feat(airt): multi-step tool-attack search tool (Kaggle techniques)

[rdheekonda]

Summary

Adds generate_multistep_tool_attack so AIRT users (TUI/agent) can run an algorithmic multi-step tool-attack search against any HTTP agent by natural language.

It searches user-message chains for a replay-stable read-then-exfiltrate causal path — the agent reads an untrusted source (read_file/fetch_url/query_database) and then performs a privileged outbound action (fetch_url/send_email) carrying its contents — verified by a trace predicate and confirmed by a fresh replay.

Our own implementation of the algorithmic techniques from the Kaggle AI Agent Security - Multi-Step Tool Attacks competition (Kaggle × OpenAI × Google × IEEE, 2026), attributed in docstrings:

• Replay-stable candidates + shared-prefix / trajectory search — Pilkwang Kim
• Two-probe recovery — tetsu2131
• Split / multi-post exfiltration — Nguyễn Công Tuấn (JED)

We reimplement the algorithms (not the competition code) so we control the trace format and success predicate. Generalized to any agent/tools; runs inside an Assessment. Companion cookbook notebook: agentic-red-teaming/06_multistep_tool_attacks.ipynb.

Changes

• scripts/attack_runner.py: generate_multistep_tool_attack emits a self-contained workflow (embeds the MultiStepToolAttack search + HTTP target + Assessment); registered in METHODS.
• tools/attacks.py: generate_multistep_tool_attack tool wrapper (auto-registered from tools/).
• agents/ai-red-teaming-agent.md: routing rule + tool reference.

Validation

• generate_only produces a compiling, self-contained workflow targeting the given agent_url.
• Executed end-to-end against a real deployed agent: budget calibrated, 2 replay-stable findings (read-then-exfil, shared-prefix branch); other strategies correctly did not fire (honest search). Assessment streamed to the platform.

Test plan

• generate_multistep_tool_attack(agent_url=...) in the TUI → auto-executes → assessment appears.