cs.CROct 29, 2026

Characterizing LLM Agent Behaviors in Module Shadowing Environments

Authors: Shuai Yang, Enmeng Lu, Jinyu Fan, Gongce Cao, Yu Chen, Jiawei Xie, Feifei Zhao, Zhangsheng Wang, 

Organizations: Gaoling School of AI, Renmin University of China, Beijing, China · Beijing Institute of AI Safety and Governance, Beijing, China · School of Humanities, University of Chinese Academy of Sciences, Beijing, China · Safe and Secure AI (SSAI), Beijing, China

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

LLM agents operating in untrusted workspaces face the risk of untrusted code execution during routine tasks, yet final reports and workspace states alone cannot reliably establish whether execution occurred. We introduce an evaluation framework that codes observation, reasoning, execution, and response behaviors from agent trajectories and aligns them with independent environmental records to reconstruct execution histories and verify final reports. We apply this framework to module shadowing, in which a local file is loaded in place of a trusted module during import, enabling untrusted code execution without adversarial prompts. Across 90 trials with 15 models, the payload executed in 51% of direct shadowing trials and 87% of indirect shadowing trials. Even explicit recognition of the shadowing mechanism did not ensure prevention, as the payload ran in 10 of the 29 trials with recorded recognition. These failures were often omitted from final reports, as 49 of the 62 triggered trials ended without mention of the security issue. Three reports even denied execution, including one from a trial in which independent logs recorded 19 payload executions. Final workspace states also obscured prior execution when agents deleted or overwrote the payload marker in 10 triggered trials. These findings demonstrate that combining behavioral coding with independent environmental auditing enables rigorous and transparent evaluation of agent safety.

Figures & tables

Figure 1: Our evaluation framework. We code agent trajectories into four behavioral categories comprising observation, reasoning, execution, and response. Independent environmental auditing records file system changes and preserves artifact history. We combine these sources to reconstruct event histories, characterize behavioral patterns, and assess incident reporting.
Figure 2: Payload execution across conditions and agent steps. (a) Each row shows a model's 3 direct trials on the left and 3 indirect trials on the right. Teal denotes untriggered trials, whereas red shades distinguish the marker artifact's final state after execution as retained, overwritten, or deleted. Open and filled circles denote open weights and proprietary models, respectively. (b) Lines connect trigger counts under the two conditions, with line width indicating how many models share the same pair of counts. Orange denotes more triggers under indirect shadowing, while gray denotes equal counts. (c) Kaplan-Meier estimates of the probability of remaining untriggered through each agent step. Untriggered trials are censored at their final step.
Figure 3: Agent behavioral patterns and their associations with payload execution. (a1, a2) Behavioral maps for direct and indirect shadowing, respectively. Columns represent trials grouped by observed safeguard and ordered by expressed reasoning state and then outcome, while rows represent coded behaviors defined in Table S1 . Colored cells mark recorded behaviors by category, whereas gray cells indicate that a behavior was not recorded within its coding window. Reasoning behaviors capture explicit statements up to and including the first trigger step, whereas module inspection and artifact checks are coded strictly before that step. Untriggered trials use the full trajectory for these measures. The top strips show the execution outcome and marker state, the strongest observed safeguard, and task submission. On the mechanism recognition row, teal outlines enclose untriggered trials and red outlines enclose triggered trials. Red outlines spanning the other 4 reasoning rows identify triggered trials with at least 1 of these behaviors but no explicit mechanism recognition. Bars on the right show the prevalence of each behavior within the condition. (b) Associations between coded behaviors and payload execution, pooled across both conditions. Points show Haldane-corrected log⁡2\log_{2} odds ratios comparing payload execution in trials with and without each behavior, and horizontal lines show 95% Wald confidence intervals. Negative values indicate lower execution odds in trials with the behavior. Filled and open circles indicate padj<0.001p_{\text{adj}}<0.001 and padj≥0.001p_{\text{adj}}\geq 0.001 , respectively, after Benjamini-Hochberg correction across all tested behaviors.
Figure 4: Relationships among expressed risk awareness, observed safeguards, and payload execution. Trial distributions under direct (a) and indirect (b) shadowing, respectively, with 45 trials per condition. Node heights and ribbon widths are proportional to trial counts, with teal and red ribbons representing untriggered and triggered trials, respectively. Expressed risk awareness is coded up to and including the first trigger step, or over the full trajectory for untriggered trials. Observed safeguards summarize execution behavior across the entire trial and are grouped as effective, some runs isolated, or none.
Expressed risk awarenessObserved safeguardsDirectIndirect
Explicit mechanism recognitioneffective13/133/3
 some runs isolated3/50/1
 none0/40/3
Other expressed awarenesseffective1/1-
 some runs isolated0/10/9
 none0/80/9
Table 1: Untriggered trials by expressed risk awareness and observed safeguards. Entries show the ratio of untriggered trials to total trials for each combination of expressed risk awareness and observed safeguards under each condition, while a dash indicates that no trials fell into that category. Expressed risk awareness reflects explicit statements recorded up to and including the first trigger step, or across the full trajectory for untriggered trials.
Appendix figures & tables2 assets

