{"total":84,"rows":[{"id":"2407.12784","title":"AgentPoison: Red-teaming LLM Agents via Poisoning Memory or Knowledge Bases","created":"2024-07-17","cited_by_count":429,"area":"agents"},{"id":"2504.01990","title":"Advances and Challenges in Foundation Agents: From Brain-Inspired Intelligence to Evolutionary, Collaborative, and Safe Systems","created":"2025-03-31","cited_by_count":126,"area":"agents"},{"id":"2504.13203","title":"X-Teaming: Multi-Turn Jailbreaks and Defenses with Adaptive Multi-Agents","created":"2025-04-15","cited_by_count":125,"area":"agents"},{"id":"2406.12814","title":"Dissecting Adversarial Robustness of Multimodal LM Agents","created":"2024-06-18","cited_by_count":120,"area":"agents"},{"id":"2502.08966","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","created":"2025-02-13","cited_by_count":69,"area":"agents"},{"id":"2411.09523","title":"Navigating the Risks: A Survey of Security, Privacy, and Ethics Threats in LLM-Based Agents","created":"2024-11-14","cited_by_count":65,"area":"agents"},{"id":"2410.17401","title":"AdvAgent: Controllable Blackbox Red-teaming on Web Agents","created":"2024-10-22","cited_by_count":59,"area":"agents"},{"id":"2506.23260","title":"From Prompt Injections to Protocol Exploits: Threats in LLM-Powered AI Agents Workflows","created":"2025-06-29","cited_by_count":58,"area":"agents"},{"id":"2506.19676","title":"A Survey of LLM-Driven AI Agent Communication: Protocols, Security Risks, and Defense Countermeasures","created":"2025-06-24","cited_by_count":57,"area":"agents"},{"id":"2410.17520","title":"MobileSafetyBench: Evaluating Safety of Autonomous Agents in Mobile Device Control","created":"2024-10-23","cited_by_count":51,"area":"agents"},{"id":"2502.08586","title":"Commercial LLM Agents Are Already Vulnerable to Simple Yet Dangerous Attacks","created":"2025-02-12","cited_by_count":49,"area":"agents"},{"id":"2410.12855","title":"JAILJUDGE: A Comprehensive Jailbreak Judge Benchmark with Multi-Agent Enhanced Explanation Evaluation Framework","created":"2024-10-11","cited_by_count":47,"area":"agents"},{"id":"2407.16667","title":"RedAgent: Red Teaming Large Language Models with Context-aware Autonomous Language Agent","created":"2024-07-23","cited_by_count":44,"area":"agents"},{"id":"2407.20242","title":"BadRobot: Jailbreaking Embodied LLM Agents in the Physical World","created":"2024-07-16","cited_by_count":43,"area":"agents"},{"id":"2508.19461","title":"Reliable Weak-to-Strong Monitoring of LLM Agents","created":"2025-08-26","cited_by_count":31,"area":"agents"},{"id":"2601.17548","title":"Prompt Injection Attacks on Agentic Coding Assistants: A Systematic Analysis of Vulnerabilities in Skills, Tools, and Protocol Ecosystems","created":"2026-01-24","cited_by_count":31,"area":"agents"},{"id":"2505.24019","title":"LLM Agents Should Employ Security Principles","created":"2025-05-29","cited_by_count":29,"area":"agents"},{"id":"2408.00523","title":"Fuzz-Testing Meets LLM-Based Agents: An Automated and Efficient Framework for Jailbreaking Text-To-Image Generation Models","created":"2024-08-01","cited_by_count":27,"area":"agents"},{"id":"2506.13666","title":"We Should Identify and Mitigate Third-Party Safety Risks in MCP-Powered Agent Systems","created":"2025-06-16","cited_by_count":27,"area":"agents"},{"id":"2604.06811","title":"SkillTrojan: Backdoor Attacks on Skill-Based Agent Systems","created":"2026-04-08","cited_by_count":25,"area":"agents"},{"id":"2402.14859","title":"The Wolf Within: Covert Injection of Malice into MLLM Societies via an MLLM