LLM agents like Claude Code can not only write code but also be used for autonomous AI research and engineering \citep{rank2026posttrainbench, novikov2025alphaevolve}. We show that an \emph{autoresearch}-style pipeline \citep{karpathy2026autoresearch} powered by Claude Code discovers novel white-box adversarial attack \textit{algorithms} that \textbf{significantly outperform all existing (30+) methods} in jailbreaking and prompt injection evaluations. Starting from existing attack implementations, such as GCG~\citep{zou2023universal}, the agent iterates to produce new algorithms achieving up to 40\% attack success rate on CBRN queries against GPT-OSS-Safeguard-20B, compared to $\leq$10\% for existing algorithms (\Cref{fig:teaser}, left). The discovered algorithms generalize: attacks optimized on surrogate models transfer directly to held-out models, achieving \textbf{100\% ASR against Meta-SecAlign-70B} \citep{chen2025secalign} versus 56\% for the best baseline (\Cref{fig:teaser}, middle). Extending the findings of~\cite{carlini2025autoadvexbench}, our results are an early demonstration that incremental safety and security research can be automated using LLM agents. White-box adversarial red-teaming is particularly well-suited for this: existing methods provide strong starting points, and the optimization objective yields dense, quantitative feedback. We release all discovered attacks alongside baseline implementations and evaluation code at https://github.com/romovpa/claudini.

翻译：像Claude Code这样的大语言模型代理不仅能编写代码，还可用于自主化人工智能研究与工程 \citep{rank2026posttrainbench, novikov2025alphaevolve}。我们证明了由Claude Code驱动的\textit{自主研究}风格流水线 \citep{karpathy2026autoresearch} 能够发现新型白盒对抗攻击\textit{算法}，其在越狱和提示注入评估中\textbf{显著优于所有现有（30余种）方法}。该代理从GCG~\citep{zou2023universal}等现有攻击实现出发，通过迭代生成新算法，在针对GPT-OSS-Safeguard-20B的CBRN查询中实现了高达40%的攻击成功率，而现有算法在此场景下成功率\leq10\%（\Cref{fig:teaser}，左图）。所发现的算法具有良好的泛化能力：在替代模型上优化的攻击可直接迁移至保留模型，对\textbf{Meta-SecAlign-70B} \citep{chen2025secalign}达到\textbf{100%攻击成功率}，而最佳基线仅为56%（\Cref{fig:teaser}，中图）。通过扩展~\cite{carlini2025autoadvexbench}的研究发现，我们的结果初步证明：增量式的安全与安保研究可通过大语言模型代理实现自动化。白盒对抗性红队测试尤其适合该范式——现有方法提供了强有力的起点，而优化目标则能生成密集的量化反馈。我们已在https://github.com/romovpa/claudini开源所有发现的攻击算法及其基线实现与评估代码。