Search agents powered by large language models (LLMs) use web search to answer questions. But attackers can inject false information or manipulate context to mislead the agent. Existing tests use fixed, human-made attack templates that don't mimic how real threats change over time.
Researchers created a system where attack strategies evolve automatically, without human templates. A method called Contrastive Rollout Evolutionary Optimization (CREO) drives a population of attacks to mutate and improve, while a controlled sandbox provides a stable testing environment. Fine-grained metrics measure how deeply an agent is hijacked or paralyzed.
The evolved attacks consistently outperformed static ones across multiple benchmarks and frontier LLMs. This shows that testing with static attacks underestimates real-world risk, and highlights the need for defenses that adapt to evolving threats.