{"total":177,"rows":[{"id":"2308.03688","title":"AgentBench: Evaluating LLMs as Agents","created":"2023-08-07","cited_by_count":1267,"area":"agents"},{"id":"2401.05566","title":"Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training","created":"2024-01-10","cited_by_count":529,"area":"agents"},{"id":"2412.14470","title":"Agent-SafetyBench: Evaluating the Safety of LLM Agents","created":"2024-12-19","cited_by_count":306,"area":"agents"},{"id":"2401.10019","title":"R-Judge: Benchmarking Safety Risk Awareness for LLM Agents","created":"2024-01-18","cited_by_count":288,"area":"agents"},{"id":"2401.05459","title":"Personal LLM Agents: Insights and Survey about the Capability, Efficiency and Security","created":"2024-01-10","cited_by_count":260,"area":"agents"},{"id":"2409.11295","title":"EIA: Environmental Injection Attack on Generalist Web Agents for Privacy Leakage","created":"2024-09-17","cited_by_count":150,"area":"agents"},{"id":"2403.04783","title":"AutoDefense: Multi-Agent LLM Defense against Jailbreak Attacks","created":"2024-03-02","cited_by_count":145,"area":"agents"},{"id":"2410.07283","title":"Prompt Infection: LLM-to-LLM Prompt Injection within Multi-Agent Systems","created":"2024-10-09","cited_by_count":133,"area":"agents"},{"id":"2503.00061","title":"Adaptive Attacks Break Defenses Against Indirect Prompt Injection Attacks on LLM Agents","created":"2025-02-27","cited_by_count":125,"area":"agents"},{"id":"2406.12814","title":"Dissecting Adversarial Robustness of Multimodal LM Agents","created":"2024-06-18","cited_by_count":120,"area":"agents"},{"id":"2405.05175","title":"AirGapAgent: Protecting Privacy-Conscious Conversational Agents","created":"2024-05-08","cited_by_count":94,"area":"agents"},{"id":"2402.10753","title":"ToolSword: Unveiling Safety Issues of Large Language Models in Tool Learning Across Three Stages","created":"2024-02-16","cited_by_count":82,"area":"agents"},{"id":"2410.14923","title":"Imprompter: Tricking LLM Agents into Improper Tool Use","created":"2024-10-19","cited_by_count":68,"area":"agents"},{"id":"2410.13886","title":"Refusal-Trained LLMs Are Easily Jailbroken As Browser Agents","created":"2024-10-11","cited_by_count":65,"area":"agents"},{"id":"2402.16965","title":"WIPI: A New Web Threat for LLM-Driven Web Agents","created":"2024-02-26","cited_by_count":51,"area":"agents"},{"id":"2502.08586","title":"Commercial LLM Agents Are Already Vulnerable to Simple Yet Dangerous Attacks","created":"2025-02-12","cited_by_count":49,"area":"agents"},{"id":"2510.05156","title":"VeriGuard: Enhancing LLM Agent Safety via Verified Code Generation","created":"2025-10-03","cited_by_count":49,"area":"agents"},{"id":"2410.12855","title":"JAILJUDGE: A Comprehensive Jailbreak Judge Benchmark with Multi-Agent Enhanced Explanation Evaluation Framework","created":"2024-10-11","cited_by_count":47,"area":"agents"},{"id":"2410.01606","title":"Automated Red Teaming with GOAT: the Generative Offensive Agent Tester","created":"2024-10-02","cited_by_count":45,"area":"agents"},{"id":"2506.02456","title":"VPI-Bench: Visual Prompt Injection Attacks for Computer-Use Agents","created":"2025-06-03","cited_by_count":45,"area":"agents"},{"id":"2407.16667","title":"RedAgent: Red Teaming Large Language Models with Context-aware Autonomous Language Agent","created":"2024-07-23","cited_by_count":44,"area":"agents"},{"id":"2407.20242","title":"BadRobot: Jailbreaking Embodied LLM Agents in the Physical World","created":"2024-07-16","cited_by_count":43,"area":"agents"},{"id":"2505.19443","title":"Vibe Coding vs. Agentic Coding: Fundamentals and Practical Implications of Agentic AI","created":"2025-05-26","cited_by_count":42,"area":"agents"},{"id":"2312.03815","title":"LLM as OS, Agents as Apps: Envisioning AIOS, Agents and the AIOS-Agent Ecosystem","created":"2023-12-06","cited_by_count":38,"area":"agents"},{"id":"2603.10749","title":"AttriGuard: Defeating Indirect Prompt Injection in LLM Agents via Causal Attribution of Tool Invocations","created":"2026-03-11","cited_by_count":38,"area":"agents"},{"id":"2504.00218","title":"$\\textit{Agents Under Siege}$: Breaking Pragmatic Multi-Agent LLM Systems