LLM Agent Security

LLM: Large Language Model

Follow this topic Ask about this topic

Momentum

29 papers in the last four weeks, up 81% on the four weeks before. 0.3% of all new papers.

Jul 13Week of Sep 28

Latest papers 234

All topics

The Surface You Test Is Not the Surface That Breaks
May 28, 2026Syed Nazmus Sakib, Nafiul Haque, Shahrear Bin Amin +1LLM Agent Security AI Agent Security Benchmarks
Department of Robotics and Mechatronics Engineering, University of Dhaka · Department of Computer Science and Engineering, University of Dhaka
Plant, Persist, Trigger: Sleeper Attack on Large Language Model Agents
May 27, 2026Yongxiang Li, Moxin Li, Zhixin Ma +2LLM Agent Security AI Agent Security Benchmarks
University of Science and Technology of China · National University of Singapore · Singapore Management University
Got a Secret? LLM Agents Can't Keep It: Evaluating Privacy in Multi-Agent Systems
May 26, 2026Aman Priyanshu, Supriti Vijay, Esha PahwaData Leakage Multi-Agent LLM Systems
Foundation AI · USA · Corvic AI
SEC-bench Pro: Can Language Models Solve Long-Horizon Software Security Tasks?
May 26, 2026Hwiwon Lee, Jiawei Liu, Dongjun Kim +3Software Vulnerability Detection Software Security
University of Illinois Urbana-Champaign
ChainCaps: Composition-Safe Tool-Using Agents via Monotonic Capability Attenuation
May 26, 2026Xiaochong Jiang, Shiqi Yang, Ziwei Li +3LLM Agent Security Capability-Based Security
Independent Researcher, Seattle, WA, USA · Independent Researcher, New York City, NY, USA · King Abdullah University of Science and Technology, Saudi Arabia
Security of OpenClaw Agents: Fundamentals, Attacks, and Countermeasures
May 25, 2026Yuntao Wang, Jianle Ba, Han Liu +5AI Agent Security LLM Agent Security
School of Cyber Science and Engineering, Xi’an Jiaotong University, Xi’an, China
Evo-Attacker: Memory-Augmented Reinforcement Learning for Long-Horizon Tool Attacks on LLM-MAS
May 25, 2026Bingyu Yan, Xiaoming Zhang, Jinyu Hou +4Adversarial Attacks on LLMs LLM Agent Security
1Beihang University · 2Beijing University of Posts and Telecommunications · 3China Academy of Information and Communications Technology
MemMorph: Tool Hijacking in LLM Agents via Memory Poisoning
May 24, 2026Xuanye Zhang, Yongsen Zheng, Zhuqin Xu +5LLM Agent Security Tool-Using Agents
Nanyang Technological University, Singapore
IterInject: Indirect Prompt Injection Against LLM Agents via Feedback-Guided Iterative Optimization
May 23, 2026Zixuan Chen, Jiaxiang Chen, Li Luo +4LLM Agent Security Indirect Prompt Injection
1Shanghai Jiao Tong University · 2The University of Hong Kong
Agent-ToM: Learning to Monitor Autonomous LLM Agents via Theory-of-Mind Reasoning
May 22, 2026Nesreen K. Ahmed, Nima NafisiLLM Agent Security AI Agent Monitoring
Cisco Outshift
When the Manual Lies: A Realistic Benchmark to Evaluate MCP Poisoning Attacks for LLM Agents
May 22, 2026Shi Liu, Xuehai Tang, Xikang Yang +4MCP Security LLM Agent Security
Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China · School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China
Benchmarking Autonomous Agents against Temporal, Spatial, and Semantic Evasions
May 21, 2026Jianan Ma, Xiaohu Du, Ruixiao Lin +8LLM Agent Evaluation LLM Agent Security
Hangzhou Dianzi University · Ant Group · Zhejiang University +1
PocketAgents: A Manifest-Driven Library of Autonomous Defense Agents
May 20, 2026Sidnei Barbieri, Ágney Lopes Roth Ferraz, Lourenço Alves Pereira JúniorAutonomous Cyber Defense LLM Agent Security
Aeronautics Institute of Technology (ITA), São José dos Campos/SP, Brazil
An Application-Layer Multi-Modal Covert-Channel Reference Monitor for LLM Agent Egress
May 20, 2026Alfredo MetereLLM Agent Security AI Agent Monitoring
Enclawed, LLC, California, USA
Heartbeat-Bound Hierarchical Credentials: Cryptographic Revocation for AI Agent Swarms
May 20, 2026Saurabh DeochakeAI Agent Security LLM Agent Security
SentinelOne Inc. Mountain View, USA
POLAR-Bench: A Diagnostic Benchmark for Privacy-Utility Trade-offs in LLM Agents
May 18, 2026Qiaoyuan Zheng, Yiqu Yang, Qi Gao +1LLM Agent Evaluation LLM Agent Security
ETH Zurich Zurich, Switzerland · ETH AI Center Zurich, Switzerland
OEP: Poisoning Self-Evolving LLM Agents via Locally Correct but Non-Transferable Experiences
May 18, 2026Kaixiang Wang, Jiong Lou, Zhaojiacheng Zhou +1LLM Agent Security Agent Memory Poisoning
Shanghai Jiao Tong University Shanghai, China
Prompts Don't Protect: Architectural Enforcement via MCP Proxy for LLM Tool Access Control
May 18, 2026Rohith UppalaLLM Agent Security AI Control
Independent Researcher
Trust No Tool: Evaluating and Defending LLM Agents under Untrusted Tool Feedback
May 17, 2026Lecheng Yan, Ruizhe Li, Xicheng Han +5AI Agent Reliability LLM Agent Evaluation
Southern University of Science and Technology · University of Science and Technology of China · Zhejiang University +2
ASPI: Seeking Ambiguity Clarification Amplifies Prompt Injection Vulnerability in LLM Agents
May 17, 2026Udari Madhushani Sehwag, Zhengyang Shan, Heming Liu +3LLM Agent Security AI Agent Security Benchmarks
Scale AI · 2Boston University · 4Human Frontier Collective +3
Who Owns This Agent? Tracing AI Agents Back to Their Owners
May 15, 2026Ruben Chocron, Doron Jonathan Ben Chayim, Eyal Lenga +3AI Accountability LLM Agent Security
Ben-Gurion University of the Negev Beer-Sheva, Israel · Center for Cybersecurity Systems & Networks, Amrita Vishwa Vidyapeetham Amritapuri, India · Northeastern University Boston, Massachusetts, USA
Known By Their Actions: Fingerprinting LLM Browser Agents via UI Traces
May 14, 2026William Lugoloobi, Samuelle Marro, Jabez Magomere +2Language Model Fingerprinting LLM Agent Security
Oxford Internet Institute, University of Oxford · Department of Engineering Science, University of Oxford
MemLineage: Lineage-Guided Enforcement for LLM Agent Memory
May 14, 2026Ciyan Ouyang, Rui HouLLM Agent Memory LLM Agent Security
State Key Laboratory of Cyberspace Security Defense Institute of Information Engineering, CAS Beijing, China
AgentTrap: Measuring Runtime Trust Failures in Third-Party Agent Skills
May 13, 2026Haomin Zhuang, Hanwen Xing, Yujun Zhou +5AI Agent Security LLM Agent Security
University of Notre Dame · University of Southern California · LMU Munich +1
SkillSafetyBench: Evaluating Agent Safety under Skill-Facing Attack Surfaces
May 12, 2026Chang Jin, An Wang, Zeming Wei +7LLM Agent Security AI Agent Security Benchmarks
1Shanghai AI Laboratory · 2Peking University · 3East China Normal University
Proteus: A Self-Evolving Red Team for Agent Skill Ecosystems
May 12, 2026Zhaojiacheng ZhouLLM Agent Security Automated Red Teaming
Department of Computer Science and Engineering Shanghai Jiao Tong University Shanghai 200240, China
Can a Single Message Paralyze the AI Infrastructure? The Rise of AbO-DDoS Attacks through Targeted Mobius Injection
May 12, 2026Zi Liang, Ronghua Li, Yanyun Wang +2AI Agent Security LLM Agent Security
The Hong Kong Polytechnic University, Hong Kong SAR, China · HKUST (GZ), Guangzhou, China
Comment and Control: Hijacking Agentic Workflows via Context-Grounded Evolution
May 11, 2026Neil Fendley, Zhengyu Liu, Aonan Guan +2Adversarial Attacks on LLMs Agentic Workflows
Johns Hopkins University Maryland, USA · Wyze Labs Washington, USA
Engineering Robustness into Personal Agents with the AI Workflow Store
May 11, 2026Roxana Geambasu, Mariana Raykova, Pierre Tholoniat +3Agentic Workflows LLM Agent Security
Columbia University and Google · Google
Content-Aware Attack Detection in LLM Agent Tool-Call Traffic: An Empirical Study of Features, Architectures, and Evaluation Protocols
May 11, 2026Sultan ZavrakData Leakage Graph Neural Networks
Department of Computer Engineering, Duzce University, Duzce, Turkey

