[Submitted on 21 May 2026 (v1), last revised 24 Jul 2026 (this version, v2)]

Authors:Jianan Ma, Xiaohu Du, Ruixiao Lin, Yaoxiang Bian, Jialuo Chen, Yunhao Feng, Xiaofang Yang, Shiwen Cui, Changhua Meng, Xinhao Deng, Jingyi Wang, Zhen Wang

View PDF HTML (experimental)

Abstract:As autonomous agents (e.g., OpenClaw) increasingly operate with deep system-level privileges to execute complex tasks, they introduce severe, unmitigated security risks. Existing LLM safety testing methods are largely built around prompt-level inputs and response-level judgments, while recent agent benchmarks remain limited in automation, trajectory coverage, and action-grounded judgment. In this work, we present ASEval, a novel automated security testing framework for autonomous agents. ASEval generates realistic benign multi-turn conversations, perturbs them into risk test cases through carefully designed perturbation operators, executes each case against the target agent, and applies an action-grounded oracle to judge the complete trace. We instantiate ASEval to construct A3S-Bench, a test suite of 2,254 executable multi-turn test cases spanning diverse usage scenarios, delivery patterns, and agent-level security risks. Extensive evaluation on 11 LLM-backed OpenClaw agents confirms that ASEval effectively exposes pervasive security failures. In particular, our proposed perturbation operators raise the average risk-trigger rate from 22.9% under existing injection techniques to 47.4%, as judged by an action-grounded oracle that matches human annotation at 93.2% binary F1. Our further analysis and case studies illustrate that such failures emerge from multi-turn delivery, persistent state, and tool-mediated actions that response-level evaluation overlooks.

Submission history

From: Jianan Ma [view email]
[v1] Thu, 21 May 2026 11:07:51 UTC (989 KB)
[v2] Fri, 24 Jul 2026 06:09:29 UTC (975 KB)