What's this about?
An automatic red-teaming agent that evolves its own skills from experience. The threat model it targets is the important part: LLM agents are now deployed inside product-level execution harnesses, where a jailbreak does not produce a bad sentence — it triggers real tool use and persistent state changes. That is a categorically greater risk than unsafe text generation.
What is red teaming?
Deliberately attacking your own system to find what breaks before someone hostile does. Traditionally it is expert humans, which makes it expensive, slow and bounded by who you can hire. Automating it means the attacker can run continuously; making it *evolve* means the attacks it discovers this week become the starting point for next week, so coverage compounds instead of resetting each engagement.
Why does this matter to you?
- "Jailbreak causes real tool use and persistent state changes" is the correct threat framing for agentic systems and worth adopting verbatim.
- Experience-driven skill evolution here is the same mechanism as WikiSkill and Warp's self-improving reviewer — applied to offense.
- Continuous automated red teaming is what the cyberdefense letter's "test defenses continuously against frontier capabilities" would actually require in practice.