LLM Agent Security

LLM: Large Language Model

The field examines how agents can be manipulated through indirect prompt injection, malicious tools or skills, poisoned memory, excessive permissions, and multi-agent interactions, sometimes leading to data leaks or harmful actions. Researchers evaluate these risks with red-team attacks and benchmarks that track agent trajectories, tool calls, and real effects—not just final answers. Defenses include runtime authorization and least privilege, sandboxing, provenance and information-flow controls, monitoring, and security-focused training. A central challenge is protecting agents over long, changing workflows without blocking legitimate tasks, while making evaluations realistic enough to capture adaptive attacks and deployment risks.

Latest papers

332 papers44 papers in the last four weeks, up 33% on the four weeks before. 0.3% of all new papers.

When Child Inherits: Modeling and Exploiting Subagent Spawn in Multi-Agent Networks
May 8, 2026Ziwen Cai, Yihe Zhang, Xiali HeiLLM Agent Security Multi-Agent System Security
University of Louisiana at Lafayette Lafayette, USA
PropGuard: Safeguarding LLM-MAS via Propagation-Aware Exploration and Remediation
May 8, 2026Bingyu Yan, Xiaoming Zhang, Jinyu Hou +4LLM Agent Security Prompt Injection Attacks on AI Agents
Beihang University · Beijing University of Posts and Telecommunications · City University of Hong Kong
Research on Security Enhancement Methods for Adversarial Robust Large Language Model Intelligent Agents for Medical Decision-Making Tasks
May 7, 2026Saisai HuClinical Decision Support LLM Agent Security
Pace University · New York, NY 10038 · United States
Towards Security-Auditable LLM Agents: A Unified Graph Representation
May 7, 2026Chaofan Li, Lyuye Zhang, Jintao Zhai +9LLM Agent Security Multi-Agent System Security
Huazhong University of Science and Technology, China · Nanyang Technological University, Singapore, Singapore · Chongqing University of Posts and Telecommunications, China +2
When Routine Chats Turn Toxic: Unintended Long-Term State Poisoning in Personalized Agents
May 7, 2026Xiaoyu Xu, Minxin Du, Qipeng Xie +3LLM Agent Security Agent Memory Poisoning
†The Hong Kong Polytechnic University · ⋄Hong Kong University of Science and Technology, HKUST (Guangzhou)
PragLocker: Protecting Agent Intellectual Property in Untrusted Deployments via Non-Portable Prompts
May 7, 2026Qinfeng Li, Yuntai Bao, Jianghui Hu +5LLM Agent Security
Zhejiang University · Chang’an University · Innovation and Management Center, School of Software Technology (Ningbo), Zhejiang University +2
LoopTrap: Termination Poisoning Attacks on LLM Agents
May 7, 2026Huiyu Xu, Zhibo Wang, Wenhui Zhang +4Adversarial Attacks on LLMs LLM Red Teaming
The State Key Laboratory of Blockchain and Data Security Zhejiang University Hangzhou, Zhejiang, P. R. China · School of Cyber Science and Engineering Southeast University Nanjing, Jiangsu, P. R. China
SafeHarbor: Hierarchical Memory-Augmented Guardrail for LLM Agent Safety
May 7, 2026Zhe Liu, Zonghao Ying, Wenxin Zhang +5LLM Guardrails LLM Agent Security
School of Cyber Science and Technology, Beihang University, Beijing, China · Institute of Artificial Intelligence, Beihang University, Beijing, China · University of Chinese Academy of Sciences, Beijing, China +1
Agentic Vulnerability Reasoning on COTS Binaries
May 6, 2026Hwiwon Lee, Jongseong Kim, Lingming ZhangSoftware Reverse Engineering Software Vulnerability Detection
University of Illinois Urbana-Champaign
SkCC: Portable and Secure Skill Compilation for Cross-Framework LLM Agents
May 5, 2026Yipeng Ouyang, Yi Xiao, Yuhao Gu +1LLM Agent Security LLM Agent Skill Retrieval
Sun Yat-sen University
Safeguarding LLM Agents against Long-Horizon Threats via Shadow Memory
May 4, 2026Yuhui Wang, Tanqiu Jiang, Jiacheng Liang +2LLM Agent Security Agent Memory Management
Stony Brook University USA · Cisco Systems USA
When Agents Handle Secrets: A Survey of Confidential Computing for Agentic AI
May 4, 2026Javad Forough, Marios Kogias, Hamed HaddadiCybersecurity Remote Attestation
Department of Computing Imperial College London London, United Kingdom
Hybrid Inspection and Task-Based Access Control in Zero-Trust Agentic AI
May 4, 2026Majed El Helou, Benjamin Ryder, Chiara Troiani +3Cybersecurity LLM Agent Security
Cisco Systems, Switzerland
When Alignment Isn't Enough: Response-Path Attacks on LLM Agents
May 4, 2026Mingyu Luo, Zihan Zhang, Zesen Liu +7AI Agent Reliability LLM Agent Security
Fudan University, Shanghai, China · The Hong Kong University of Science and Technology, Hong Kong, China · Huazhong University of Science and Technology, Wuhan, China
Trojan Hippo Bench: A Dynamic Benchmark for Persistent Memory Attacks and Defenses in LLM Agents
May 3, 2026Debeshee Das, Julien Piet, Darya Kaviani +3LLM Agent Security AI Agent Security Benchmarks
ETH Zürich · UC Berkeley · Snyk
A Low-Latency Fraud Detection Layer for Detecting Adversarial Interaction Patterns in LLM-Powered Agents
May 1, 2026Sheldon Yu, Yingcheng Sun, Hanqing Guo +1AI Agent Security LLM Agent Security
University of California, San Diego · UNC at Greensboro · Indiana University Bloomington
Semia: Auditing Agent Skills via Constraint-Guided Representation Synthesis
May 1, 2026Hongbo Wen, Ying Li, Hanzhi Liu +4AI Agent Auditing Static Code Analysis
University of California, Santa Barbara Santa Barbara, CA, USA · University of California, Los Angeles Los Angeles, CA, USA · Fuzzland USA +1
Security Attack and Defense Strategies for Autonomous Agent Frameworks: A Layered Review with OpenClaw as a Case Study
Apr 30, 2026Luyao Xu, Xiang ChenAI Agent Security LLM Agent Security
School of Artificial Intelligence and Computer Science, Nantong University, Nantong, China · State Key Lab. for Novel Software Technology, Nanjing University, Nanjing, China
Enforcing Benign Trajectories: A Behavioral Firewall for Structured-Workflow AI Agents
Apr 29, 2026Hung DangLLM Agent Security AI Agent Monitoring
Van Lang University, Ho Chi Minh City, Vietnam
SUDP: Secret-Use Delegation Protocol for Agentic Systems
Apr 27, 2026Xiaohang Yu, Hejia Geng, Xinmeng Zeng +1Cybersecurity LLM Agent Security
Imperial College London · Science Intelligence · University of Oxford +1
AgentWard: A Lifecycle Security Architecture for Autonomous AI Agents
Apr 27, 2026Yixiang Zhang, Xinhao Deng, Jiaqing Wu +3AI Agent Security LLM Agent Security
A Systematic Survey of Security Threats and Defenses in LLM-Based AI Agents: A Layered Attack Surface Framework
Apr 25, 2026Kexin ChuAI Agent Security LLM Agent Security
School of Computing, University of Connecticut
RouteGuard: Internal-Signal Detection of Skill Poisoning in LLM Agents
Apr 24, 2026Wenjie Xiao, Xuehai Tang, Biyu Zhou +2LLM Agent Security Prompt Injection Attacks on LLMs
University of Chinese Academy of Sciences · Institute of Information Engineering, Chinese Academy of Sciences
Sovereign Agentic Loops: Decoupling AI Reasoning from Execution in Real-World Systems
Apr 24, 2026Jun He, Deying YuLLM Agent Security AI Agent Safety
CI-Work: Benchmarking Contextual Integrity in Enterprise LLM Agents
Apr 23, 2026Wenjie Fu, Xiaoting Qin, Jue Zhang +5Data Leakage Contextual Integrity
Huazhong University of Science and Technology, China · Microsoft
FSFM: A Biologically-Inspired Framework for Selective Forgetting of Agent Memory
Apr 22, 2026Yingjie Gu, Wenjian Xiong, Liqiang Wang +7LLM Agent Security Memory-Augmented Agents
China Mobile Digital Intelligence Business Unit | China Mobile Jiutian Company | China Mobile Jiutian Research Institute
SafeAgent: A Runtime Protection Architecture for Agentic Systems
Apr 19, 2026Hailin Liu, Eugene Ilyushin, Jie Ni +1Adversarial Attacks on LLMs AI Agent Security
Lomonosov Moscow State University · Central University
enclawed: A Configurable, Sector-Neutral Hardening Framework for Single-User AI Assistant Gateways
Apr 18, 2026Alfredo MetereAI Assurance AI Agent Security
Metere Consulting, LLC.
CapSeal: Capability-Sealed Secret Mediation for Secure Agent Execution
Apr 18, 2026Shutong Jin, Ruiyi Guo, Ray C. C. CheungAI Agent Security LLM Agent Security
City University of Hong Kong, Hong Kong · Beijing Foreign Studies University
A Survey on Long-Term Memory Security in LLM Agents: Attacks, Defenses, and Governance Across the Memory Lifecycle
Apr 17, 2026Zehao Lin, Xixuan Hao, Renyu Fu +5LLM Agent Security AI Agent Governance
MemTensor (Shanghai) Technology Co., Ltd. · The Hong Kong University of Science and Technology (Guangzhou) · Shanghai Jiao Tong University