Operative","created":"2024-02-20","cited_by_count":21,"area":"agents"},{"id":"2603.15714","title":"How Vulnerable Are AI Agents to Indirect Prompt Injections? Insights from a Large-Scale Public Competition","created":"2026-03-16","cited_by_count":17,"area":"agents"},{"id":"2602.05746","title":"Learning to Inject: Automated Prompt Injection via Reinforcement Learning","created":"2026-02-05","cited_by_count":16,"area":"agents"},{"id":"2605.03378","title":"ARGUS: Defending LLM Agents Against Context-Aware Prompt Injection","created":"2026-05-05","cited_by_count":14,"area":"agents"},{"id":"2412.05734","title":"LeakAgent: RL-based Red-teaming Agent for LLM Privacy Leakage","created":"2024-12-07","cited_by_count":13,"area":"agents"},{"id":"2506.00781","title":"CoP: Agentic Red-teaming for Large Language Models using Composition of Principles","created":"2025-06-01","cited_by_count":13,"area":"agents"},{"id":"2602.20720","title":"AdapTools: Adaptive Tool-based Indirect Prompt Injection Attacks on Agentic LLMs","created":"2026-02-24","cited_by_count":13,"area":"agents"},{"id":"2503.23804","title":"DrunkAgent: Stealthy Memory Corruption in LLM-Powered Recommender Agents","created":"2025-03-31","cited_by_count":12,"area":"agents"},{"id":"2506.15170","title":"From LLMs to MLLMs to Agents: A Survey of Emerging Paradigms in Jailbreak Attacks and Defenses within LLM Ecosystem","created":"2025-06-18","cited_by_count":12,"area":"agents"},{"id":"2512.06914","title":"SoK: Trust-Authorization Mismatch in LLM Agent Interactions","created":"2025-12-07","cited_by_count":11,"area":"agents"},{"id":"2604.23338","title":"A Systematic Survey of Security Threats and Defenses in LLM-Based AI Agents: A Layered Attack Surface Framework","created":"2026-04-25","cited_by_count":11,"area":"agents"},{"id":"2602.07398","title":"AgentSys: Secure and Dynamic LLM Agents Through Explicit Hierarchical Memory Management","created":"2026-02-07","cited_by_count":10,"area":"agents"},{"id":"2506.07524","title":"TAI3: Testing Agent Integrity in Interpreting User Intent","created":"2025-06-09","cited_by_count":9,"area":"agents"},{"id":"2510.02609","title":"RedCodeAgent: Automatic Red-teaming Agent against Diverse Code Agents","created":"2025-10-02","cited_by_count":9,"area":"agents"},{"id":"2504.01278","title":"Strategize Globally, Adapt Locally: A Multi-Turn Red Teaming Agent with Dual-Level Learning","created":"2025-04-02","cited_by_count":8,"area":"agents"},{"id":"2504.03759","title":"Emerging Cyber Attack Risks of Medical AI Agents","created":"2025-04-02","cited_by_count":8,"area":"agents"},{"id":"2510.01359","title":"Breaking the Code: Security Assessment of AI Code Agents Through Systematic Jailbreaking Attacks","created":"2025-10-01","cited_by_count":7,"area":"agents"},{"id":"2605.11514","title":"FlowSteer: Prompt-Only Workflow Steering Exposes Planning-Time Vulnerabilities in Multi-Agent LLM Systems","created":"2026-05-12","cited_by_count":7,"area":"agents"},{"id":"2605.30883","title":"TRACE: Task-Aware Adaptive Self-Evolving Agentic Jailbreaking","created":"2026-05-29","cited_by_count":7,"area":"agents"},{"id":"2510.05159","title":"Malice in Agentland: Down the Rabbit Hole of Backdoors in the AI Supply Chain","created":"2025-10-03","cited_by_count":6,"area":"agents"},{"id":"2606.02540","title":"SkillHarm: Lifecycle-Aware Skill-Based Attacks via Automated Construction","created":"2026-06-01","cited_by_count":6,"area":"agents"},{"id":"2508.03864","title":"Evo-MARL: Co-Evolutionary Multi-Agent Reinforcement Learning for Internalized