Large language models (LLMs) have shown promise in assisting cybersecurity tasks, yet existing approaches struggle with automatic vulnerability discovery and exploitation due to limited interaction, weak execution grounding, and a lack of experience reuse. We propose Co-RedTeam, a security-aware multi-agent framework designed to mirror real-world red-teaming workflows by integrating security-domain knowledge, code-aware analysis, execution-grounded iterative reasoning, and long-term memory. Co-RedTeam decomposes vulnerability analysis into coordinated discovery and exploitation stages, enabling agents to plan, execute, validate, and refine actions based on real execution feedback while learning from prior trajectories. Extensive evaluations on challenging security benchmarks demonstrate that Co-RedTeam consistently outperforms strong baselines across diverse backbone models, achieving over 60% success rate in vulnerability exploitation and over 10% absolute improvement in vulnerability detection. Ablation and iteration studies further confirm the critical role of execution feedback, structured interaction, and memory for building robust and generalizable cybersecurity agents.

翻译：大语言模型在辅助网络安全任务方面展现出潜力，但现有方法因交互能力有限、执行基础薄弱以及经验复用不足，难以实现自动化的漏洞发现与利用。本文提出Co-RedTeam，这是一个具备安全感知的多智能体框架，通过整合安全领域知识、代码感知分析、基于执行的迭代推理和长期记忆机制，模拟真实世界红队攻防工作流程。Co-RedTeam将漏洞分析解构为协同的发现与利用两个阶段，使智能体能够基于实际执行反馈进行规划、执行、验证和优化操作，同时从历史轨迹中持续学习。在具有挑战性的安全基准测试上的大量实验表明，Co-RedTeam在不同骨干模型上均显著优于现有基线方法，在漏洞利用任务中达到超过60%的成功率，在漏洞检测任务中实现超过10%的绝对性能提升。消融实验与迭代研究进一步证实了执行反馈、结构化交互和记忆机制对于构建鲁棒且可泛化的网络安全智能体的关键作用。