An automated red-teaming framework just showed how easily AI agents leak data and skip their own guardrails.
Researchers built a black-box testing system that only needs a basic description of an agent to start probing it for weaknesses. It sorts findings into a seven-domain taxonomy of risks, then uses an automated method called SAGE-RT to generate 120 adversarial test scenarios per domain, with human reviewers checking the LLM judges that score the results. The team ran the framework against two popular multi-agent frameworks, CrewAI and AutoGen, paired with four different base models. None of this required inside access to code, weights, or training data.
The results were rough. Agents showed governance risk 56.25 percent of the time on average, privacy risk hit 65 percent in multi-agent setups, and behavioral vulnerabilities showed up in as many as 85 percent of tests. That matters because agentic systems are already being connected to real tools, real permissions, and real user data, while most safety evaluations still test single chatbot replies instead of the multi-step actions an agent actually takes.
Chatbot jailbreaks made headlines for years before anyone built comparable tooling for agents that can actually act on their own. This framework is a step toward closing that gap, but it is still a research paper, not a certification. Surviving 120 scripted attacks per domain is not the same as surviving contact with real users.