Safety","created":"2025-08-05","cited_by_count":4,"area":"agents"},{"id":"2509.25271","title":"RADAR: A Risk-Aware Dynamic Multi-Agent Framework for LLM Safety Evaluation via Role-Specialized Collaboration","created":"2025-09-28","cited_by_count":4,"area":"agents"},{"id":"2608.10218","title":"Mind Viruses: Self-Propagating Ideas in Multi-Agent LLM Systems","created":"2026-08-10","cited_by_count":4,"area":"agents"},{"id":"2510.17862","title":"When \"Correct\" Is Not Safe: Can We Trust Functionally Correct Patches Generated by Code Agents?","created":"2025-10-15","cited_by_count":3,"area":"agents"},{"id":"2510.21057","title":"Soft Instruction De-escalation Defense","created":"2025-10-24","cited_by_count":3,"area":"agents"},{"id":"2605.25389","title":"Evo-Attacker: Memory-Augmented Reinforcement Learning for Long-Horizon Tool Attacks on LLM-MAS","created":"2026-05-25","cited_by_count":3,"area":"agents"},{"id":"2511.04707","title":"Jailbreaking in the Haystack","created":"2025-11-05","cited_by_count":2,"area":"agents"},{"id":"2511.06396","title":"Efficient LLM Safety Evaluation through Multi-Agent Debate","created":"2025-11-09","cited_by_count":2,"area":"agents"},{"id":"2602.04431","title":"MaMa: A Game-Theoretic Approach for Designing Safe Agentic Systems","created":"2026-02-04","cited_by_count":2,"area":"agents"},{"id":"2602.13234","title":"Stay in Character, Stay Safe: Dual-Cycle Adversarial Self-Evolution for Safety Role-Playing Agents","created":"2026-01-29","cited_by_count":2,"area":"agents"},{"id":"2603.24203","title":"Invisible Threats from Model Context Protocol: Generating Stealthy Injection Payload via Tree-based Adaptive Search","created":"2026-03-25","cited_by_count":2,"area":"agents"},{"id":"2604.04060","title":"CoopGuard: Stateful Cooperative Agents Safeguarding LLMs Against Evolving Multi-Round Attacks","created":"2026-04-05","cited_by_count":2,"area":"agents"},{"id":"2604.22871","title":"AutoRISE: Agent-Driven Strategy Evolution for Red-Teaming Large Language Models","created":"2026-04-23","cited_by_count":2,"area":"agents"},{"id":"2605.11891","title":"Proteus: A Self-Evolving Red Team for Agent Skill Ecosystems","created":"2026-05-12","cited_by_count":2,"area":"agents"},{"id":"2606.18356","title":"SafeClawBench: Separating Semantic, Audit-Evidence, and Sandbox Harm in Tool-Using LLM Agents","created":"2026-06-16","cited_by_count":2,"area":"agents"},{"id":"2606.20470","title":"Analyzing Defensive Misdirection Against Model-Guided Automated Attacks on Agentic AI Systems","created":"2026-06-18","cited_by_count":2,"area":"agents"},{"id":"2607.11698","title":"Agent Hacks Agent: Autoresearch for Production-Agent Red-Teaming","created":"2026-07-13","cited_by_count":2,"area":"agents"},{"id":"2609.07529","title":"CoER: Defending against Adaptive Indirect Prompt Injection via Adversarial Co-Evolution and Refinement","created":"2026-09-07","cited_by_count":2,"area":"agents"},{"id":"2510.18131","title":"BlueCodeAgent: A Blue Teaming Agent Enabled by Automated Red Teaming for CodeGen AI","created":"2025-10-20","cited_by_count":1,"area":"agents"},{"id":"2512.08139","title":"Robust Agents in Open-Ended Worlds","created":"2025-12-09","cited_by_count":1,"area":"agents"},{"id":"2601.14660","title":"NeuroFilter: Activation-Based Guardrails for Privacy-Conscious LLM Agents","created":"2026-01-21","cited_by_count":1,"area":"agents"},{"id":"2602.05066","title":"Bypassing AI Control Protocols via Agent-as-a-Proxy Attacks","created":"2026-02-04","cited_by_count":1,"area":"agents"},{"id":"2602.07391","title":"NAAMSE: Framework for Evolutionary