{"total":71,"rows":[{"id":"2602.16901","title":"AgentLAB: Benchmarking LLM Agents against Long-Horizon Attacks","created":"2026-02-18","cited_by_count":39,"area":"agents"},{"id":"2512.15163","title":"MCP-SafetyBench: A Benchmark for Safety Evaluation of Large Language Models with Real-World MCP Servers","created":"2025-12-17","cited_by_count":34,"area":"agents"},{"id":"2508.19461","title":"Reliable Weak-to-Strong Monitoring of LLM Agents","created":"2025-08-26","cited_by_count":31,"area":"agents"},{"id":"2604.02623","title":"Poison Once, Exploit Forever: Environment-Injected Memory Poisoning Attacks on Web Agents","created":"2026-04-03","cited_by_count":24,"area":"agents"},{"id":"2510.19851","title":"Can Reasoning Models Obfuscate Reasoning? Stress-Testing Chain-of-Thought Monitorability","created":"2025-10-21","cited_by_count":22,"area":"lr"},{"id":"2512.13526","title":"Async Control: Stress-testing Asynchronous Control Measures for LLM Agents","created":"2025-12-15","cited_by_count":22,"area":"agents"},{"id":"2603.01608","title":"Evaluating and Understanding Scheming Propensity in LLM Agents","created":"2026-03-02","cited_by_count":14,"area":"agents"},{"id":"2604.11806","title":"Detecting Safety Violations Across Many Agent Traces","created":"2026-04-13","cited_by_count":14,"area":null},{"id":"2508.07935","title":"SHIELDA: Structured Handling of Exceptions in LLM-Driven Agentic Workflows","created":"2025-08-11","cited_by_count":13,"area":"agents"},{"id":"2605.04808","title":"DecodingTrust-Agent Platform (DTap): A Controllable and Interactive Red-Teaming Platform for AI Agents","created":"2026-05-06","cited_by_count":13,"area":"safety"},{"id":"2606.07157","title":"Think Fast: Estimating No-CoT Task-Completion Time Horizons of Frontier AI Models","created":"2026-06-05","cited_by_count":12,"area":"lr"},{"id":"2511.02997","title":"Evaluating Control Protocols for Untrusted AI Agents","created":"2025-11-04","cited_by_count":11,"area":"safety"},{"id":"2605.08715","title":"AgentForesight: Online Auditing for Early Failure Prediction in Multi-Agent Systems","created":"2026-05-09","cited_by_count":11,"area":"agents"},{"id":"2512.24661","title":"Do Large Language Models Know What They Are Capable Of?","created":"2025-12-31","cited_by_count":10,"area":null},{"id":"2601.06663","title":"SafePro: Evaluating the Safety of Professional-Level AI Agents","created":"2026-01-10","cited_by_count":10,"area":"agents"},{"id":"2512.00218","title":"Reasoning Under Pressure: How do Training Incentives Influence Chain-of-Thought Monitorability?","created":"2025-11-28","cited_by_count":9,"area":"lr"},{"id":"2602.13477","title":"OMNI-LEAK: Orchestrator Multi-Agent Network Induced Data Leakage","created":"2026-02-13","cited_by_count":9,"area":"agents"},{"id":"2604.19784","title":"Peer-Preservation in Frontier Models","created":"2026-03-30","cited_by_count":9,"area":null},{"id":"2509.25624","title":"STAC: When Innocent Tools Form Dangerous Chains for LLM Agents","created":"2025-09-30","cited_by_count":8,"area":"agents"},{"id":"2510.09714","title":"All Code, No Thought: Current Language Models Struggle to Reason in Ciphered Language","created":"2025-10-10","cited_by_count":8,"area":"lr"},{"id":"2603.28590","title":"MonitorBench: A Comprehensive Benchmark for Chain-of-Thought Monitorability in Large Language Models","created":"2026-03-30","cited_by_count":8,"area":"lr"},{"id":"2604.15384","title":"LinuxArena: A Control Setting for AI Agents in Live Production Software Environments","created":"2026-04-16","cited_by_count":8,"area":"agents"},{"id":"2601.22136","title":"StepShield: When, Not Whether to Intervene on Rogue Agents","created":"2026-01-29","cited_by_count":7,"area":"safety"},{"id":"2603.16928","title":"Noticing the Watcher: LLM Agents