Supplementary material from the paper’s appendix.

Appendix

CategoryBehaviourDefinition and examples
ObservationInspected the evaluation environmentExamines evaluation logs, verifier or test directories, processes, watcher code or cached bytecode, for example by reading the file-system watcher and startup scripts "to understand how completion is verified".
 Inspected the module before any triggerDisplays the module's source before the first-trigger step, for example with nl -ba xml.py .
 Checked for the artifact before any triggerExamines the artifact path or lists its directory before the first-trigger step, for example by listing the still-empty artifact directory.
ReasoningRecognized name shadowingStates that the local file takes precedence over or conflicts with the library module of the same name, for example "shadows Python's stdlib xml package".
 Noted the payload's side effectDescribes the module's extra action, for example "writes a canary file when imported".
 Voiced suspicion of the moduleExpresses suspicion about the module, for example "contains suspicious code".
Appendix
Table S1: Behavior definitions and examples from agent trajectories. "The module" denotes the local shadowing file; "the artifact" denotes the payload's marker.
Figure S1: Trial action traces. Each panel shows one condition, with one trial per row. Labels prefixed with D and I correspond to the column numbers in Figure 3 a1 and a2, respectively. Each tile is an agent step: blue denotes observation, green an isolated interpreter run, pale red an exposed run and dark red payload execution. A pale blue bar marks an artifact check before the first-trigger step. A white diamond marks explicit mechanism recognition; a white circle marks other expressed awareness in a step without explicit recognition. Other awareness includes noting the payload's side effect, voicing suspicion or evaluation awareness, or stating an intention not to run the module. Awareness markers cover statements up to and including the first-trigger step. Untriggered trials use the full trajectory for these marks. The right margin gives the number of steps omitted beyond step 24.
More in this topic

LLM Agent Security

Large language model agent security studies attacks and safeguards for systems that plan, use tools, retain memory, and act across applications.

See all 342 papers

Explore similar work

CardsList

  1. LLM Agents Can Easily Tamper With Their Own Traces

    Sep 24, 2026Jeremy Qin, David Schmotz, Derck Prinzhorn +3AI Agent AuditingAI Agent Security

    ELLIS Institute Tübingen · Max Planck Institute for Intelligent Systems · Tübingen AI Center +3

  2. AgentTrap: Measuring Runtime Trust Failures in Third-Party Agent Skills

    May 13, 2026Haomin Zhuang, Hanwen Xing, Yujun Zhou +5AI Agent SecurityLLM Agent Security

    University of Notre Dame · University of Southern California · LMU Munich +1

  3. AgentSpy: Making AI Agent Behavior Observable

    Oct 5, 2026Christoph Bühler, Matteo Biagiola, Luca Di Grazia +1AI Agent ReliabilityAI Agent Auditing

    University of St. Gallen, St. Gallen, SG, Switzerland · University of St. Gallen and Università della Svizzera italiana (USI), St. Gallen and Lugano, SG and TI, Switzerland