X-AgentRed red-teams multi-service AI agents for compositional flaws

Researchers introduced X-AgentRed, a red-teaming framework that builds a dependency graph of tools across Gmail, Slack, Jira and payment APIs to find harmful tool-call chains. It achieves 1.77x more successful attacks and 2.99x wider tool coverage than the STAC baseline.

• X-AgentRed builds a directed graph linking one tool's effects to another's preconditions
• The framework yields 1.77x harmful path rate versus 1.0x for STAC
• Tool coverage grows 2.99x, exploring 199% more tools
• Risk arises from effect accumulation, precondition chaining and benign user intent