Researchers have built a framework that attacks AI agents not through their inputs, but through the environments they operate in.
A team from Zhejiang University published DeepTrap, an automated tool for finding security vulnerabilities in agentic AI systems by manipulating execution contexts - the files, stored memories, tools, and auxiliary artifacts an agent depends on - rather than crafting adversarial prompts. The framework treats attack generation as a black-box optimization problem that simultaneously maximizes harm potential, evades detection, and preserves the outward appearance of normal task completion. Testing across nine models with a 42-case benchmark spanning six vulnerability classes and seven operational scenarios showed that compromised contexts can reliably induce unsafe behavior even when the agent's final response looks clean to the user.
The findings punch a hole in how most AI safety evaluations work today: check what a model says, not what it does across a full execution chain. As more companies ship autonomous agents with persistent memory and broad tool access, the gap between output-level filtering and actual runtime behavior stops being theoretical and starts being an attack surface.
Put plainly: an agent that clears every standard safety benchmark can still be running a compromised playbook in the background. Anyone shipping agentic systems and relying solely on response-level evaluation should find that unsettling.