Red Teaming Agents: The New Attack Surface of Tools and State

Red teaming a single LLM means testing whether one prompt produces one bad output. Red teaming an agent means testing a different attack surface: tools it can call and state it carries across turns. The system plans, holds memory between steps, and sometimes coordinates with other agents. A prompt that looks harmless in isolation can chain into something dangerous three steps later, and the attack surface now includes tool misuse, privilege escalation through delegated actions, and memory or context poisoning mid-task. This talk covers what changes when red teaming moves from single-turn to agentic systems: why prompt-level jailbreak techniques stop being sufficient, how multi-turn adversarial probing works in practice, and where automated attacker agents (LLM-as-red-teamer, RL-driven attack policies) are starting to replace hand-written prompts. I'll walk through a concrete failure mode from recent research: standalone LLM agents that fail to sustain multi-stage attack campaigns on their own, and why hybrid planner-plus-controller approaches outperform them. Attendees leave with a practical threat model for their own agentic systems, a sense of which red-teaming techniques transfer from the LLM world and which need to be built new, and pointers to open tooling and open problems in this space. No prior red-teaming experience required.