Summary
AI agents use language models that interact with software tools and data, but this can lead to security risks if harmful inputs manipulate the agent's behavior or exploit software flaws. The paper presents AgentXploit, a two-part system that finds how attacks could happen in the code and then tries to carry out those attacks in a safe testing environment before deployment. The authors also provide a benchmark with multiple real-world vulnerabilities in AI agent frameworks to evaluate such attack methods. Their system outperforms previous automated approaches in finding and verifying these security issues. This work helps make AI agents safer by detecting risks early in development.
What this means in practice
- •For software security teams: Test AI agent projects for security vulnerabilities automatically before deployment by combining code analysis with runtime attack attempts.
- •For ai platform providers: Improve AI agent safety by integrating automated tools that discover and exploit vulnerabilities in agent code and runtime environments.
Authors
Weida Liang, Shi Qiu, Zhun Wang, Simon Sure, Xiaoyuan Liu, Tianneng Shi, Zhaorun Chen, Wenbo Guo, Dawn Song
Abstract
AI agents combine language models with external data and tools that can modify files, call APIs, or execute code. Security failures can arise when adversarial content changes an agent's tool use or when the surrounding software contains vulnerabilities such as path traversal or command injection. We study authorized white-box pre-deployment auditing, where the auditor has access to the target repository and a controlled runtime, but successful attacks must still act through the task-defined attacker interface and be confirmed by an external verifier. We present AgentXploit, a two-role auditing system that separates repository-level attack-path discovery from runtime exploitation. The Analyzer Agent traces attacker-controlled inputs to sensitive operations and records code-supported candidate attack paths; the Exploiter Agent turns these paths into concrete attacks and revises them using runtime feedback. We also introduce AgentXploit-Bench, containing 72 reproducible vulnerabilities across 12 open-source AI-agent systems and frameworks. Across three runs, AgentXploit reaches 59.3% end-to-end success, compared with 38.4% for Codex. Under a token-budget-matched comparison, Codex reaches 46.3%. On AgentDojo, where injection points are provided, the Exploiter Agent reaches 79.2% attack success versus 52.7% for AgentVigil. These results highlight repository discovery and runtime exploitation as distinct challenges in end-to-end agent security auditing.