TrajRed framework secures AI agents, reducing attack success to near zero

AI agents are increasingly deployed in organizational workflows where they pull external information and invoke tools. That exposure creates a dangerous attack surface: malicious or untrusted data can silently steer agents toward unintended actions. Existing red-teaming methods rely on fixed attack templates or only examine final outcomes, leaving blind spots in multi-step reasoning and tool use. To close that gap, researchers Zhihao Zhu and Yi Yang introduce TrajRed, a trajectory-guided red-teaming framework that treats agent execution as a step-by-step path. By analyzing these trajectories, TrajRed identifies attack surfaces that template-based and automatic baselines miss, giving defenders a more realistic view of how exploits unfold in practice.

Building on those findings, the same team created TrajGuard, a runtime governance layer that monitors ongoing agent workflows and intervenes when they enter high-risk trajectory states discovered during red teaming. In experiments on AgentDojo, a benchmark of four organizational task suites, TrajRed systematically found stronger vulnerabilities than fixed-template and automatic red-team approaches. More importantly, TrajGuard reduced attack success rates across every tested attack method to near zero while preserving the utility of benign tasks. This dual approach—red teaming to uncover dangerous paths, then runtime governance to block them—provides a practical, unified framework for governing execution risk in agentic AI systems. The paper (arXiv:2608.04018) highlights that organizations deploying AI agents need to look beyond final outputs and secure the full decision-making journey.