Agentic Red-Team Tools Expose API Keys, Sandbox Escape, and Host Compromise Risks

A peer-reviewed security audit of 12 open-source agentic red-team systems found pervasive architectural flaws: 10 of 12 were vulnerable to sandbox escape and host compromise, 11 of 12 exposed LLM provider API keys, and all allowed unbounded weaponization bypassing guardrails. The paper describes a five-stage kill chain (worker RCE, privilege escalation, persistence, sandbox escape, host compromise), an "agent-phishing" manipulation technique that needs no prompt injection, and a 97.8% success rate in tests across six frontier LLMs; it recommends strict worker-orchestrator separation, no secrets in workers, OS-level guardrails, and egress proxying.