May 8, 2026J/K move · Enter open · S save

When Child Inherits: Modeling and Exploiting Subagent Spawn in Multi-Agent Networks

Ziwen Cai, Yihe Zhang, Xiali Hei

University of Louisiana at Lafayette Lafayette, USA

LLM Agent Security Multi-Agent System Security Multi-Agent LLMs

Open paper AskPDF arXiv

Since the official release of ChatGPT in 2022, large language models (LLMs) have rapidly evolved from chatbot-style interfaces into agentic systems that can delegate work through tools and newly spawned subagents. While these capabilities improve automation and scalability, they also pose new security risks in multi-agent networks. Existing research has studied how individual LLM-based agents can be compromised through prompt injection, jailbreaking, poisoned retrieval data, or malicious extensions. Less is known about what happens after one agent is compromised inside a multi-agent network. In particular, inherited memory from parent agents can carry malicious instructions, outdated states, or unintended behavioral rules into newly created subagents, allowing a local compromise to spread across agent boundaries. In this paper, we model contemporary multi-agent networks through the lens of subagent inheritance. Our analysis shows that current frameworks can violate trust boundaries through insecure memory inheritance, weak resource control, stale post-spawn state, and improper termination authority. We demonstrate these risks in real agent frameworks and propose defenses based on explicit security invariants. Our findings show that inheritance is not merely an implementation detail, but a central component influencing the security of multi-agent systems.