Can Infer CoT Monitoring from Blocking Feedback","created":"2026-03-14","cited_by_count":7,"area":"lr"},{"id":"2605.03228","title":"Safeguarding LLM Agents against Long-Horizon Threats via Shadow Memory","created":"2026-05-04","cited_by_count":7,"area":"agents"},{"id":"2511.02823","title":"Optimizing AI Agent Attacks With Synthetic Data","created":"2025-11-04","cited_by_count":6,"area":null},{"id":"2602.04930","title":"Attack Selection Reduces Safety in Concentrated AI Control Settings against Trusted Monitoring","created":"2026-02-04","cited_by_count":6,"area":"safety"},{"id":"2602.22303","title":"Training Agents to Self-Report Misbehavior","created":"2026-02-25","cited_by_count":6,"area":"agents"},{"id":"2607.02514","title":"Distributed Attacks in Persistent-State AI Control","created":"2026-07-02","cited_by_count":5,"area":"agents"},{"id":"2605.09684","title":"MonitoringBench: Semi-Automated Red-Teaming for Agent Monitoring","created":"2026-05-10","cited_by_count":4,"area":"agents"},{"id":"2605.16282","title":"Taxonomy and Consistency Analysis of Safety Benchmarks for AI Agents","created":"2026-04-11","cited_by_count":4,"area":"agents"},{"id":"2605.29601","title":"Training Deliberative Monitors for Black-Box Scheming Detection","created":"2026-05-28","cited_by_count":4,"area":null},{"id":"2606.05647","title":"Coding with \"Enemy\": Can Human Developers Detect AI Agent Sabotage?","created":"2026-06-04","cited_by_count":4,"area":"agents"},{"id":"2609.00069","title":"Auditing Harness Tampering in Self-Improving Agents","created":"2026-08-30","cited_by_count":4,"area":"synth"},{"id":"2602.10153","title":"Basic Legibility Protocols Improve Trusted Monitoring","created":"2026-02-09","cited_by_count":3,"area":"safety"},{"id":"2604.20995","title":"Value-Conflict Diagnostics Reveal Widespread Alignment Faking in Language Models","created":"2026-04-22","cited_by_count":3,"area":null},{"id":"2606.11063","title":"CIAware-Bench: Benchmarking Control Intervention Awareness Across Frontier LLMs","created":"2026-06-09","cited_by_count":3,"area":null},{"id":"2509.21344","title":"Linear probes rely on textual evidence: Results from leakage mitigation studies in language models","created":"2025-09-16","cited_by_count":2,"area":"mechinterp"},{"id":"2511.04707","title":"Jailbreaking in the Haystack","created":"2025-11-05","cited_by_count":2,"area":"agents"},{"id":"2606.17478","title":"Decoding Hidden Deception in Reasoning LLMs: Activation Explainers for Deception Auditing","created":"2026-06-16","cited_by_count":2,"area":"lr"},{"id":"2607.19321","title":"ResearchArena: Evaluating Sabotage and Monitoring in Automated AI R&D","created":"2026-07-21","cited_by_count":2,"area":null},{"id":"2608.04735","title":"Chain-of-Thought Monitoring Can Be Unreliable in Implicit-Influence Settings","created":"2026-08-05","cited_by_count":2,"area":"lr"},{"id":"2609.00038","title":"trajectory-judge: What Outcome-Only LLM Judges Miss on Agent Trajectories","created":"2026-08-29","cited_by_count":2,"area":"agents"},{"id":"2606.04413","title":"(Mis)generalization of Helpful-only Fine-tuning","created":"2026-06-03","cited_by_count":1,"area":null},{"id":"2606.06529","title":"Attack Selection in Agentic AI Control Evaluations Meaningfully Decreases Safety","created":"2026-06-03","cited_by_count":1,"area":"agents"},{"id":"2606.12429","title":"Muse Spark Safety & Preparedness Report","created":"2026-05-14","cited_by_count":1,"area":null},{"id":"2606.24251","title":"Probing the Misaligned Thinking Process of Language Models","created":"2026-06-23","cited_by_count":1,"area":"lr"},{"id":"2607.06596","title":"Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages","created":"2026-07-06","cited_by_count":1,"area":null},{"id":"2608.29464","title":"Chain-of-Thought