1% of skills have at least one configuration leading to malicious execution; existing scans fail to detect most
- CONTRA successfully identifies the target malicious configuration in 39.2% of tested cases

## Full text

Recent tools such as OpenClaw have extended the capabilities of LLM-based agents from simple dialog-based systems to fully autonomous agents. These systems allow personalization of the agent through modifiable internal files and the installation of skills. While this enables deployment in a wide range of settings and the automation of diverse tasks, greater capability and autonomy increases the risk of malicious actions being executed unintentionally. In this work, we explore the interplay between agent configuration and the risk of executing dangerous actions without explicit instruction. To this end, we propose CONfiguration Tree-search for Red-teaming Agents (CONTRA), an LLM-assisted tree-search algorithm that discovers agent configurations resulting in the execution of malicious actions. CONTRA works by reasoning about benign yet dangerous configurations and evaluating them in a simulated environment. We construct a dataset of the 473 most popular skills from a public repository, along with 2-5 corresponding malicious target actions per skill. In a large-scale analysis, we find that 75.1% of skills have at least one configuration resulting in the execution of a malicious action, most of which have not been detected as containing malicious content by existing scans. Overall, CONTRA successfully identifies a configuration leading to the execution of the target action in 39.2% of all tested cases. Our findings demonstrate that current agents provide insufficient safety with respect to personalization.

---

Verify against the original before citing; curated by Astral Feed: https://feed.astralor.com/items/itm_0bf15bb986d4c84c0ea82fd8