AgentXploit is a two-role auditing system for AI agents that separates repository-level attack-path discovery from runtime exploitation. It consists of an Analyzer Agent and an Exploiter Agent, and is tested on 12 open-source AI-agent systems and frameworks, achieving a 59.3% end-to-end success rate.