Helpful to a Fault: Measuring Illicit Assistance in Multi-Turn, Multilingual LLM Agents

LLM-based agents execute real-world workflows via tools. These affordances enable ill-intended adversaries to also use these agents to carry out complex misuse scenarios. Existing agent-misuse benchmarks largely test single-prompt instructions, leaving a gap in measuring how agents end up helping with harmful or illegal tasks over multiple turns. We introduce STING (Sequential Testing of Illicit N-step Goal execution), an automated red-teaming framework that constructs a step-by-step illicit plan grounded in a benign persona and iteratively probes a target agent with adaptive follow-ups, using judge agents to track phase completion. We further introduce an analysis framework that models multi-turn red-teaming as a time-to-first-jailbreak random variable, enabling analysis tools like discovery curves, hazard-ratio attribution by attack language, and a new metric: Restricted Mean Jailbreak Discovery. Across AgentHarm scenarios, STING yields substantially higher illicit-task completion than single-turn prompting and chat-oriented multi-turn baselines adapted to tool-using agents. In multilingual evaluations across six non-English settings, we find that attack success and illicit-task completion do not consistently increase in lower-resource languages, diverging from common chatbot findings. Overall, STING provides a practical way to evaluate and stress-test agent misuse in realistic deployment settings, where interactions are inherently multi-turn and often multilingual. Our code is available at https://github.com/epfl-nlp/helpful-to-a-fault.

Large language models can now do more than answer questions. Their ability to use tools and keep track of context allows them to act as agents and tackle multi-step tasks, such as planning a trip, finding flights and hotels, and even booking them. These abilities are useful, but they raise a pressing question: what happens when the same capabilities are used by someone trying to cause harm? We introduce STING, a framework that simulates such a user. STING takes a harmful goal, breaks it into smaller steps, tries those steps one by one, and adapts when the agent refuses or partly helps. This lets us test not only whether an agent’s safeguards fail, but how much nudging is needed before it helps with a harmful task. In experiments, this multi-step testing reveals more harmful assistance than standard one-prompt tests. STING also enables multilingual safety testing, facilitated by a publicly released language-independent testing environment. We also contribute an analysis framework that supports more standardized comparisons across future safety-testing methods. Overall, STING helps researchers and developers find weaknesses earlier and build safer AI agents before real attackers exploit them.