A new AI red teaming system stops replaying the same jailbreak scripts and starts learning from what worked.
Researchers describe CART, short for Closed-Loop Adaptive Red Teaming, in a new paper. Instead of firing a fixed list of prompts at a model, CART uses each test result to decide what to try next, chasing weaknesses as they surface while keeping its probes varied enough to avoid tunnel vision. The system splits the job into three roles: a Challenger that writes the tests, a Target that gets attacked (either a plain text model or an AI agent restricted to a limited toolset), and a Judge that scores the results. Tested across three benchmark families, CART surfaced more failures and higher average risk scores than static prompt replay on every model with a baseline to compare against, including agents that use tools.
That matters because most automated red teaming still amounts to running the same known attack list on a schedule, which tells you whether a model still falls for last year's tricks and little else. CART's gains on tool-using agents are the more interesting result: it suggests adaptive probing can expose weaknesses that scripted prompts never reach, which matters as more products ship as agents rather than plain chatbots. The researchers also found that swapping which model plays Challenger or Judge changes what gets found, an argument for keeping those roles independently audited rather than run by the same system.
This paper measures what CART's test policies can find, not how often these failures show up in real deployment. A red team that gets smarter is not the same as a model that gets safer.