Research map / Multi-agent systems and games / LLM agents

RedCodeAgent: Automatic Red-teaming Agent against Diverse Code Agents

ICLR 2026 · Multi-agent systems and games › LLM agents · approach: Software engineering agent benchmarks · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes RedCodeAgent, an LLM-agent red-teamer with a success-experience memory and a toolbox of jailbreak tools that attacks code agents and judges outcomes in Docker sandboxes.

Problem

Static safety benchmarks and single manually designed jailbreak tools fail to find many vulnerabilities in code agents, and LLM judges that only read static code can be biased; code agents must also produce executable risky code, not just avoid refusal.

Approach

An adaptive red-teaming agent (GPT-4o-mini based, LangChain) that retrieves top-K successful past attacks from a memory (scored by risk-scenario/description similarity minus trajectory-length penalty), dynamically chooses among a toolbox (GCG, AmpleGCG, Advprompter, AutoDAN, and an LLM-based code substitution tool), queries the target code agent, and judges success via sandbox execution scripts.

Key results

• On RedCode-Exec against OpenCodeInterpreter, RedCodeAgent reaches 72.47% ASR and 7.53% RR versus 55.46% ASR for no jailbreak and 29-46% for single jailbreak baselines.
• On RedCode-Gen against ReAct, RedCodeAgent achieves 81.52% ASR and 2.50% RR versus 65.62% ASR / 34.38% RR without jailbreak.
• On real-world Cursor, RedCodeAgent raises ASR from 62.60% to 72.72% and lowers RR from 7.03% to 4.07%; on MetaGPT ASR rises from 24.98% to 45.62%.

Surprising findings

• Existing jailbreak methods (GCG, AmpleGCG, Advprompter, AutoDAN) often do not improve ASR over static no-jailbreak prompts on code tasks, since they do not ensure functional execution.
• Simply retrying baseline jailbreak methods does not significantly improve ASR or RR while greatly increasing time cost.

Limitations

• Commercial assistants Cursor and Codeium were tested via semi-automatic scripts without an API, limiting scale.
• Results depend on GPT-4o-mini as base LLM and LLM-based judge for RedCode-Gen; ASR gains with GPT-4o are modest (74.07%).

Experimental setup

Datasets: RedCode-Exec RedCode-Gen RMCbench HumanEval

Benchmarks: RedCode-Exec RedCode-Gen RMCbench

Metrics: attack success rate rejection rate time cost trajectory length

Baselines: No Jailbreak GCG AmpleGCG Advprompter AutoDAN 5-method-combine

Builds on: GCG AmpleGCG Advprompter AutoDAN RedCode-Exec

Closest papers by meaning

• RedCode: Risky Code Execution and Generation Benchmark for Code Agents (NeurIPS 2024 · similarity 0.94)
• MOSAIC-Bench: Measuring Compositional Vulnerability Induction in Coding Agents (NeurIPS 2026 · similarity 0.88)
• AutoRedTeamer: Autonomous Red Teaming with Lifelong Attack Integration (NeurIPS 2025 · similarity 0.88)
• Co-RedTeam: Orchestrated Security Discovery and Exploitation with LLM Agents (ICML 2026 · similarity 0.88)
• CoP: Agentic Red-teaming for Large Language Models using Composition of Principles (NeurIPS 2025 · similarity 0.87)
• GitTaskBench: A Benchmark for Code Agents Solving Real-World Tasks Through Code Repository Leveraging (AAAI 2026 · similarity 0.87)