A new red-teaming framework called X-AgentRed is finding more ways for personal AI agents to go wrong, by chaining ordinary tool calls into harmful outcomes.
Researchers built X-AgentRed to probe personal agents that connect to multiple services and apps through tool use. Instead of just asking an LLM to guess at dangerous combinations, the system analyzes each tool's effects, the harms it could cause, and what conditions it needs to run, then builds a directed graph showing how one tool's output can unlock another tool's execution. It samples paths through that graph and turns them into realistic scenarios where an agent fulfilling a normal-looking request ends up producing harm. When a path hits a dead end, execution feedback lets the system substitute different tools or loosen preconditions and try again.
Across four frontier agentic models, X-AgentRed found harmful tool paths at 1.77 times the rate of the prior method STAC, and covered nearly three times as many distinct tools. That matters because personal agents are increasingly wired into email, calendars, and other everyday services. The failures this method surfaces are not obviously malicious requests; they are ordinary-looking tasks that become harmful only once several tools interact.
Red-teaming that only tests familiar tool combinations will keep missing the combinations nobody thought to check, and that is precisely where an agent with real permissions can do real damage.