While recent automated red-teaming methods show promise for systematically exposing model vulnerabilities, most existing approaches rely on human-specified workflows. This dependence on manually designed workflows suffers from human biases and makes exploring the broader design space expensive. We introduce AgenticRed, an automated pipeline that leverages LLMs' in-context learning to iteratively design and refine red-teaming systems without human intervention. Rather than optimizing attacker policies within predefined structures, AgenticRed treats red-teaming as a system design problem, and it autonomously evolves automated red-teaming systems using evolutionary selection and generational knowledge. Red-teaming systems designed by AgenticRed consistently outperform state-of-the-art approaches, achieving 96% attack success rate (ASR) on Llama-2-7B, 98% on Llama-3-8B and 100% on Qwen3-8B on HarmBench. Our approach generates robust, query-agnostic red-teaming systems that transfer strongly to the latest proprietary models, achieving an impressive 100% ASR on GPT-5.1, DeepSeek-R1 and DeepSeek V3.2. This work highlights evolutionary algorithms as a powerful approach to AI safety that can keep pace with rapidly evolving models.

翻译：尽管近期自动化红队测试方法在系统性暴露模型漏洞方面展现出潜力，但现有方法大多依赖人工设定的工作流程。这种对人工设计流程的依赖不仅受人类偏见影响，更导致设计空间探索成本高昂。我们提出AgenticRed——一种无需人工干预、利用大语言模型的上下文学习能力迭代设计与优化红队测试系统的自动化管道。与在预设结构内优化攻击策略不同，AgenticRed将红队测试视为系统设计问题，通过进化选择与代际知识自主进化自动化红队系统。经AgenticRed设计的红队测试系统始终优于现有最优方法：在HarmBench基准测试中，其对Llama-2-7B、Llama-3-8B和Qwen3-8B的攻击成功率分别达96%、98%和100%。该方法生成的鲁棒性查询无关红队系统具备强迁移性，在最新专有模型上表现卓越——对GPT-5.1、DeepSeek-R1及DeepSeek V3.2的攻击成功率均达100%。本研究凸显进化算法作为能同步快速迭代模型的强大AI安全方案的有效性。