mlsanityData to 7 Oct 2026

NAAMSE: Framework for Evolutionary Security Evaluation of Agents

arXiv 2602.07391 ↗First posted 7 Feb 2026cs.AI cs.MAcited by 1

On the map: LLM agents and tool use → Agent threats, guardrails and governance

also in 1 more
Abstract (arXiv)

AI agents are increasingly deployed in production, yet their security evaluations remain bottlenecked by manual red-teaming or static benchmarks that fail to model adaptive, multi-turn adversaries. We propose NAAMSE, an evolutionary framework that reframes agent security evaluation as a feedback-driven optimization problem. Our system employs a single autonomous agent that orchestrates a lifecycle of genetic prompt mutation, hierarchical corpus exploration, and asymmetric behavioral scoring. By using model responses as a fitness signal, the framework iteratively compounds effective attack strategies while simultaneously ensuring "benign-use correctness", preventing the degenerate security of blanket refusal. Our experiments across a diverse suite of state-of-the-art large language models demonstrate that evolutionary mutation systematically amplifies vulnerabilities missed by one-shot methods, with controlled ablations revealing that the synergy between exploration and targeted mutation uncovers high-severity failure modes. We show that this adaptive approach provides a more realistic and scalable assessment of agent robustness in the face of evolving threats. The code for NAAMSE is open source and available at https://github.com/HASHIRU-AI/NAAMSE.

Key facts. Cited by 1 paper in the map (data through 7 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 31 of its 48 references that are in the map. First posted on arXiv 7 Feb 2026.

Builds on

31 of 48 references.

Closest ancestors · 1

Same direction, newest first

  1. 2026Co-RedTeam: Orchestrated Security Discovery and Exploitation with LLM Agents2 Feb

Other references · 30

  1. 2025Gemini 2.5: Pushing the Frontier with Advanced Reasoning, Multimodality, Long Context, and Next Generation Agentic Capabilitiescited by 3,655
  2. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 2,914
  3. 2020MiniLM: Deep Self-Attention Distillation for Task-Agnostic Compression of Pre-Trained Transformerscited by 1,414
  4. 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,339
  5. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,330
  6. 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,326
  7. 2022Red Teaming Language Models with Language Modelscited by 983
  8. 2022Ignore Previous Prompt: Attack Techniques For Language Modelscited by 760
  9. 2023AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Modelscited by 738
  10. 2023Tree of Attacks: Jailbreaking Black-Box LLMs Automaticallycited by 619
  11. 2023GPTFUZZER: Red Teaming Large Language Models with Auto-Generated Jailbreak Promptscited by 520
  12. 2024JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Modelscited by 494
18 more
  1. 2024WildGuard: Open One-Stop Moderation Tools for Safety Risks, Jailbreaks, and Refusals of LLMscited by 460
  2. 2023"Do Anything Now": Characterizing and Evaluating In-The-Wild Jailbreak Prompts on Large Language Modelscited by 457
  3. 2025GEPA: Reflective Prompt Evolution Can Outperform Reinforcement Learningcited by 449
  4. 2019An Evaluation Dataset for Intent Classification and Out-of-Scope Predictioncited by 378
  5. 2023Benchmarking and Defending Against Indirect Prompt Injection Attacks on Large Language Modelscited by 237
  6. 2024JailBreakV: A Benchmark for Assessing the Robustness of MultiModal Large Language Models against Jailbreak Attackscited by 208
  7. 2024WildTeaming at Scale: From In-the-Wild Jailbreaks to (Adversarially) Safer Language Modelscited by 206
  8. 2024ArtPrompt: ASCII Art-based Jailbreak Attacks against Aligned LLMscited by 197
  9. 2017Rasa: Open Source Language Understanding and Dialogue Managementcited by 67
  10. 2018The Art, Science, and Engineering of Fuzzing: A Surveycited by 61
  11. 2024EasyJailbreak: A Unified Framework for Jailbreaking Large Language Modelscited by 57
  12. 2025AutoRedTeamer: Autonomous Red Teaming with Lifelong Attack Integrationcited by 38
  13. 2024AttackEval: How to Evaluate the Effectiveness of Jailbreak Attacking on Large Language Modelscited by 26
  14. 2025Adaptive Testing for LLM Evaluation: A Psychometric Alternative to Static Benchmarkscited by 25
  15. 2024SATA: A Paradigm for LLM Jailbreak via Simple Assistive Task Linkagecited by 10
  16. 2025GAAPO: Genetic Algorithmic Applied to Prompt Optimizationcited by 10
  17. 2025Auto-RT: Automatic Jailbreak Strategy Exploration for Red-Teaming Large Language Modelscited by 9
  18. 2026TrailBlazer: History-Guided Reinforcement Learning for Black-Box LLM Jailbreakingcited by 1

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2026: 1.

1 paper.

Similar, not cited

Close in wording, no citation either way

  1. 2026Proteus: A Self-Evolving Red Team for Agent Skill Ecosystems
  2. 2025DoomArena: A framework for Testing AI Agents Against Evolving Security Threats
  3. 2026Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents
  4. 2026EvoSkill Injection: Red-Teaming Autonomous Skill Generation and Evolution in Self-Evolving Agents
  5. 2026Architecting Secure AI Agents: Perspectives on System-Level Defenses Against Indirect Prompt Injection Attacks
  6. 2026AutoRISE: Agent-Driven Strategy Evolution for Red-Teaming Large Language Models
  7. 2026The Attack and Defense Landscape of Agentic AI: A Comprehensive Survey
  8. 2026CyberEvolver: Structured Self-Evolution for Cybersecurity Agents On the Fly