Technical Summary: Co-RedTeam

Problem Statement

Despite the promise of Large Language Models (LLMs) in cybersecurity, existing approaches for automated vulnerability discovery and exploitation face significant limitations. Current systems, often relying on single-agent setups or generic coding agents, struggle with multi-step reasoning, adaptive attack planning, and robust exploration of the vulnerability space. Key challenges include:

• Brittle Reasoning: Single-shot reasoning often fails to handle complex, multi-step security workflows.
• Lack of Execution Grounding: Many systems rely on static analysis or hypothetical reasoning without validating hypotheses through actual code execution, leading to high false-positive rates and failed exploit generation.
• Inability to Reuse Experience: Existing agents typically operate in isolation, failing to learn from prior attack trajectories or accumulate domain-specific knowledge over time.
• Scalability: Manual red-teaming is labor-intensive and difficult to scale, while automated attempts often lack the depth required for real-world codebases.

Methodology: Co-RedTeam

The authors propose Co-RedTeam, a security-aware multi-agent framework designed to mirror real-world red-teaming workflows. The system operates on a target codebase and an isolated execution environment (Docker container) through two coordinated stages, managed by a central Orchestrator.

1. System Architecture and Orchestration

The Orchestrator acts as a central controller, transforming high-level security objectives into a structured, execution-ready workflow. It initializes agents, assigns role-specific tools, and manages the control flow between discovery and exploitation. It validates inputs and dynamically routes tasks based on whether a vulnerability hypothesis is provided or needs to be discovered.

2. Stage I: Vulnerability Discovery

This stage focuses on identifying potential vulnerabilities when no explicit description is provided.

• Analysis Agent: Equipped with code-browsing tools (to inspect file hierarchies, entry points, and snippets) and access to structured security knowledge (CWE, OWASP). It generates evidence-grounded vulnerability hypotheses by tracing untrusted inputs to sensitive sinks.
• Critique Agent: Acts as an independent verifier, reviewing the Analysis Agent's proposals. It evaluates the evidence chain, risk rationale, and feasibility, assigning risk levels (Critical to Informational) and providing feedback for refinement or rejection.
• Process: An iterative loop continues until a stable set of high-confidence, evidence-backed vulnerability candidates is produced.

3. Stage II: Iterative Exploitation

This stage validates discovered vulnerabilities through execution in an isolated environment.

• Planner Agent: Maintains an explicit, multi-step Exploit Plan. It grounds the attack in program context and security knowledge, then iteratively refines the plan based on execution feedback. If a step fails, the Planner inserts corrective actions or revises future steps rather than blindly retrying.
• Validation Agent: A safety gate that checks proposed actions (commands/scripts) for syntactic correctness, safety, and alignment with the intended goal before execution.
• Execution Agent: Executes validated commands within a sandboxed Docker environment.
• Evaluation Agent: Interprets execution results (stdout, stderr, exit codes) to determine if the goal was met, identifying deviations or errors and providing concrete guidance for the Planner's next iteration.
• Process: The system operates in a closed-loop (Plan-Execute-Evaluate) until a vulnerability is successfully reproduced (Proof-of-Concept generated) or deemed infeasible.

4. Long-Term Memory

To enable continual improvement, Co-RedTeam employs a layered long-term memory system that stores experience across three levels:

• Vulnerability Pattern Memory: Stores confirmed vulnerability schemas and common false leads.
• Strategy Memory: Captures high-level exploitation strategies and workflows applicable across different targets.
• Technical Action Memory: Records concrete, low-level actions (commands, scripts) and their outcomes (success or failure with fixes).
  Memory is synthesized from research plans, execution traces, and evaluation feedback, and retrieved via embedding-based similarity search to inform future reasoning.

Key Contributions

1. Framework Design: Introduction of Co-RedTeam, a multi-agent framework that explicitly integrates security-domain knowledge, code-aware analysis, execution-grounded iterative reasoning, and long-term memory.
2. Execution-Grounded Validation: A shift from static reasoning to a closed-loop planning-execution-evaluation process that validates vulnerabilities through real code execution, significantly reducing false positives.
3. Experience Reuse: A novel layered memory architecture that allows the system to accumulate and reuse knowledge (patterns, strategies, and technical actions) across tasks, mimicking the learning curve of human experts.
4. Comprehensive Evaluation: Extensive testing on challenging benchmarks (CyBench, BountyBench, CyberGym) demonstrating superior performance over strong baselines.

Experimental Results

The authors evaluated Co-RedTeam on three benchmarks using various backbone LLMs (including Gemini-2.5-Pro, Gemini-3-Pro, and others).

• Performance Gains: Co-RedTeam consistently outperformed baselines (Vanilla LLMs, OpenHands, C-Agent, VulTrail, RepoAudit).
  • Exploitation Success: Achieved over 60% success rate in vulnerability exploitation (e.g., 63.7% on CyBench with Gemini-3-Pro).
  • Vulnerability Detection: Achieved over 20% detection accuracy (e.g., 65.0% on BountyBench exploit tasks, 20.0% detection accuracy), representing an absolute improvement of over 10% over the strongest baselines.
• Ablation Studies:
  • Execution Feedback: Removing execution feedback caused the most severe performance degradation (e.g., ASR dropped from 59.1% to 17.5% on CyBench), confirming its indispensability.
  • Memory: Disabling long-term memory resulted in substantial declines, particularly in long-horizon tasks, highlighting the value of experience reuse.
  • Components: Removing validation, code browsing, or security documentation consistently degraded performance, proving the necessity of each component.
• Efficiency: Despite its multi-turn architecture, Co-RedTeam demonstrated competitive latency, often outperforming complex agents like OpenHands and C-Agent in runtime.
• Generalization: The framework showed robust performance across diverse model families (including open-source models like gpt-oss-20b and qwen3-32b), indicating the architecture's effectiveness is not tied to a specific LLM.

Significance and Claims

The paper claims that Co-RedTeam addresses the core limitations of prior automatic red-teaming approaches by providing a principled, execution-grounded, and experience-driven framework. By tightly integrating specialized agents with a structured workflow and long-term memory, the system effectively mirrors human red-teaming behaviors. The authors assert that this approach enables robust and adaptive vulnerability validation that static or single-shot approaches cannot achieve, offering a scalable solution for continuous security assessment in rapidly evolving software systems. The results suggest that the combination of domain knowledge, iterative execution, and memory-driven learning is critical for building generalizable cybersecurity agents.