VeriGrey: agent gray-box verification

The researchers propose a gray-box testing method, VeriGrey, which uses the tool sequences invoked by an agent as feedback-driven testing, and through mutated prompts designs injected tasks as necessary steps for completing the agent's function, in order to discover security risks in LLM agents. On the AgentDojo benchmark with a GPT-4.1 backend, VeriGrey finds 33% more indirect prompt injection vulnerabilities than black-box baselines. In real-world case studies, the method found prompts on the Gemini CLI coding agent and the OpenClaw personal assistant that black-box methods could not identify and that can induce multiple attack scenarios. On OpenClaw, VeriGrey builds a conversational agent that performs mutation fuzzing on demand, discovered malicious skill variants from 10 malicious skills, with a success rate of 10/10 on a Kimi-K2.5 backend and 9/10 on an Opus 4.6 backend. The authors state that such dynamic testing methods are expected to eventually develop into an agent assurance framework.