Two-stage auditing finds more exploitable flaws in AI agent repositories

AgentXploit separates source-code attack-path discovery from runtime exploitation, outperforming comparison systems on two security benchmarks.

Top University

Weida Liang · Shi Qiu · Zhun Wang · Simon Sure · Xiaoyuan Liu · Tianneng Shi · +3 more

National University of Singapore · University of North Carolina at Chapel Hill · University of California, Berkeley · University of Chicago · University of California, Santa Barbara

Research Digest·28 September 2026·2 min read

Thread:Agent Security & Attacks

In one line

AgentXploit automates repository-to-runtime red-teaming for AI agents, achieving 59.3% end-to-end attack success.

Before you read this

Three ideas this paper builds on

agent safetyRisks from AI agents including timing errors, shutdown avoidance, collusion, overclaiming, and unsafe execution, mitigated by constrained decoding, safety harnesses, and swarm governance.183 papers →audit workflowA systematic process for verifying data integrity, model behavior, and evaluation validity through checks for errors, confounds, and hidden artifacts.108 papers →prompt injectionA security attack where malicious instructions are embedded into inputs to override an LLM's intended behavior.84 papers →

Read it as

AgentXploit is a two-role auditing system for AI agents, separating attack-path discovery (Analyzer) from runtime exploitation (Exploiter). The Analyzer searches the code repository to trace attacker-controlled inputs to sensitive operations, recording candidate attack paths. The Exploiter then attempts to turn those paths into concrete attacks against a running target, revising based on feedback.

The authors introduce AgentXploit-Bench with 72 vulnerabilities across 12 open-source agent systems. In evaluations, AgentXploit achieved 59.3% end-to-end success, outperforming Codex at 38.4% (46.3% under matched token budget). On the AgentDojo benchmark, the Exploiter agent reached 79.2% attack success versus 52.7% for AgentVigil.

These results demonstrate that discovering vulnerabilities in agent code and exploiting them in runtime are distinct challenges, and that automated auditing can be improved by treating them separately.

How it works

before and after

RSS

The Daily Edition

The front page in your inbox each weekday morning: the lead, the picks, and why each one earned its place.

What it released

Code

Concepts

agent safety audit workflow prompt injection role decoupling repository-level benchmark multi-agent architecture