May 28, 2026, cs.CRJ/K move · Enter open · S save

The Surface You Test Is Not the Surface That Breaks

Syed Nazmus Sakib, Nafiul Haque, Shahrear Bin Amin, Shifat E. Arman

Department of Robotics and Mechatronics Engineering, University of Dhaka · Department of Computer Science and Engineering, University of Dhaka

LLM Agent Security AI Agent Security Benchmarks Prompt Injection Defense Prompt Injection Attacks Prompt Injection Attacks on LLMs Prompt Injection Attacks on AI Agents

Open paper AskPDF arXiv

Prompt-injection benchmarks for LLM agents typically test attacks through a single injection surface and report the resulting attack success rate as a property of the model. We ask whether those robustness conclusions remain stable when the same adversarial content enters through a different part of the agent interface. Using AgentDojo, we evaluate 13 LLMs across four task suites and place a byte-identical payload either in a tool output or in the tool description. This small change produces large differences in comparative robustness: 44.9% of all model pairs change their relative ordering across the two surfaces, with substantial ranking instability in every suite. The effect is especially pronounced for a small number of models, showing that a benchmark can substantially underestimate vulnerability when it tests only one surface. We further find that this behavior has predictive structure. Using three suites to identify the riskier surface for each model predicts the more vulnerable surface on an unseen suite with 76.9% accuracy. Defense results show the same dependence, as mitigations effective against tool-output attacks can leave substantial exposure through tool descriptions. Our results show that prompt-injection robustness is not surface-invariant and that agent evaluations should test the surfaces on which their security conclusions depend.

Momentum

Related topics

Latest papers 234