Search agents connect LLMs to the Internet, enabling them to access broader and more up-to-date information. However, this also introduces a new threat surface: unreliable search results can mislead agents into producing unsafe outputs. Real-world incidents and our two in-the-wild observations show that such failures can occur in practice. To study this threat systematically, we propose SafeSearch, an automated red-teaming framework that is scalable, cost-efficient, and lightweight, enabling harmless safety evaluation of search agents. Using this, we generate 300 test cases spanning five risk categories (e.g., misinformation and prompt injection) and evaluate three search agent scaffolds across 17 representative LLMs. Our results reveal substantial vulnerabilities in LLM-based search agents, with the highest ASR reaching 90.5% for GPT-4.1-mini in a search-workflow setting. Moreover, we find that common defenses, such as reminder prompting, offer limited protection. Overall, SafeSearch provides a practical way to measure and improve the safety of LLM-based search agents. Our codebase and test cases are publicly available: https://github.com/jianshuod/SafeSearch.

翻译：搜索代理将LLM与互联网连接，使其能够获取更广泛和更及时的信息。然而，这也引入了新的威胁面：不可靠的搜索结果可能误导代理产生不安全的输出。现实世界中的事件以及我们的两项实际观察表明，此类故障在实践中确实可能发生。为系统性地研究这一威胁，我们提出SafeSearch——一个可扩展、成本效益高且轻量级的自动红队测试框架，能够对搜索代理进行无害化的安全评估。利用该框架，我们生成了涵盖五个风险类别（例如错误信息和提示注入）的300个测试用例，并在17个代表性LLM上评估了三种搜索代理架构。我们的研究结果揭示了基于LLM的搜索代理存在显著漏洞，在搜索工作流场景中GPT-4.1-mini的最高攻击成功率（ASR）达到90.5%。此外，我们发现常见防御措施（如提醒提示）提供的保护有限。总体而言，SafeSearch为量化和改进基于LLM的搜索代理的安全性提供了实用方法。我们的代码库和测试用例已公开：https://github.com/jianshuod/SafeSearch。