Sabotage

Follow this topic Ask about this topic

Momentum

2 papers in the last four weeks, with none the four weeks before. 0.0% of all new papers.

Jul 13Week of Sep 28

Latest papers 19

All topics

The Innocent Courier: Covert Exfiltration Through Legitimate LLM Web Fetching
Oct 1, 2026Alessandro Pegoraro, Daryan Merx, Phillip Rieger +1Attacker Large Language Model Cyberattacks
Technical University of Darmstadt · Graz University of Technology
Shutdown Sabotage Propensities in Multi-Agent Systems
Sep 23, 2026Amelie Knecht, Ulysse Schaller, Christopher Summerfield +1Sabotage Strategic Agents
AI Safety Research Group, University of Stuttgart, Stuttgart, Germany · University of Oxford, Oxford, United Kingdom
ResearchArena: Evaluating Sabotage and Monitoring in Automated AI R&D
Jul 21, 2026Lena Libon, Ben Rank, Jehyeok Yeon +5Sabotage Artificial Intelligence Safety
ELLIS Institute Tübingen, Max Planck Institute for Intelligent Systems, Tübingen AI Center · ETH Zurich · University of Amsterdam
Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages
Jul 6, 2026Lucas PintoSabotage Model Auditing
Independent Researcher
Smarter Saboteurs, Better Fixers: Scaling & Security in Linear Multi-Agent Workflows
Jun 10, 2026Timothy McAllister, Sina Abdidizaji, Ivan Garibay +1Multi-Agent Workflows Sabotage
Department of Computer Science, University of Central Florida, Orlando, FL, USA · Department of Industrial Engineering, University of Central Florida, Orlando, FL, USA
Bootstrapped Monitoring: Leveraging Transparent Reasoning to Oversee Stronger AI Agents
Jun 10, 2026Frank Xiao, Mary PhuongArtificial Intelligence Control Trustworthy Artificial Intelligence
California Institute of Technology
The Distributed Detectability Band Against Marginal-Preserving Attacks
Jun 9, 2026Zhang Qinqin, Gao YuzeSabotage Distributed Denial-Of-Service
Diffuse AI Control on Fuzzy Tasks
Jun 8, 2026Mikhail Terekhov, Caglar Gulcehre, Vivek Hebbar +1Artificial Intelligence Safety Sabotage
Anthropic Fellows Program (via MATS) · EPFL · Redwood Research +1
Coding with "Enemy": Can Human Developers Detect AI Agent Sabotage?
Jun 4, 2026Jingheng Ye, Huiqi Zou, Simon Yu +1Sabotage Coding Agents
Northeastern University
Gram: Assessing sabotage propensities via automated alignment auditing
May 28, 2026David Lindner, Victoria Krakovna, Sebastian FarquharSabotage Artificial Intelligence Alignment
1Google DeepMind
The Best-Laid SCHEMEs: Coordinated Sabotage and Monitoring in Multi-Agent Systems
May 27, 2026Nikolay Radev, Lennart Haas, Benjamin Arnav +1Sabotage Coding Agents
Training on Documents About Monitoring Leads to CoT Obfuscation
May 14, 2026Reilly Haskins, Bilal Chughtai, Joshua EngelsSabotage Obfuscation
University of Canterbury · Google DeepMind · Pivotal Research
Adaptive Dual-Path Framework for Covert Semantic Communication
May 5, 2026Xi Yu, Weicai Li, Lin Yin +1Semantic Communications Dual-Path Network
School of Information and Communication Engineering, Beijing University of Posts and Telecommunications (BUPT), Beijing 100876, China · Center for Target Cognition Information Processing Science and Technology, and the Key Laboratory of Modern Measurement and Control Technology, Ministry of Education, both at Beijing Information Science and Technology University, Beijing, China
Option-Order Randomisation Reveals a Distributional Position Attractor in Prompted Sandbagging
Apr 29, 2026Jon-Paul CacioliMmlu-Pro Position Bias
Independent Researcher, Melbourne, Australia
Below-Chance Blindness: Prompted Underperformance in Small LLMs Produces Positional Bias Rather than Answer Avoidance
Apr 28, 2026Jon-Paul CacioliSabotage Position Bias
Independent Researcher, Melbourne, Australia
Evaluating whether AI models would sabotage AI safety research
Apr 27, 2026Robert Kirk, Alexandra Souly, Kai Fronsdal +2Artificial Intelligence Safety Sabotage
UK AI Security Institute · UK AISI Research Affiliate
Removing Sandbagging in LLMs by Training with Weak Supervision
Apr 23, 2026Emil Ryd, Henning Bartsch, Julian Stastny +2Sabotage Adversarial Evaluation
MATS · University of Oxford · Redwood Research +1
Auditing Sabotage Bench: A Benchmark for Detecting and Fixing Research Sabotage in ML Codebases
Apr 17, 2026Eric Gan, Aryan Bhatt, Buck Shlegeris +2Sabotage Code Quality
Redwood Research
LinuxArena: A Control Setting for AI Agents in Live Production Software Environments
Apr 16, 2026Tyler Tracy, Ram Potham, Nick Kuhn +31Sabotage Runtime Safety Filtering
Redwood Research · EquiStamp

Oct 1, 2026, cs.CRJ/K move · Enter open · S save

The Innocent Courier: Covert Exfiltration Through Legitimate LLM Web Fetching

Alessandro Pegoraro, Daryan Merx, Phillip Rieger, Ahmad-Reza Sadeghi

Technical University of Darmstadt · Graz University of Technology

Attacker Large Language Model Cyberattacks Sabotage

Open paper AskPDF arXiv

With the increasing capabilities of Large-Language-Models (LLMs) and LLM-based agents, users are increasingly using them to solve everyday problems, such as answering e-mails or providing programming support. Existing work has extensively investigated security and privacy risks, such as prompt injections and the disclosure of sensitive data to chatbot providers. While various solutions were developed to address these risks, including input structuring to prevent prompt injections or deploying local LLMs to avoid sharing confidential data with chatbot operators, LLMs also pose the risk of leaking confidential data to third parties. In this paper, we demonstrate with LLMLeak a novel attack vector where malicious software that runs locally but cannot communicate directly with the internet abuses LLMs to establish a covert channel. While inputs that instruct the LLM to send data directly via generated code are easy to detect and network libraries are typically restricted, LLMLeak relies only on the LLM's tool to fetch websites for further information. A malicious software component on the client side embeds a secret into a URL. It presents the referenced website as providing information required for a benign task, such as migrating a software library. When the LLM accesses the URL, the attacker receives the encoded secret through an attacker-controlled DNS or web server. We perform an extensive evaluation on eleven open-parameter models, observe an attack success rate of 79.7%, and also conduct a case study on real-world chatbots, demonstrating the relevance of LLMLeak.

Momentum

Related topics

Latest papers 19