Large Language Models (LLMs) are increasingly used in agentic systems, where their interactions with diverse tools and environments create complex, multi-stage safety challenges. However, existing benchmarks mostly rely on static, single-turn assessments that miss vulnerabilities from adaptive, long-chain attacks. To fill this gap, we introduce DREAM, a framework for systematic evaluation of LLM agents against dynamic, multi-stage attacks. At its core, DREAM uses a Cross-Environment Adversarial Knowledge Graph (CE-AKG) to maintain stateful, cross-domain understanding of vulnerabilities. This graph guides a Contextualized Guided Policy Search (C-GPS) algorithm that dynamically constructs attack chains from a knowledge base of 1,986 atomic actions across 349 distinct digital environments. Our evaluation of 12 leading LLM agents reveals a critical vulnerability: these attack chains succeed in over 70% of cases for most models, showing the power of stateful, cross-environment exploits. Through analysis of these failures, we identify two key weaknesses in current agents: contextual fragility, where safety behaviors fail to transfer across environments, and an inability to track long-term malicious intent. Our findings also show that traditional safety measures, such as initial defense prompts, are largely ineffective against attacks that build context over multiple interactions. To advance agent safety research, we release DREAM as a tool for evaluating vulnerabilities and developing more robust defenses.

翻译：大型语言模型（LLM）在智能体系统中日益广泛应用，其与多样化工具及环境的交互引发了复杂多阶段的安全挑战。然而，现有基准测试主要依赖静态单轮评估，无法捕捉自适应长链攻击所产生的漏洞。为填补这一空白，我们提出DREAM框架，用于系统评估LLM智能体抵御动态多阶段攻击的能力。该框架的核心是跨环境对抗知识图谱（CE-AKG），可实现对漏洞的跨域状态化感知。该图谱指导上下文引导策略搜索（C-GPS）算法，从涵盖349个不同数字环境的1,986个原子操作知识库中动态构建攻击链。对12个主流LLM智能体的评估揭示了关键脆弱性：在多数模型中，此类攻击链的成功率超过70%，彰显了状态化跨环境攻击的威力。通过分析攻击失败案例，我们识别出现有智能体的两大缺陷：上下文脆弱性（安全行为无法跨环境迁移）以及长期恶意意图追踪能力的缺失。研究还表明，传统安全措施（如初始防御提示）对通过多轮交互构建上下文的攻击基本无效。为推进智能体安全研究，我们开源DREAM工具，用于评估漏洞并开发更鲁棒的防御机制。