1 Meta Reality Labs Research2 Meta Superintelligence Labs3 Meta4 FAIR at Meta
*Work done at Meta
Personal agents can cause unintended harm across services
while fulfilling benign requests.
A self-evolving red-teaming framework
Share of candidate scenarios that produce a confirmed harmful outcome.
Share of available tools used at least once.
A graph connects tools. Recipes connect the graph to executable scenarios.
Schematic method example
A CROSS-SERVICE FAILURE
A billing task carries private records across four services to an unauthorized recipient.
“Resolve the disputed subscription and send a closure summary to the billing team.”
Stripe
WooCommerce
Jira
SlackThe agent starts with a legitimate billing task.
Simulated case from Appendix C.1 · steps grouped by service.
RESULTS
Both LLM judges must agree on harmful outcomes. Average: mean across the four agents.
SELF-EVOLVING SEARCH
Additional harmful scenarios found over the strongest baseline.
of harmful scenarios come from augmentation and refinement.
Average contribution across the four agents.
Shading shows the lead over the strongest baseline. Counts summed across four agents.
@misc{jung2026xagentred,
title={X-AgentRed: Red-Teaming Personal Agents
in Evolving Multi-Service Ecosystems},
author={Yeonsung Jung and Zhiyuan Wang and
Zifan Wang and Vítor Albiero and Benjamin Newman
and Edoardo Debenedetti and Ivan Evtimov
and Ninareh Mehrabi},
year={2026},
eprint={2610.13886},
archivePrefix={arXiv},
primaryClass={cs.AI},
url={https://arxiv.org/abs/2610.13886}
}