X-AgentRed searches for harmful outcomes produced by sequences of otherwise plausible tool calls across services. The study evaluates a simulated ecosystem of 30 services and 914 tools, using a dependency graph to identify how one action creates the conditions for another. The method connects tool preconditions, effects and potential harms, then samples…
Inspect the ClaimsCase · DiggingBeagle record
X-AgentRed explores harmful chains across multiple agent services
X-AgentRed constructs tool-dependency graphs to explore unintended cross-service action chains and improves search using execution feedback.
Scope
Controlled cross-service agent red-teaming research submitted October 9, 2026; simulator-level evaluation.
Assessment profile
Assessment method- Setting
- simulation
- Exploitation
- demonstrated
- Remediation
- not applicable
- AI role
- AGAINST AI
Basis and provenance
The evaluated ecosystem has 30 simulated services and 914 tools. Each configuration is evaluated once, using model-generated service behavior and model judgments; these limits prevent deployment-level conclusions. Primary passages were inspected in this review, but the pinned contract supplies no grading rubric for A-D or the numeric impact bands; both remain ungraded. This is a source review, not an independent reproduction.
Assessed Oct 13, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-R4-XAGENTRED-1 · CLM-R4-XAGENTRED-2 · CLM-R4-XAGENTRED-3 · X-AgentRed: Red-Teaming Personal Agents in Evolving Multi-Service Ecosystems
At a glance
Security review of a personal agent needs to consider end-to-end tool composition and cumulative effects, not only isolated call validity.
Read the implicationsWhether generated chains survive independent implementation of third-party services is untested. Tool state and permission provenance across a series of service calls may differ in real deployments. Model-simulated service behavior, judging error and one-run variation constrain interpretation of the reported ratios. Broader tool coverage also accompanies…
Limits and uncertaintyFull account
X-AgentRed searches for harmful outcomes produced by sequences of otherwise plausible tool calls across services. The study evaluates a simulated ecosystem of 30 services and 914 tools, using a dependency graph to identify how one action creates the conditions for another.
The method connects tool preconditions, effects and potential harms, then samples paths that can be turned into agent tasks. Execution feedback helps repair blocked paths and diversify successful ones. This investigates the consequences of a whole workflow: checking whether each individual call looks reasonable can miss effects that accumulate through state shared across services.
Across four target agents, the authors report an average harmful-path rate 1.77 times STAC's and tool coverage 2.99 times STAC's. These relative results use a named baseline; they are not absolute attack-success rates or a count of live services compromised. Greater coverage also accompanied longer paths, so the comparison does not isolate structural diversity from path length.
The environment and judgments are model-mediated. Claude Opus 4.8 generates tool responses and state updates, while Claude Opus 5 and GPT-5.6 Sol judge outcomes. Each configuration is evaluated in one run. Simulated permissions, state transitions, judge errors and run variation can therefore affect the reported gains. The supported contribution is a method for expanding cross-service tests, with independent implementation of the resulting paths still needed before inferring failures in actual products.
Mechanism and trust boundary
- 01
Dependency graph
The method models how one tool's effects satisfy another tool's preconditions and samples cross-service paths.
Boundary: Individually plausible calls can compose into an unintended outcome.
- 02
Simulated execution feedback
A model-based tool simulator supplies responses and service-state updates used to refine and diversify scenarios.
Boundary: Simulator affordances are not proof that a real service exposes the same permissions or state transition.
- 03
Judged harmful path
Two model judges assess outcomes across four target models and named baseline methods.
Boundary: A relative discovery-rate gain is not a real-world attack success rate.
Timeline
- Oct 9, 2026disclosure
Public disclosure
Claims & evidence
CLM-R4-XAGENTRED-1X-AgentRed constructs tool-dependency graphs to explore unintended cross-service action chains and improves search using execution feedback.supported
Basis: reported finding
- supportsX-AgentRed: Red-Teaming Personal Agents in Evolving Multi-Service Ecosystemsprimary disclosure
Abstract: graph construction and iterative red-teaming method.
CLM-R4-XAGENTRED-2Across four target agents in a simulated ecosystem, the authors report 1.77 times STAC's harmful-path rate and 2.99 times its tool coverage on average. These ratios use STAC specifically, not an unspecified pooled baseline.supported
Basis: reported finding
- supportsX-AgentRed: Red-Teaming Personal Agents in Evolving Multi-Service Ecosystemsprimary disclosure
Introduction; Sections 4.1-4.3; Table 2.
CLM-R4-XAGENTRED-3The evaluation uses ToolSimulator with 30 services and 914 tools. Claude Opus 4.8 generates tool responses and state updates; Claude Opus 5 and GPT-5.6 Sol act as judges, and each configuration is evaluated in one run.supported
Basis: reported finding
- supportsX-AgentRed: Red-Teaming Personal Agents in Evolving Multi-Service Ecosystemsprimary disclosure
Section 4, introductory paragraph; Section 4.1, Environment and Models.
Implications
Security review of a personal agent needs to consider end-to-end tool composition and cumulative effects, not only isolated call validity.
Unknowns and contradictions
- Whether generated chains survive independent implementation of third-party services is untested.
- Tool state and permission provenance across a series of service calls may differ in real deployments.
- Model-simulated service behavior, judging error and one-run variation constrain interpretation of the reported ratios.
- Broader tool coverage also accompanies longer paths; the source does not isolate structural diversity from path length.
Sources and citation
Material revision history
- Oct 13, 2026 · Published version · first publication · revision 141