Personal agents that chain tool calls across Gmail, Slack, Jira, and payment APIs create a new attack surface. A benign user request can produce harmful outcomes when actions accumulate and interact across service boundaries. X-AgentRed is a red-teaming framework that discovers these compositional failures by building a directed graph of tool dependencies, sampling attack paths, and using execution feedback to refine them.
The paper (arXiv 2610.13886v1) addresses the gap between single-tool security testing and the reality of multi-service orchestration. Existing red-teaming methods prompt LLMs to generate harmful scenarios or decompose known attack objectives into benign-looking steps. X-AgentRed instead constructs a graph where nodes are tools and edges represent how one tool’s effects satisfy another’s preconditions, then explores paths that produce harm.
The Compositional Risk Model
When an agent has access to tools across multiple services, three conditions create risk:
- Effect accumulation: Actions in one service create state that persists and influences later actions in other services.
- Precondition chaining: Tool B can execute only if tool A has already modified shared state (a calendar event, a file permission, a payment authorization).
- Benign intent: The user’s original request appears harmless, but the tool-call sequence produces outcomes the user did not anticipate or authorize.
Example: A user asks the agent to “reschedule my meeting and notify attendees.” The agent:
- Calls
calendar.update()to move the meeting - Calls
email.send()to notify attendees - Calls
slack.post()to update the team channel - Calls
jira.update()to adjust sprint planning
If the agent misinterprets “notify attendees” and sends a message to an external mailing list, or if it updates the wrong Jira ticket and triggers a production deployment, the compositional outcome is harmful even though each individual tool call looks reasonable in isolation.
How X-AgentRed Builds the Dependency Graph
The red-teaming agent analyzes each tool’s schema to extract:
- Effects: What state does this tool modify? (e.g.,
email.send()creates a sent message,calendar.update()changes an event time) - Preconditions: What must be true before this tool can execute? (e.g.,
payment.authorize()requires a valid payment method on file) - Potential harms: What outcomes could violate confidentiality, integrity, or availability? (e.g., data exfiltration, unauthorized access, resource exhaustion)
It then constructs a directed graph where:
- Each node is a tool
- An edge from tool A to tool B exists if A’s effects satisfy B’s preconditions
- Edges are weighted by the likelihood that the transition produces harm
Sampling a path from this graph yields a sequence of tool calls that, when executed in order, should produce a harmful outcome.
Self-Evolving Red-Teaming Loop
X-AgentRed does not stop at graph construction. It runs the sampled paths against real or simulated agent environments and uses execution feedback to improve:
Path Diversification
When a path successfully produces harm, the framework substitutes tools with similar effects to explore variations. If email.send() → slack.post() → payment.authorize() succeeds, it tries email.send() → teams.message() → payment.authorize() to see if the attack generalizes across communication platforms.
Precondition Refinement
When a path fails because a tool’s preconditions are not met, the framework analyzes the blocked step and inserts earlier tools to satisfy the missing preconditions. If payment.authorize() fails because no payment method exists, it adds payment.add_method() earlier in the chain.
This creates a feedback loop:
graph TD
A[Sample path from dependency graph] --> B[Execute path in agent environment]
B --> C{Harmful outcome?}
C -->|Yes| D[Diversify via tool substitution]
C -->|No| E[Refine preconditions at blocked step]
D --> F[Update graph weights]
E --> F
F --> AEvaluation Results
The paper tested X-AgentRed against four frontier agentic models and compared it to STAC (a baseline red-teaming method that prompts LLMs to generate harmful scenarios).
| Metric | X-AgentRed | STAC | Improvement |
|---|---|---|---|
| Harmful path rate | 1.77x | 1.0x | 77% more successful attacks |
| Tool coverage | 2.99x | 1.0x | 199% more tools explored |
| Unique attack patterns | High | Low | Discovers novel cross-service interactions |
The harmful path rate measures the fraction of sampled paths that produce outcomes violating security policies. Tool coverage measures the number of distinct tools involved in successful attacks. X-AgentRed’s graph-based exploration discovers attack paths that LLM-based generation misses because they involve unfamiliar tool combinations.
Architecture: Where to Draw Security Boundaries
Multi-service agent security requires boundaries at multiple layers:
Tool Interface Layer
Each tool should validate inputs and enforce authorization before executing. This prevents individual tools from being misused, but it does not prevent compositional failures where valid tool calls combine to produce harm.
Service Connector Layer
Connectors that bridge the agent to external services (Gmail API, Slack API, Jira API) should enforce rate limits, audit logging, and permission scoping. This limits the blast radius of a single compromised tool call.