with Optimized Prompt Attacks","created":"2025-03-31","cited_by_count":34,"area":"agents"},{"id":"2504.14064","title":"DoomArena: A framework for Testing AI Agents Against Evolving Security Threats","created":"2025-04-18","cited_by_count":32,"area":"agents"},{"id":"2601.17548","title":"Prompt Injection Attacks on Agentic Coding Assistants: A Systematic Analysis of Vulnerabilities in Skills, Tools, and Protocol Ecosystems","created":"2026-01-24","cited_by_count":31,"area":"agents"},{"id":"2505.24019","title":"LLM Agents Should Employ Security Principles","created":"2025-05-29","cited_by_count":29,"area":"agents"},{"id":"2510.02554","title":"ToolTweak: An Attack on Tool Selection in LLM-based Agents","created":"2025-10-02","cited_by_count":26,"area":"agents"},{"id":"2504.13192","title":"CheatAgent: Attacking LLM-Empowered Recommender Systems via LLM Agent","created":"2025-04-13","cited_by_count":25,"area":"agents"},{"id":"2404.17833","title":"Testing and Understanding Erroneous Planning in LLM Agents through Synthesized User Inputs","created":"2024-04-27","cited_by_count":22,"area":"agents"},{"id":"2410.16950","title":"Breaking ReAct Agents: Foot-in-the-Door Attack Will Get You In","created":"2024-10-22","cited_by_count":22,"area":"agents"},{"id":"2311.06957","title":"Simulating Public Administration Crisis: A Novel Generative Agent-Based Simulation System to Lower Technology Barriers in Social Science Research","created":"2023-11-12","cited_by_count":21,"area":"agents"},{"id":"2402.14859","title":"The Wolf Within: Covert Injection of Malice into MLLM Societies via an MLLM Operative","created":"2024-02-20","cited_by_count":21,"area":"agents"},{"id":"2407.17915","title":"The Dark Side of Function Calling: Pathways to Jailbreaking Large Language Models","created":"2024-07-25","cited_by_count":20,"area":"agents"},{"id":"2510.06445","title":"A Survey on Agentic Security: Applications, Threats and Defenses","created":"2025-10-07","cited_by_count":20,"area":"agents"},{"id":"2510.10073","title":"SecureWebArena: A Holistic Security Evaluation Benchmark for LVLM-based Web Agents","created":"2025-10-11","cited_by_count":19,"area":"agents"},{"id":"2601.17549","title":"Breaking the Protocol: Security Analysis of the Model Context Protocol Specification and Prompt Injection Vulnerabilities in Tool-Integrated LLM Agents","created":"2026-01-24","cited_by_count":19,"area":"agents"},{"id":"2603.15727","title":"AgentWorm: Self-Propagating Attacks Across LLM Agent Ecosystems","created":"2026-03-16","cited_by_count":17,"area":"agents"},{"id":"2505.23559","title":"SafeScientist: Toward Risk-Aware Scientific Discoveries by LLM Agents","created":"2025-05-29","cited_by_count":16,"area":"agents"},{"id":"2512.04864","title":"Are Your Agents Upward Deceivers?","created":"2025-12-04","cited_by_count":16,"area":"agents"},{"id":"2401.05998","title":"Combating Adversarial Attacks with Multi-Agent Debate","created":"2024-01-11","cited_by_count":15,"area":"agents"},{"id":"2505.12567","title":"A Survey of Attacks on Large Language Models","created":"2025-05-18","cited_by_count":15,"area":"agents"},{"id":"2408.02205","title":"Swiss Cheese Model for AI Safety: A Taxonomy and Reference Architecture for Multi-Layered Guardrails of Foundation Model Based Agents","created":"2024-08-05","cited_by_count":14,"area":"agents"},{"id":"2504.08848","title":"X-Guard: Multilingual Guard Agent for Content Moderation","created":"2025-04-11","cited_by_count":13,"area":"agents"},{"id":"2506.00781","title":"CoP: Agentic Red-teaming for Large Language Models using Composition of Principles","created":"2025-06-01","cited_by_count":13,"area":"agents"},{"id":"2604.02837","title":"Towards Secure Agent Skills: Architecture, Threat Taxonomy, and Security Analysis","created":"2026-04-03","cited_by_count":13,"area":"agents"},{"id":"2605.28914","title":"AIRGuard: Guarding Agent Actions with Runtime Authority Control","created":"2026-05-27","cited_by_count":13,"area":"agents"},{"id":"2506.15170","title":"From LLMs to MLLMs to Agents: A Survey of Emerging Paradigms in Jailbreak Attacks and Defenses within LLM