---
title: "CONTRA：通过配置树搜索对可个性化智能体进行红队测试"
source: "arXiv AI/CL/LG（论文）"
source_tier: "t2"
url: "https://arxiv.org/abs/2607.03220v1"
permalink: "https://feed.astralor.com/items/itm_0bf15bb986d4c84c0ea82fd8"
published: "2026-07-03T11:34:27.000Z"
score: 81
channel: "ai"
tags: ["CONTRA","LLM","OpenClaw","个性化配置","智能体安全","红队测试"]
---

# CONTRA：通过配置树搜索对可个性化智能体进行红队测试

## AI 点评

> 这篇论文让我很兴奋，因为它直击了当前自主Agent安全最薄弱的环节：个性化配置。如果你在开发Agent平台或使用类似OpenClaw的工具，这绝对是必读的研究。它不仅告诉你威胁存在，还提供了一个自动化工具来发现这些漏洞。对于安全研究员和AI产品经理来说，这是一份及时的危险地图。

## 速览

论文提出CONTRA方法，利用LLM辅助的树搜索算法自动发现可个性化智能体的恶意配置。通过分析公共仓库中473个流行技能，发现75.1%的技能存在至少一种可导致恶意行为的配置，而现有扫描未能检出。CONTRA成功识别39.2%测试用例中的目标恶意配置，揭示当前智能体在个性化定制方面安全不足。

## 关键点

- 提出CONTRA算法，通过树搜索与LLM推理自动发现智能体配置中的恶意行为路径
- 构建包含473个流行技能的数据集，每个技能对应2-5个恶意目标动作
- 实验发现75.1%的技能存在可导致恶意执行的配置，现有检测方法漏报率高
- CONTRA在39.2%的测试用例中成功找到了触发目标恶意动作的配置

## 全文

Recent tools such as OpenClaw have extended the capabilities of LLM-based agents from simple dialog-based systems to fully autonomous agents. These systems allow personalization of the agent through modifiable internal files and the installation of skills. While this enables deployment in a wide range of settings and the automation of diverse tasks, greater capability and autonomy increases the risk of malicious actions being executed unintentionally. In this work, we explore the interplay between agent configuration and the risk of executing dangerous actions without explicit instruction. To this end, we propose CONfiguration Tree-search for Red-teaming Agents (CONTRA), an LLM-assisted tree-search algorithm that discovers agent configurations resulting in the execution of malicious actions. CONTRA works by reasoning about benign yet dangerous configurations and evaluating them in a simulated environment. We construct a dataset of the 473 most popular skills from a public repository, along with 2-5 corresponding malicious target actions per skill. In a large-scale analysis, we find that 75.1% of skills have at least one configuration resulting in the execution of a malicious action, most of which have not been detected as containing malicious content by existing scans. Overall, CONTRA successfully identifies a configuration leading to the execution of the target action in 39.2% of all tested cases. Our findings demonstrate that current agents provide insufficient safety with respect to personalization.

---

引用前请核对原文;本文由星际流动整理:https://feed.astralor.com/items/itm_0bf15bb986d4c84c0ea82fd8