Co-RedTeam: Orchestrated Security Discovery and Exploitation with LLM Agents

Large language models (LLMs) have shown promise in assisting cybersecurity tasks, yet existing approaches struggle with automatic vulnerability discovery and exploitation due to limited interaction, weak execution grounding, and a lack of experience reuse. We propose Co-RedTeam, a security-aware multi-agent framework designed to mirror real-world red-teaming workflows by integrating security-domain knowledge, code-aware analysis, execution-grounded iterative reasoning, and long-term memory. Co-RedTeam decomposes vulnerability analysis into coordinated discovery and exploitation stages, enabling agents to plan, execute, validate, and refine actions based on real execution feedback while learning from prior trajectories. Extensive evaluations on challenging security benchmarks demonstrate that Co-RedTeam consistently outperforms strong baselines across diverse backbone models, achieving over 60\% success rate in vulnerability exploitation and over 10\% absolute improvement in vulnerability detection. Ablation and iteration studies further confirm the critical role of execution feedback, structured interaction, and memory for building robust and generalizable cybersecurity agents.

Modern AI systems are becoming increasingly capable of assisting cybersecurity tasks such as finding software vulnerabilities and testing system defenses. However, existing AI approaches often struggle with realistic security analysis because cybersecurity requires much more than generating text: agents must reason about code, interact with tools, execute actions, analyze feedback, and iteratively refine strategies. In this work, we introduce Co-RedTeam, a collaborative AI-agent framework designed to mimic how human security experts conduct red-teaming and vulnerability analysis. Instead of relying on a single AI model, our system combines multiple specialized agents that can analyze source code, execute exploits, validate outcomes, and learn from previous experiences. By incorporating real execution feedback and long-term memory, Co-RedTeam can progressively improve its attack strategies during security evaluation. Experiments on challenging cybersecurity benchmarks show that our framework substantially improves both vulnerability discovery and exploitation success compared to existing approaches. Our findings highlight the potential of collaborative AI agents for scalable and automated cybersecurity analysis, while also revealing the importance of execution feedback and memory for building reliable AI security systems.