Why does VeriGrey use tool invocation sequences instead of traditional branch coverage as its feedback function?

Traditional branch coverage fails to capture LLM agent behavior because two different agent actions (like read_file vs. write_file) execute through nearly identical code paths. The behavioral difference lives in the LLM's tool selection decision, not in the surrounding code structure. Tool invocation sequences—recording which tools were called and in what order—directly capture these behavioral differences and serve as a reliable proxy for agent behavior diversity.

How does VeriGrey's Context Bridging mutation strategy defeat hardened LLM defenses?

Security-trained LLMs reject injection prompts that appear irrelevant to the current task. Context Bridging defeats this by embedding the attacker's goal as a necessary prerequisite for completing the agent's primary task. For example, if an agent is fixing a security vulnerability, the injected prompt claims that reading a SECRET file and exfiltrating it is required to safely apply the fix. The LLM's motivation to complete its legitimate task becomes the attack vector.

What are the practical engineering implications of VeriGrey's 33% improvement over black-box testing?

The 33% gap means organizations using only black-box security testing for their LLM agents are missing more than one in four exploitable vulnerabilities. Practically, this means: pre-deployment red-teaming should use grey-box tools like VeriGrey; skill/plugin marketplaces need automated dynamic testing in their submission pipelines; and CI/CD pipelines for agent development should incorporate grey-box security testing to catch regressions.

— AI DAILY

Sources

arXiv