Security Evaluation of Agents","created":"2026-02-07","cited_by_count":1,"area":"agents"},{"id":"2603.01564","title":"From Secure Agentic AI to Secure Agentic Web: Challenges, Threats, and Future Directions","created":"2026-03-02","cited_by_count":1,"area":"agents"},{"id":"2603.20925","title":"Profit is the Red Team: Stress-Testing Agents in Strategic Economic Interactions","created":"2026-03-21","cited_by_count":1,"area":"agents"},{"id":"2607.03220","title":"CONTRA: Red-Teaming Configurations of Personalizable Agents","created":"2026-07-03","cited_by_count":1,"area":"agents"},{"id":"2607.05120","title":"Agent Data Injection Attacks are Realistic Threats to AI Agents","created":"2026-07-06","cited_by_count":1,"area":"agents"},{"id":"2510.03771","title":"OptAgent: Optimizing Query Rewriting for E-commerce via Multi-Agent Simulation","created":"2025-10-04","cited_by_count":0,"area":"agents"},{"id":"2602.00979","title":"GradingAttack: Exposing Security Vulnerabilities in LLM Based Educational Grading Agents","created":"2026-02-01","cited_by_count":0,"area":"agents"},{"id":"2602.16520","title":"Recursive language models for jailbreak detection: a procedural defense for tool-augmented agents","created":"2026-02-18","cited_by_count":0,"area":"agents"},{"id":"2604.01014","title":"AutoMIA: Improved Baselines for Membership Inference Attack via Agentic Self-Exploration","created":"2026-04-01","cited_by_count":0,"area":"agents"},{"id":"2605.07414","title":"OrchJail: Jailbreaking Tool-Calling Text-to-Image Agents by Orchestration-Guided Fuzzing","created":"2026-05-08","cited_by_count":0,"area":"agents"},{"id":"2605.16471","title":"From AI-Generated Content to Agentic Action: Security and Safety Threats in Generative AI","created":"2026-05-15","cited_by_count":0,"area":"agents"},{"id":"2605.18988","title":"Surviving the Unseen: Predictive Defense for Novel Multi-Turn Multimodal Attacks","created":"2026-05-18","cited_by_count":0,"area":"agents"},{"id":"2605.30677","title":"Investigating Detection and Obfuscation of Prompt Injection Attacks Against Software Reverse Engineering AI Agents","created":"2026-05-29","cited_by_count":0,"area":"agents"},{"id":"2608.00134","title":"Stateful Cooperative Agents Safeguarding LLMs Against Evolving Multi-Turn Attacks","created":"2026-07-31","cited_by_count":0,"area":"agents"},{"id":"2608.12977","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","created":"2026-08-13","cited_by_count":0,"area":"agents"},{"id":"2608.27439","title":"RedEvoAgent: Automatic Red-Teaming Agent with Experience-Driven Skill Evolution","created":"2026-08-27","cited_by_count":0,"area":"agents"},{"id":"2609.13731","title":"Trustworthy Agentic AI: A Comprehensive Cybersecurity and Systems Survey on Threat Landscapes, Defense Architectures, and Open Challenges","created":"2026-09-12","cited_by_count":0,"area":"agents"},{"id":"2609.15293","title":"Why LLM Agents Collapse Without Oversight: The Enforcement Gap as the Mechanism Behind Emergence World Failures","created":"2026-09-14","cited_by_count":0,"area":"agents"},{"id":"2609.34463","title":"CoDeL: Co-Evolutionary Defense against Indirect Prompt Injection in LLM-based Agents","created":"2026-09-28","cited_by_count":0,"area":"agents"},{"id":"2610.13886","title":"X-AgentRed: Red-Teaming Personal Agents in Evolving Multi-Service Ecosystems","created":"2026-10-09","cited_by_count":0,"area":"agents"},{"id":"2610.16426","title":"AuthGateBench: Benchmarking LLMs as Authorization Gate","created":"2026-10-12","cited_by_count":0,"area":"agents"}],"next_cursor":null}