mlsanityData to 14 Oct 2026

AgenticRed: Evolving Agentic Systems for Red-Teaming

arXiv 2601.13518 ↗First posted 20 Jan 2026cs.AI cs.NEcited by 5

On the map: LLM agents and tool use → Agent threats, guardrails and governance

also in 1 more
Abstract (arXiv)

While recent automated red-teaming methods show promise for systematically exposing model vulnerabilities, most existing approaches rely on human-specified workflows. This dependence on manually designed workflows suffers from human biases and makes exploring the broader design space expensive. We introduce AgenticRed, an automated pipeline that leverages LLMs' in-context learning to iteratively design and refine red-teaming systems without human intervention. Rather than optimizing attacker policies within predefined structures, AgenticRed treats red-teaming as a system design problem, and it autonomously evolves automated red-teaming systems using evolutionary selection and generational knowledge. Red-teaming systems designed by AgenticRed consistently outperform state-of-the-art approaches, achieving 96% attack success rate (ASR) on Llama-2-7B, 98% on Llama-3-8B and 100% on Qwen3-8B on HarmBench. Our approach generates robust, query-agnostic red-teaming systems that transfer strongly to the latest proprietary models, achieving an impressive 100% ASR on GPT-5.1, DeepSeek-R1 and DeepSeek V3.2. This work highlights evolutionary algorithms as a powerful approach to AI safety that can keep pace with rapidly evolving models.

Key facts. Cited by 5 papers in the map (data through 14 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 47 of its 63 references that are in the map. First posted on arXiv 20 Jan 2026.

Builds on

47 of 63 references.

Closest ancestors · 3

Same direction, newest first

  1. 2025RL Is a Hammer and LLMs Are Nails: A Simple Reinforcement Learning Recipe for Strong Prompt Injection6 Oct
  2. 2025CoP: Agentic Red-teaming for Large Language Models using Composition of Principles1 Jun
  3. 2025X-Teaming: Multi-Turn Jailbreaks and Defenses with Adaptive Multi-Agents15 Apr