Agent Orchestrator Layer
The orchestrator that plans and executes tool-call sequences should:
- Maintain a state machine that tracks effects across services
- Enforce invariants (e.g., “do not send email to external domains without explicit user confirmation”)
- Implement circuit breakers that halt execution when preconditions indicate risk
User Authorization Layer
Before executing any tool-call sequence, the agent should present a summary of intended effects and request user approval. This is the last line of defense against compositional failures.
Implementation Sketch
Here’s how you might implement a simplified dependency graph builder:
from typing import Dict, List, Set
from dataclasses import dataclass
@dataclass
class ToolSpec:
name: str
effects: Set[str] # e.g., {"email_sent", "calendar_updated"}
preconditions: Set[str] # e.g., {"calendar_event_exists"}
potential_harms: List[str] # e.g., ["data_exfiltration", "unauthorized_access"]
class DependencyGraph:
def __init__(self, tools: List[ToolSpec]):
self.tools = {t.name: t for t in tools}
self.edges = self._build_edges()
def _build_edges(self) -> Dict[str, List[str]]:
edges = {name: [] for name in self.tools}
for source_name, source in self.tools.items():
for target_name, target in self.tools.items():
if source_name == target_name:
continue
# Edge exists if source effects satisfy target preconditions
if source.effects & target.preconditions:
edges[source_name].append(target_name)
return edges
def sample_path(self, max_length: int = 5) -> List[str]:
import random
path = []
current = random.choice(list(self.tools.keys()))
path.append(current)
for _ in range(max_length - 1):
neighbors = self.edges[current]
if not neighbors:
break
current = random.choice(neighbors)
path.append(current)
return path
def refine_preconditions(self, blocked_tool: str, missing: Set[str]):
# Find tools that produce the missing effects
candidates = [
name for name, tool in self.tools.items()
if tool.effects & missing
]
return candidatesThis is a toy example. Production implementations need:
- Probabilistic edge weights based on harm likelihood
- Execution feedback integration to update weights
- State tracking to model precondition satisfaction across partial paths
- Tool substitution logic to diversify successful attacks
Likely Failure Modes
Graph Incompleteness
If the tool schema does not capture all effects and preconditions, the graph will miss edges and fail to discover valid attack paths. This requires careful schema design and ongoing maintenance as tools evolve.
Execution Environment Divergence
If the red-teaming environment does not match the production agent environment (different API versions, different permission models, different rate limits), successful attacks in testing may fail in production, and vice versa.
Precondition Explosion
As the number of tools grows, the number of possible preconditions grows combinatorially. Refining preconditions at every blocked step can lead to infinite loops where the framework keeps adding tools to satisfy new preconditions without ever reaching a harmful outcome.
False Positives
Not every path that produces an unexpected outcome is harmful. The framework needs a clear definition of harm (data exfiltration, unauthorized access, resource exhaustion) and a way to distinguish between surprising-but-benign outcomes and actual security violations.
Observability Requirements
Red-teaming multi-service agents requires instrumentation at every layer:
- Tool call logs: Record every tool invocation, including inputs, outputs, and timestamps.
- State snapshots: Capture the agent’s internal state before and after each tool call to track effect accumulation.
- Cross-service traces: Link tool calls across services using distributed tracing (OpenTelemetry, Jaeger) to visualize compositional paths.
- Harm detection signals: Emit events when tool calls violate security policies (e.g., “email sent to external domain without user approval”).
Without these, you cannot replay attacks, debug failures, or measure the effectiveness of mitigations.
Technical Verdict
Use X-AgentRed when:
- You are deploying agents that orchestrate tool calls across multiple services (email, calendar, messaging, payments, ticketing).
- You need to discover compositional security failures that single-tool testing misses.
- You have the infrastructure to run red-teaming loops in a sandboxed environment and feed execution feedback back into the graph.
Avoid X-AgentRed when:
- Your agent uses a single service or a small, fixed set of tools where you can manually enumerate all possible tool-call sequences.
- You do not have observability infrastructure to capture tool call logs, state snapshots, and cross-service traces.
- You cannot define clear harm criteria (data exfiltration, unauthorized access, resource exhaustion) that distinguish between unexpected-but-benign outcomes and actual security violations.
The framework is most valuable when the agent’s tool set is large, evolving, and spans multiple service boundaries. It is less useful when the attack surface is small enough to enumerate manually or when you lack the execution environment to validate discovered paths.