Javelin: Self-Play and Adversarial Co-Evolution in Multi-Agent Offensive Security Systems

This paper describes Ares, a proprietary framework developed by Assail, Inc. that adapts selfevolving agent architectures to autonomous red teaming, enabling security agents to continuously improve their capabilities without human-curated training data. Building upon the co-evolutionary architecture introduced by the Agent0 framework [Xia et al., 2025], Ares establishes a adversarial dynamic between an Adversary Simulator that generates increasingly sophisticated security challenges and a Breacher that learns to analyze and exploit them using integrated security tools. While applicable to mobile application security, Ares is primarily designed for API red teaming—addressing the critical need for automated security assessment of REST, GraphQL, and gRPC services that form the backbone of modern digital infrastructure. We introduce security-specific adaptations including multifactor reward functions for vulnerability detection, sandbox-based ground truth validation, and domain-adapted policy optimization. Our framework addresses the unique challenges of applying self-evolution to security domains, including the non-deterministic nature of vulnerability assessment and the need for tool-integrated reasoning across heterogeneous security toolchains. This paper presents an architectural design and theoretical framework; the empirical improvements cited from Agent0 (+18% mathematical reasoning, +24% general reasoning) are results on reasoning benchmarks, not security-specific evaluations. Empirical validation on red teaming tasks is planned for future work. Keywords: Large Language Models, Autonomous Agents, red teaming, API Security, Red Teams, Reinforcement Learning, Self-Evolution, Cybersecurity, Tool-Integrated Reasoning