Search papers, labs, and topics across Lattice.
This paper introduces AHA, an automated red-teaming framework that leverages one LLM agent to discover vulnerabilities in another by creating a falsifiable discovery loop. By systematically proposing and testing vulnerability hypotheses, AHA constructs a Vulnerability Concept Graph (VCG) that captures reusable knowledge about unsafe agent behaviors across different models and attack scenarios. The approach not only outperforms existing baselines by 14.2 percentage points but also provides a structured, auditable artifact for safety teams to validate and address vulnerabilities effectively.
AHA reveals a reusable vulnerability core across production LLM agents, significantly enhancing the efficiency of red-teaming efforts.
Production LLM agents such as Claude Code and Codex operate over untrusted content, files, commands, and workspace state, making safety failures directly actionable. Red-teaming must therefore keep pace with evolving models and tools. Existing approaches mainly optimize attack success and preserve artifacts such as benchmarks, payloads, or attack programs, which record where attacks succeed but not the enabling conditions behind unsafe agent behavior. We study automated red-teaming for production LLM agents using one agentic research environment to discover reusable vulnerability knowledge about another. We present AHA, a falsifiable discovery loop that proposes a vulnerability hypothesis, constructs a falsifier, instantiates a valid attack, executes it in a sandboxed harness, reflects on the trajectory, and promotes confirmed findings into a Vulnerability Concept Graph (VCG). Each concept links an attacker-facing surface to an unsafe trajectory through a claim, enabling condition, falsifier, transfer prediction, and supporting evidence. Across Claude Code and Codex on three scenarios covering direct and indirect attacks, the discovered concepts reveal a reusable vulnerability core across models and agents. A frozen VCG requires no further search and outperforms the strongest frozen discovery baseline by 14.2 percentage points under the same single-shot protocol, while transferring across scenarios and attack channels. The resulting VCG provides an auditable artifact for production safety teams to inspect vulnerabilities, validate patches, and accumulate reusable safety knowledge. Our code is available at https://github.com/henrymao2004/Auto-research-red-teaming-in-sleep.
