henrymao2004/Auto-research-red-teaming

What it is

AHA (Agent Hacks Agent) is a red-team research harness that runs a "researcher" LLM agent overnight against Docker-sandboxed victim agents, promoting confirmed attacks into a persistent Vulnerability Concept Graph (VCG). Beyond the headline ASR numbers the summary gives, the repo documents a specific discovery methodology, a plugin architecture for adding your own targets, and operational-safety constraints. A paper is cited (arXiv:2607.11698, dated 2026-07-13) and there is an interactive "casebook" of 117 confirmed concepts across 17 settings.

How it works

The pipeline is two-stage, and the design choices are the point:

• Stage 1 — discovery. A /loop-driven researcher dispatches role-specialized sub-agents each iteration: a **Hypothesizer that commits a falsifier before seeing the attack, an Attack-Designer, a Reflector, and a periodic Critic. Only replicated, non-falsified** breaks are promoted into the VCG. Every iteration writes an inspectable attacks/<run>/v<N>/ folder.
• Stage 2 — held-out evaluation. Each discovery artifact is frozen and instantiated once per held-out instance, with no further search or feedback, so a break is attributed to the artifact alone rather than to ongoing search. This is why the 47.0% vs 32.8% comparison is framed as "reusable, not re-searched."

Extensibility: researcher agent, victim agent, and scenario are each registry-discovered plugins, and every scenario is a single contract.yaml — so you can point it at your own benchmark without rewriting the loop.

Preconditions / Affected

The evaluation matrix is two agent stacks (Claude Code, Codex) × three victims (Minimax-M2.7, Kimi-K2.6, Deepseek-V4-Pro) × three scenario families (AgentHazard, AgentDyn, DTap — direct and indirect channels). Findings cluster into 8 recurring mechanism families; a single claimed-authorization core lights up 16 of 18 settings, and task-goal hijack covers 9 of 12 indirect-channel settings.

What to do

This is a harness to run, not a patch to apply. Read the two files the repo points you to before use:

• AGENT.md — the LLM-consumption entry point (the README explicitly tells AI agents to read this instead).
• SECURITY.md — referenced by the caution below.

Caution (stated by the repo): AHA stores harmful prompts and attack payloads and drives real actions inside sandboxed victims. Run it only against systems you own or are authorized to test.

Caveats

• Confirmed concepts in the casebook are sanitized to the mechanism level, not published as working payloads.
• Transfer is strong but not free: cross-victim reuse reaches ≈88% of native ASR (up to 86.7%), and an indirect-only graph hits 41.8% on a direct-channel split — degraded relative to native discovery.
• Victim/model version strings (Minimax-M2.7, Kimi-K2.6, Deepseek-V4-Pro) and the arXiv id are as written on the page; treat them as the repo's own labels.