大規模LLM代理的安全測試：從風險發現到基於證據的驗證

摘要

LLM智能体通过外部工具日益自主地执行操作，导致复杂且不断演变的安全风险。然而，现有安全测试针对的是专家设计的违规行为，且对应结果由硬编码规则评估，这使得随着智能体的演进，扩展测试的代价高昂。为此，我们提出Vera，一个端到端的自动化安全测试框架，通过三阶段自强化流水线将软件工程测试原则实例化于非确定性智能体。首先，基于文献驱动的探索持续发现并结构化新兴风险，形成安全风险、攻击方法和工具执行环境的分类体系。其次，跨分类维度的组合式组合生成可执行安全用例，每个用例指定具体安全目标、程序化构建的初始状态以及基于可观测工件确定的验证谓词。第三，自适应执行在隔离沙箱中运行异构智能体，其中控制智能体基于运行时观测引导多轮交互，而基于证据的验证器通过环境状态和工具调用证据（而非模型自我报告）判断结果。我们在四个生产级智能体框架（OpenClaw、Hermes、Codex、Claude Code）上评估Vera，揭示了显著的安全弱点，多通道攻击下的平均攻击成功率达93.9%；我们还发布了Vera-Bench，包含1600个可执行安全用例，覆盖三种执行环境下的124个风险类别。这些结果表明，模块化、可执行的测试基础设施对于快速演进的智能体系统进行严格且可维护的大规模安全评估至关重要。代码已开源在 https://github.com/Yunhao-Feng/Vera。

English

LLM agents increasingly perform autonomous actions through external tools, leading to complex and evolving safety risks. However, existing safety testing targets expert-designed safety violations, and the corresponding outcomes are evaluated by hard-coded rules, making them costly to extend as agents evolve. To this end, we present Vera, an end-to-end automated safety testing framework that instantiates software engineering testing principles for non-deterministic agents through a three-stage, self-reinforcing pipeline. First, a literature-driven exploration continuously discovers and structures emerging risks into taxonomies of safety risks, attack methods, and tool execution environments. Second, combinatorial composition across taxonomy dimensions produces executable safety cases, each specifying a concrete safety goal, a programmatically constructed initial state, and a deterministic verification predicate grounded in observable artifacts. Third, adaptive execution runs heterogeneous agents in isolated sandboxes where a control agent steers multi-turn interaction based on runtime observations, while evidence-grounded verifiers judge outcomes from environment state and tool-call evidence rather than model self-report. We evaluate Vera on four production agent frameworks (OpenClaw, Hermes, Codex, Claude Code), revealing substantial safety weaknesses, with average attack success rates reaching 93.9\% under multi-channel attacks; we also release Vera-Bench, comprising 1600 executable safety cases spanning 124 risk categories across three execution settings. These results indicate that modular, executable testing infrastructure is essential for rigorous and maintainable safety evaluation of rapidly evolving agentic systems at scale. The code is publicly available at https://github.com/Yunhao-Feng/Vera.