ASEval: Automated Trajectory-Level Security Testing for Autonomous Agents

As autonomous agents (e.g., OpenClaw) increasingly operate with deep system-level privileges to execute complex tasks, they introduce severe, unmitigated security risks. Existing LLM safety testing methods are largely built around prompt-level inputs and response-level judgments, while recent agent benchmarks remain limited in automation, trajectory coverage, and action-grounded judgment. In this work, we present ASEval, a novel automated security testing framework for autonomous agents. ASEval generates realistic benign multi-turn conversations, perturbs them into risk test cases through carefully designed perturbation operators, executes each case against the target agent, and applies an action-grounded oracle to judge the complete trace. We instantiate ASEval to construct A3S-Bench, a test suite of 2,254 executable multi-turn test cases spanning diverse usage scenarios, delivery patterns, and agent-level security risks. Extensive evaluation on 11 LLM-backed OpenClaw agents confirms that ASEval effectively exposes pervasive security failures. In particular, our proposed perturbation operators raise the average risk-trigger rate from 22.9% under existing injection techniques to 47.4%, as judged by an action-grounded oracle that matches human annotation at 93.2% binary F1. Our further analysis and case studies illustrate that such failures emerge from multi-turn delivery, persistent state, and tool-mediated actions that response-level evaluation overlooks.