How attackers persuade AI agents to break the rules

Today, most of us interact with AI assistants - reactive bots that wait for human instructions. Yet, AI assistants are rapidly being replaced by agentic AI agents, that can interact with external tools, browse the web, generate images, send emails, and perform increasingly complex workflows on behalf of users. As these agentic agents become more capable, they may be exploited by people with bad intentions. Safety tests have generally only checked whether an AI agent refuses a single harmful request - they don't measure what happens when an attacker gradually persuades the AI through a series of seemingly harmless conversations. Now, researchers from EPFL's Natural Language Processing Laboratory have developed STING (Sequential Testing of Illicit N-step Goal execution), an automated testing framework that simulates how a real attacker might manipulate large language model (LLM) agents into carrying out harmful tasks over multiple interactions.