Ecosystem","created":"2025-06-18","cited_by_count":12,"area":"agents"},{"id":"2509.14285","title":"A Multi-Agent LLM Defense Pipeline Against Prompt Injection Attacks","created":"2025-09-16","cited_by_count":11,"area":"agents"},{"id":"2509.22256","title":"Secure and Efficient Access Control for Computer-Use Agents via Context Space","created":"2025-09-26","cited_by_count":11,"area":"agents"},{"id":"2512.06914","title":"SoK: Trust-Authorization Mismatch in LLM Agent Interactions","created":"2025-12-07","cited_by_count":11,"area":"agents"},{"id":"2412.01547","title":"Improved Large Language Model Jailbreak Detection via Pretrained Embeddings","created":"2024-12-02","cited_by_count":10,"area":"agents"},{"id":"2602.07398","title":"AgentSys: Secure and Dynamic LLM Agents Through Explicit Hierarchical Memory Management","created":"2026-02-07","cited_by_count":10,"area":"agents"},{"id":"2607.06000","title":"Context-to-Execution Integrity for LLM Agents","created":"2026-07-07","cited_by_count":10,"area":"agents"},{"id":"2505.20824","title":"MedSentry: Understanding and Mitigating Safety Risks in Medical LLM Multi-Agent Systems","created":"2025-05-27","cited_by_count":9,"area":"agents"},{"id":"2506.07524","title":"TAI3: Testing Agent Integrity in Interpreting User Intent","created":"2025-06-09","cited_by_count":9,"area":"agents"},{"id":"2508.14031","title":"Unintended Misalignment from Agentic Fine-Tuning: Risks and Mitigation","created":"2025-08-19","cited_by_count":9,"area":"agents"},{"id":"2509.13597","title":"Agentic JWT: A Secure Delegation Protocol for Autonomous AI Agents","created":"2025-09-16","cited_by_count":9,"area":"agents"},{"id":"2510.01670","title":"Just Do It!? Computer-Use Agents Exhibit Blind Goal-Directedness","created":"2025-10-02","cited_by_count":9,"area":"agents"},{"id":"2511.09710","title":"Echoing: Identity Failures when LLM Agents Talk to Each Other","created":"2025-11-12","cited_by_count":9,"area":"agents"},{"id":"2504.01278","title":"Strategize Globally, Adapt Locally: A Multi-Turn Red Teaming Agent with Dual-Level Learning","created":"2025-04-02","cited_by_count":8,"area":"agents"},{"id":"2505.04345","title":"Build Agent Advocates, Not Platform Agents","created":"2025-05-07","cited_by_count":8,"area":"agents"},{"id":"2505.18397","title":"An Outlook on the Opportunities and Challenges of Multi-Agent AI Systems","created":"2025-05-23","cited_by_count":8,"area":"agents"},{"id":"2505.21550","title":"Position: Collaborative Agentic AI Needs Interoperability Across Ecosystems","created":"2025-05-25","cited_by_count":8,"area":"agents"},{"id":"2511.10949","title":"Exposing Weak Links in Multi-Agent Systems under Adversarial Prompting","created":"2025-11-14","cited_by_count":8,"area":"agents"},{"id":"2601.04034","title":"HoneyTrap: Deceiving Large Language Model Attackers to Honeypot Traps with Resilient Multi-Agent Defense","created":"2026-01-07","cited_by_count":8,"area":"agents"},{"id":"2605.11882","title":"On-Policy Self-Evolution via Failure Trajectories for Agentic Safety Alignment","created":"2026-05-12","cited_by_count":8,"area":"agents"},{"id":"2502.20757","title":"The Rise of Darkness: Safety-Utility Trade-Offs in Role-Playing Dialogue Agents","created":"2025-02-28","cited_by_count":7,"area":"agents"},{"id":"2601.07853","title":"FinVault: Benchmarking Financial Agent Safety in Execution-Grounded Environments","created":"2026-01-09","cited_by_count":7,"area":"agents"},{"id":"2601.17887","title":"When Personalization Legitimizes Risks: Uncovering Safety Vulnerabilities in Personalized Dialogue Agents","created":"2026-01-25","cited_by_count":7,"area":"agents"},{"id":"2603.20320","title":"The Causal Impact of Tool Affordance on Safety Alignment in LLM Agents","created":"2026-03-19","cited_by_count":7,"area":"agents"},{"id":"2505.17735","title":"SafeAgent: Safeguarding LLM Agents via an Automated Risk Simulator","created":"2025-05-23","cited_by_count":6,"area":"agents"},{"id":"2602.16958","title":"Automating Agent Hijacking via Structural Template Injection","created":"2026-02-18","cited_by_count":6,"area":"agents"},{"id":"2602.22303","title":"Training Agents to Self-Report