Overly Helpful: Measuring Illegal Assistance in Multi-Turn, Multilingual LLM Agents

The researchers propose STING, an automated red-teaming framework; it wraps step-by-step illegal plans under a harmless persona and, through adaptive follow-up questioning and a judge agent used to determine stage completion, measures illegal task completion by tool-using LLM agents in multi-turn interactions. On AgentHarm scenarios, STING's illegal task completion rate is clearly higher than single-turn prompting and higher than chat-style multi-turn baselines adapted for tool-using agents. The team also models multi-turn red-teaming as a random variable of time to first jailbreak, and proposes discovery curves, a risk ratio attributing by attack language, and a new metric, Restricted Mean Jailbreak Discovery. Across six non-English settings, attack success rate and illegal task completion rate did not consistently rise for low-resource languages, which differs from common chatbot research findings.