---
title: "Agent攻击Agent：面向生产级Agent的自动化红队研究"
source: "arXiv AI/CL/LG（论文）"
source_tier: "t2"
url: "https://arxiv.org/abs/2607.11698v1"
permalink: "https://feed.astralor.com/items/itm_1a2d973f6a2d311b4e04b0b1"
published: "2026-07-13T15:31:04.000Z"
score: 81
channel: "ai"
tags: ["AHA","Claude Code","Codex","LLM Agent Safety","Red-Teaming","Vulnerability Concept Graph"]
---

# Agent攻击Agent：面向生产级Agent的自动化红队研究

## AI 点评

> 这篇论文的价值在于将红队测试从“找漏洞就完事”升级为“系统性积累漏洞知识”。如果你在部署Claude Code或Codex之类的Agent，或者负责AI安全评估，AHA框架和VCG概念能帮你省下大量反复测试的精力。更重要的是，它让漏洞发现变得可追溯、可迁移——不再是一次性的漏洞报告，而是持续生长的安全知识库。

## 速览

生产级LLM Agent（如Claude Code、Codex）处理不可信内容、文件、命令和工作区状态，安全缺陷可能直接造成实际危害。现有的红队方法主要优化攻击成功率并保存基准、载荷或攻击程序等工件，但未记录不安全行为背后的使能条件。本文提出AHA（可证伪发现循环），通过一个Agentic研究环境自动发现另一个Agent的可复用漏洞知识。AHA提出漏洞假设、构造验证器、实例化有效攻击、在沙箱中执行、反思轨迹，并将确认结果提升为漏洞概念图（VCG）。每个概念将攻击面与不安全轨迹通过声明、使能条件、验证器、迁移预测和证据连接起来。在Claude Code和Codex的三个场景（直接和间接攻击）上，发现的概念揭示跨模型和Agent的可复用漏洞核心。冻结的VCG无需进一步搜索，在同一单次协议下比最强冻结发现基线高出14.2个百分点，且能跨场景和攻击通道迁移。VCG为生产安全团队提供了可审计的工件，用于检查漏洞、验证补丁和积累可复用安全知识。

## 关键点

- 提出AHA框架，实现生产级LLM Agent的自动化红队攻击，生成可复用的漏洞概念图（VCG）。
- VCG记录攻击面、使能条件、验证器和迁移预测，超越传统仅记录成功攻击的工件。
- 在Claude Code和Codex上验证，冻结VCG比最强冻结基线高14.2个百分点，且跨场景迁移。
- 为安全团队提供可审计的漏洞知识积累工具，支持补丁验证和安全知识复用。

## 全文

Production LLM agents such as Claude Code and Codex operate over untrusted content, files, commands, and workspace state, making safety failures directly actionable. Red-teaming must therefore keep pace with evolving models and tools. Existing approaches mainly optimize attack success and preserve artifacts such as benchmarks, payloads, or attack programs, which record where attacks succeed but not the enabling conditions behind unsafe agent behavior. We study automated red-teaming for production LLM agents using one agentic research environment to discover reusable vulnerability knowledge about another. We present AHA, a falsifiable discovery loop that proposes a vulnerability hypothesis, constructs a falsifier, instantiates a valid attack, executes it in a sandboxed harness, reflects on the trajectory, and promotes confirmed findings into a Vulnerability Concept Graph (VCG). Each concept links an attacker-facing surface to an unsafe trajectory through a claim, enabling condition, falsifier, transfer prediction, and supporting evidence. Across Claude Code and Codex on three scenarios covering direct and indirect attacks, the discovered concepts reveal a reusable vulnerability core across models and agents. A frozen VCG requires no further search and outperforms the strongest frozen discovery baseline by 14.2 percentage points under the same single-shot protocol, while transferring across scenarios and attack channels. The resulting VCG provides an auditable artifact for production safety teams to inspect vulnerabilities, validate patches, and accumulate reusable safety knowledge. Our code is available at https://github.com/henrymao2004/Auto-research-red-teaming-in-sleep.

---

引用前请核对原文;本文由星际流动整理:https://feed.astralor.com/items/itm_1a2d973f6a2d311b4e04b0b1