Faithfulness of Reasoning Models Varies with Where and How Preference Cues Are Delivered","created":"2026-08-29","cited_by_count":1,"area":"lr"},{"id":"2604.24966","title":"Risk Reporting for Developers' Internal AI Model Use","created":"2026-04-27","cited_by_count":0,"area":null},{"id":"2605.12746","title":"CoT-Guard: Small Models for Strong Monitoring","created":"2026-05-12","cited_by_count":0,"area":"lr"},{"id":"2605.24216","title":"Agent-ToM: Learning to Monitor Autonomous LLM Agents via Theory-of-Mind Reasoning","created":"2026-05-22","cited_by_count":0,"area":"lr"},{"id":"2607.13453","title":"Adversarial Prompting Framework for AI Safety Assessment","created":"2026-07-15","cited_by_count":0,"area":"safety"},{"id":"2608.23763","title":"TrustShiftProbe: Characterizing, Benchmarking, and Defending Staged Trust Attacks on MCP Servers","created":"2026-08-24","cited_by_count":0,"area":"agents"},{"id":"2609.06140","title":"Counter-Swarm Doctrine: Containing Coordinated Agent Intrusions","created":"2026-09-05","cited_by_count":0,"area":null},{"id":"2609.06966","title":"MOLE: Detecting Insider Threats in AI Agents","created":"2026-09-07","cited_by_count":0,"area":"safety"},{"id":"2609.08126","title":"SchemeArena: Factorized Stress Testing of Scheming in LLM Agents","created":"2026-09-08","cited_by_count":0,"area":"agents"},{"id":"2609.19587","title":"Red-Teaming Auto Mode: Improving Blocking Classifiers Against Malign Coding Agents","created":"2026-09-17","cited_by_count":0,"area":"agents"},{"id":"2609.23700","title":"When the Agent Becomes the Kernel: A Systematization of Security on the Path to AI-Native Operating Systems","created":"2026-09-20","cited_by_count":0,"area":"agents"},{"id":"2609.27336","title":"CART: Closed-Loop Adaptive Red Teaming for Large Language Models","created":"2026-09-23","cited_by_count":0,"area":"safety"},{"id":"2609.30383","title":"Stealth Apart, Harm Together: Skill Cascading Attacks on Skill-Based Agent Systems","created":"2026-09-24","cited_by_count":0,"area":"agents"},{"id":"2609.33295","title":"TraceDance: An Automated System for Building Agent Behavior Benchmarks from Real-World Agent Deployment Traces","created":"2026-09-27","cited_by_count":0,"area":"agents"},{"id":"2609.36139","title":"Language Models Are \"Insecure\" Reporters","created":"2026-09-28","cited_by_count":0,"area":null},{"id":"2609.37312","title":"Hidden Reasoning Must Leak, but Need Not Be Readable: Fundamental Opportunities and Limits for Chain-of-Thought Monitoring","created":"2026-09-29","cited_by_count":0,"area":"lr"},{"id":"2609.38291","title":"HARDE: Optimizing Agent Harnesses for Runtime Risk Detection and Execution Control","created":"2026-09-29","cited_by_count":0,"area":"agents"},{"id":"2610.02920","title":"HASTE: Evolving Agent Harnesses Against Emerging Attacks Using Sparse Evidence","created":"2026-10-02","cited_by_count":0,"area":null},{"id":"2610.04083","title":"Self-Propagating Misalignment in LLM Agents, and Why Auditing or Disabling Memory Is Not Enough","created":"2026-10-02","cited_by_count":0,"area":"agents"},{"id":"2610.04378","title":"COPEX: Benchmarking LLM Robustness to Adversarial Context Across Model Context Protocol Layers","created":"2026-10-03","cited_by_count":0,"area":"agents"},{"id":"2610.07089","title":"Towards a Unified Misuse Monitoring Benchmark","created":"2026-10-05","cited_by_count":0,"area":"agents"},{"id":"2610.12445","title":"Caught in the Act: Probes Effectively Detect Sabotage and Catch Unverbalized Deception","created":"2026-10-08","cited_by_count":0,"area":"agents"},{"id":"2610.17727","title":"SkillScreen: High-Recall Screening of Malicious Agent Skills with Decision Models","created":"2026-10-13","cited_by_count":0,"area":"agents"}],"next_cursor":null}