LLMエージェントの大規模安全性テスト：リスク発見からエビデンスに基づく検証へ

要旨

LLM代理（LLM agents）日益通过外部工具自主执行操作，这带来了复杂且不断演变的安全风险。然而，现有安全测试主要针对专家设计的安全违规行为，且相应结果通过硬编码规则进行评估，随着代理的演化，这些规则的扩展成本高昂。为此，我们提出Vera——一种端到端的自动化安全测试框架，通过三阶段自增强流水线，将软件工程测试原则实例化应用于非确定性代理。首先，文献驱动的探索持续发现并结构化新兴风险，将其整理为安全风险、攻击方法和工具执行环境的分类体系。其次，跨分类维度的组合编排生成可执行的安全用例，每个用例指定明确的安全目标、程序化构建的初始状态，以及基于可观测物件的确定性验证谓词。第三，自适应执行在隔离沙箱中运行异构代理，由控制代理基于运行时观测引导多轮交互，同时基于证据的验证器依据环境状态和工具调用证据（而非模型自我报告）判断结果。我们在四个生产级代理框架（OpenClaw、Hermes、Codex、Claude Code）上评估Vera，揭示了显著的安全缺陷，多在渠道攻击下平均攻击成功率高达93.9%；我们还发布了Vera-Bench，包含1600个可执行安全用例，覆盖三种执行环境下的124个风险类别。这些结果表明，模块化、可执行的测试基础设施对于大规模、严谨且可维护的快速演进代理系统安全评估至关重要。代码已公开于 https://github.com/Yunhao-Feng/Vera。

English

LLM agents increasingly perform autonomous actions through external tools, leading to complex and evolving safety risks. However, existing safety testing targets expert-designed safety violations, and the corresponding outcomes are evaluated by hard-coded rules, making them costly to extend as agents evolve. To this end, we present Vera, an end-to-end automated safety testing framework that instantiates software engineering testing principles for non-deterministic agents through a three-stage, self-reinforcing pipeline. First, a literature-driven exploration continuously discovers and structures emerging risks into taxonomies of safety risks, attack methods, and tool execution environments. Second, combinatorial composition across taxonomy dimensions produces executable safety cases, each specifying a concrete safety goal, a programmatically constructed initial state, and a deterministic verification predicate grounded in observable artifacts. Third, adaptive execution runs heterogeneous agents in isolated sandboxes where a control agent steers multi-turn interaction based on runtime observations, while evidence-grounded verifiers judge outcomes from environment state and tool-call evidence rather than model self-report. We evaluate Vera on four production agent frameworks (OpenClaw, Hermes, Codex, Claude Code), revealing substantial safety weaknesses, with average attack success rates reaching 93.9\% under multi-channel attacks; we also release Vera-Bench, comprising 1600 executable safety cases spanning 124 risk categories across three execution settings. These results indicate that modular, executable testing infrastructure is essential for rigorous and maintainable safety evaluation of rapidly evolving agentic systems at scale. The code is publicly available at https://github.com/Yunhao-Feng/Vera.