Other references · 44

  1. 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 13,028
  2. 2022Chain-of-Thought Prompting Elicits Reasoning in Large Language Modelscited by 12,459
  3. 2021Training Verifiers to Solve Math Word Problemscited by 10,109
  4. 2019Sentence-BERT: Sentence Embeddings using Siamese BERT-Networkscited by 9,170
  5. 2025Qwen3 Technical Reportcited by 8,820
  6. 2023Direct Preference Optimization: Your Language Model is Secretly a Reward Modelcited by 8,065
  7. 2025DeepSeek-R1: Incentivizing Reasoning Capability in LLMs via Reinforcement Learningcited by 6,330
  8. 2022Self-Consistency Improves Chain of Thought Reasoning in Language Modelscited by 5,708
  9. 2021Program Synthesis with Large Language Modelscited by 3,637
  10. 2023Self-Refine: Iterative Refinement with Self-Feedbackcited by 3,442
  11. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 3,104
  12. 2024Scaling LLM Test-Time Compute Optimally can be More Effective than Scaling Model Parameterscited by 1,986
32 more
  1. 2024Mixtral of Expertscited by 1,823
  2. 2023Improving Factuality and Reasoning in Language Models through Multiagent Debatecited by 1,784
  3. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,429
  4. 2022Red Teaming Language Models with Language Modelscited by 1,026
  5. 2025AlphaEvolve: A coding agent for scientific and algorithmic discoverycited by 867
  6. 2022Red Teaming Language Models to Reduce Harms: Methods, Scaling Behaviors, and Lessons Learnedcited by 729
  7. 2024AFlow: Automating Agentic Workflow Generationcited by 432
  8. 2024Automated Design of Agentic Systemscited by 407
  9. 2024A StrongREJECT for Empty Jailbreakscited by 385
  10. 2025Darwin Godel Machine: Open-Ended Evolution of Self-Improving Agentscited by 356
  11. 2024AutoDAN-Turbo: A Lifelong Agent for Strategy Self-Exploration to Jailbreak LLMscited by 199
  12. 2018The Malicious Use of Artificial Intelligence: Forecasting, Prevention, and Mitigationcited by 165
  13. 2023Take a Step Back: Evoking Reasoning via Abstraction in Large Language Modelscited by 159
  14. 2023ExpertPrompting: Instructing Large Language Models to be Distinguished Expertscited by 142
  15. 2025Artificial Hivemind: The Open-Ended Homogeneity of Language Models (and Beyond)cited by 141
  16. 2022Why Should Adversarial Perturbations be Imperceptible? Rethink the Research Paradigm in Adversarial NLPcited by 102
  17. 2021Improving Question Answering Model Robustness with Synthetic Adversarial Data Generationcited by 79
  18. 2025MedAgent-Pro: Towards Evidence-based Multi-modal Medical Diagnosis via Reasoning Agentic Workflowcited by 73
  19. 2025ScoreFlow: Mastering LLM Agent Workflows via Score-based Preference Optimizationcited by 56
  20. 2025AutoRedTeamer: Autonomous Red Teaming with Lifelong Attack Integrationcited by 43
  21. 2025Chasing Moving Targets with Online Self-Play Reinforcement Learning for Safer Language Modelscited by 39
  22. 2024Intelligent Go-Explore: Standing on the Shoulders of Giant Foundation Modelscited by 33
  23. 2025Adversarial Reasoning at Jailbreaking Timecited by 29
  24. 2025Jailbreak-R1: Exploring the Jailbreak Capabilities of LLMs via Reinforcement Learningcited by 27
  25. 2024Aviary: training language agents on challenging scientific taskscited by 26
  26. 2026OpenRT: An Open-Source Red Teaming Framework for Multimodal LLMscited by 21
  27. 2025SuperRL: Reinforcement Learning with Supervision to Boost Language Model Reasoningcited by 18
  28. 2025Quality-Diversity Red-Teaming: Automated Generation of High-Quality and Diverse Attackers for Large Language Modelscited by 9
  29. 2025Evolve the Method, Not the Prompts: Evolutionary Synthesis of Jailbreak Attacks on LLMscited by 8
  30. 2024Deciphering the Chaos: Enhancing Jailbreak Attacks via Adversarial Prompt Translationcited by 6
  31. 2024InvestESG: A multi-agent reinforcement learning benchmark for studying climate investment as a social dilemmacited by 3
  32. 2025NonTextual Target Attackcited by 3

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2026: 5.

5 papers.

  1. 2026Claudini: Autoresearch Discovers State-of-the-Art Adversarial Attack Algorithms for LLMscited by 17
  2. 2026Towards Secure Retrieval-Augmented Generation: A Comprehensive Review of Threats, Defenses and Benchmarkscited by 4
  3. 2026Proteus: A Self-Evolving Red Team for Agent Skill Ecosystemscited by 2
  4. 2026Agent Hacks Agent: Autoresearch for Production-Agent Red-Teamingcited by 2
  5. 2026Breadcrumbing Search Agentscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026JailbreakSkill: Scaling Automated Red-Teaming with Reusable and Ever-Evolving Skills
  2. 2026OpenART: Scaling Agent Red Teaming via Open-Ended Environment Evolution
  3. 2026RedEvoAgent: Automatic Red-Teaming Agent with Experience-Driven Skill Evolution
  4. 2025Mind the Gap: Comparing Model- vs Agentic-Level Red Teaming with Action-Graph Observability on GPT-OSS-20B
  5. 2025Be a Multitude to Itself: A Prompt Evolution Framework for Red Teaming
  6. 2026Red-Teaming the Agentic Red-Team
  7. 2026A Red Teaming Framework for Evaluating Robustness of AI-enabled Security Orchestration, Automation, and Response Systems
  8. 2026Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming