AI agents can be talked into actually doing harmful things with the tools they control, not just saying harmful things.
Researchers built T-MAP, a trajectory-aware evolutionary search method that watches how an AI agent's tool calls unfold step by step, then uses that execution history to evolve prompts that push the agent toward a harmful outcome. Most existing red-teaming work only checks whether a chatbot can be coaxed into typing something toxic. T-MAP instead targets agents that act through tool-calling protocols like the Model Context Protocol (MCP), testing whether an attack can survive all the way from prompt to completed action. Across a range of MCP environments, T-MAP beat existing baselines on what the researchers call "attack realization rate" - how often the harmful task actually got carried out, not just slipped past a filter. It worked against several current frontier models, including GPT-5.2, Gemini-3-Pro, Qwen3.5, and GLM-5.
That distinction matters. A model that says something it shouldn't is embarrassing; a model that uses a tool it shouldn't - sending a message, deleting a file, moving money - is a different category of problem. As agents get plugged into more real infrastructure through young, fast-growing standards like MCP, the gap between "the model refused" and "the model's actions were safe" is exactly where the danger lives.
The team has posted its code on GitHub, so this reads less like a warning and more like a checklist for anyone shipping agents that actually touch tools.