Misbehavior","created":"2026-02-25","cited_by_count":6,"area":"agents"},{"id":"2603.22341","title":"T-MAP: Red-Teaming LLM Agents with Trajectory-aware Evolutionary Search","created":"2026-03-21","cited_by_count":6,"area":"agents"},{"id":"2606.10106","title":"What makes a harness a harness: necessary and sufficient conditions for an agent harness","created":"2026-06-08","cited_by_count":6,"area":"agents"},{"id":"2409.11393","title":"LLM-Agent-UMF: LLM-based Agent Unified Modeling Framework for Seamless Design of Multi Active/Passive Core-Agent Architectures","created":"2024-09-17","cited_by_count":5,"area":"agents"},{"id":"2504.13707","title":"OpenDeception: Learning Deception and Trust in Human-AI Interaction via Multi-Agent Simulation","created":"2025-04-18","cited_by_count":5,"area":"agents"},{"id":"2506.07153","title":"Mind the Web: The Security of Web Use Agents","created":"2025-06-08","cited_by_count":5,"area":"agents"},{"id":"2507.08207","title":"Toward a Dynamic Stackelberg Game-Theoretic Framework for Agentic AI Defense Against LLM Jailbreaking","created":"2025-07-10","cited_by_count":5,"area":"agents"},{"id":"2509.18557","title":"LLMZ+: Contextual Prompt Whitelist Principles for Agentic LLMs","created":"2025-09-23","cited_by_count":5,"area":"agents"},{"id":"2510.14133","title":"Formalizing the Safety, Security, and Functional Properties of Agentic AI Systems","created":"2025-10-15","cited_by_count":5,"area":"agents"},{"id":"2510.16558","title":"A First Look at the Security Issues in the Model Context Protocol Ecosystem","created":"2025-10-18","cited_by_count":5,"area":"agents"},{"id":"2604.15559","title":"Subliminal Transfer of Unsafe Behaviors in AI Agent Distillation","created":"2026-04-16","cited_by_count":5,"area":"agents"},{"id":"2604.20911","title":"Omission Constraints Decay While Commission Constraints Persist in Long-Context LLM Agents","created":"2026-04-22","cited_by_count":5,"area":"agents"},{"id":"2412.10807","title":"Towards Action Hijacking of Large Language Model-based Agent","created":"2024-12-14","cited_by_count":4,"area":"agents"},{"id":"2503.02976","title":"Teaching AI to Handle Exceptions: Supervised Fine-Tuning with Human-Aligned Judgment","created":"2025-03-04","cited_by_count":4,"area":"agents"},{"id":"2506.02859","title":"ATAG: AI-Agent Application Threat Assessment with Attack Graphs","created":"2025-06-03","cited_by_count":4,"area":"agents"},{"id":"2506.22557","title":"MetaCipher: A Time-Persistent and Universal Multi-Agent Framework for Cipher-Based Jailbreak Attacks for LLMs","created":"2025-06-27","cited_by_count":4,"area":"agents"},{"id":"2509.23694","title":"SafeSearch: Automated Red-Teaming of LLM-Based Search Agents","created":"2025-09-28","cited_by_count":4,"area":"agents"},{"id":"2509.25271","title":"RADAR: A Risk-Aware Dynamic Multi-Agent Framework for LLM Safety Evaluation via Role-Specialized Collaboration","created":"2025-09-28","cited_by_count":4,"area":"agents"},{"id":"2601.21233","title":"Just Ask: Curious Code Agents Reveal System Prompts in Frontier LLMs","created":"2026-01-29","cited_by_count":4,"area":"agents"},{"id":"2602.10465","title":"Authenticated Workflows: A Systems Approach to Protecting Agentic AI","created":"2026-02-11","cited_by_count":4,"area":"agents"},{"id":"2603.25747","title":"BeSafe-Bench: Unveiling Behavioral Safety Risks of Situated Agents in Functional Environments","created":"2026-01-30","cited_by_count":4,"area":"agents"},{"id":"2604.10134","title":"PlanGuard: Defending Agents against Indirect Prompt Injection via Planning-based Consistency Verification","created":"2026-04-11","cited_by_count":4,"area":"agents"},{"id":"2605.05704","title":"SafeHarbor: Defining Precise Decision Boundaries via Hierarchical Memory-Augmented Guardrail for LLM Agent Safety","created":"2026-05-07","cited_by_count":4,"area":"agents"},{"id":"2605.15030","title":"WARD: Adversarially Robust Defense of Web Agents Against Prompt Injections","created":"2026-05-14","cited_by_count":4,"area":"agents"},{"id":"2605.24134","title":"ProofAgent Harness: Open Infrastructure for Adversarial Evaluation of AI Agents","created":"2026-05-22","cited_by_count":4,"area":"agents"}],"next_cursor":"100"}