SafeAgent: Safeguarding LLM Agents via an Automated Risk Simulator
On the map: LLM agents and tool use → Agent threats, guardrails and governance
Abstract (arXiv)
Large Language Model (LLM)-based agents are increasingly deployed in real-world applications such as "digital assistants, autonomous customer service, and decision-support systems", where their ability to "interact in multi-turn, tool-augmented environments" makes them indispensable. However, ensuring the safety of these agents remains a significant challenge due to the diverse and complex risks arising from dynamic user interactions, external tool usage, and the potential for unintended harmful behaviors. To address this critical issue, we propose AutoSafe, the first framework that systematically enhances agent safety through fully automated synthetic data generation. Concretely, 1) we introduce an open and extensible threat model, OTS, which formalizes how unsafe behaviors emerge from the interplay of user instructions, interaction contexts, and agent actions. This enables precise modeling of safety risks across diverse scenarios. 2) we develop a fully automated data generation pipeline that simulates unsafe user behaviors, applies self-reflective reasoning to generate safe responses, and constructs a large-scale, diverse, and high-quality safety training dataset-eliminating the need for hazardous real-world data collection. To evaluate the effectiveness of our framework, we design comprehensive experiments on both synthetic and real-world safety benchmarks. Results demonstrate that AutoSafe boosts safety scores by 45% on average and achieves a 28.91% improvement on real-world tasks, validating the generalization ability of our learned safety strategies. These results highlight the practical advancement and scalability of AutoSafe in building safer LLM-based agents for real-world deployment. We have released the project page at https://auto-safe.github.io/.
Key facts. Cited by 6 papers in the map (data through 14 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 33 of its 40 references that are in the map. First posted on arXiv 23 May 2025.
Builds on
33 of 40 references.
Closest ancestors · 15
Same direction, newest first
- 2024SafeAgentBench: A Benchmark for Safe Task Planning of Embodied LLM Agents17 Dec
- 2024Attacking Vision-Language Computer Agents via Pop-ups4 Nov
- 2024AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agents11 Oct
- 2024EIA: Environmental Injection Attack on Generalist Web Agents for Privacy Leakage17 Sep
- 2024AgentPoison: Red-teaming LLM Agents via Poisoning Memory or Knowledge Bases17 Jul
- 2024AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents19 Jun
- 2024GuardAgent: Safeguard LLM Agents by a Guard Agent via Knowledge-Enabled Reasoning13 Jun
- 2024InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents5 Mar
- 2024Watch Out for Your Agents! Investigating Backdoor Threats to LLM-Based Agents17 Feb
- 2024TrustAgent: Towards Safe and Trustworthy LLM-based Agents2 Feb
- 2024R-Judge: Benchmarking Safety Risk Awareness for LLM Agents18 Jan
- 2023Evil Geniuses: Delving into the Safety of LLM-based Agents20 Nov
3 more
Other references · 18
- 2023GPT-4 Technical Reportcited by 18,396
- 2024The Llama 3 Herd of Modelscited by 14,715
- 2022ReAct: Synergizing Reasoning and Acting in Language Modelscited by 8,695
- 2023Judging LLM-as-a-Judge with MT-Bench and Chatbot Arenacited by 8,626
- 2023Direct Preference Optimization: Your Language Model is Secretly a Reward Modelcited by 8,065
- 2024GPT-4o System Cardcited by 4,588
- 2023Reflexion: Language Agents with Verbal Reinforcement Learningcited by 4,276
- 2023Toolformer: Language Models Can Teach Themselves to Use Toolscited by 4,182
- 2022Training a Helpful and Harmless Assistant with Reinforcement Learning from Human Feedbackcited by 3,720
- 2023Jailbroken: How Does LLM Safety Training Fail?cited by 1,651
- 2024ChatGLM: A Family of Large Language Models from GLM-130B to GLM-4 All Toolscited by 1,121
- 2023BeaverTails: Towards Improved Safety Alignment of LLM via a Human-Preference Datasetcited by 860
6 more
- 2023A Survey on Large Language Model (LLM) Security and Privacy: The Good, the Bad, and the Uglycited by 387
- 2023ToRA: A Tool-Integrated Reasoning Agent for Mathematical Problem Solvingcited by 282
- 2024Agent Hospital: A Simulacrum of Hospital with Evolvable Medical Agentscited by 218
- 2023Defending Against Alignment-Breaking Attacks via Robustly Aligned LLMcited by 192
- 2024How (un)ethical are instruction-centric responses of LLMs? Unveiling the vulnerabilities of safety guardrails to harmful queriescited by 27
- 2025Align-Pro: A Principled Approach to Prompt Optimization for LLM Alignmentcited by 18
Built on by
Citing papers per year: 2025: 2; 2026: 4.
6 papers.
- 2025A Survey of Self-Evolving Agents: What, When, How, and Where to Evolve on the Path to Artificial Super Intelligencecited by 170
- 2025Check Yourself Before You Wreck Yourself: Selectively Quitting Improves LLM Agent Safetycited by 12
- 2026Learning When to Act or Refuse: Guarding Agentic Reasoning Models for Safe Multi-Step Tool Usecited by 8
- 2026Simulating Complex Multi-Turn Tool Calling Interactions in Stateless Execution Environmentscited by 3
- 2026How Well Can LLM Agents Simulate End-User Security and Privacy Attitudes and Behaviors?cited by 3
- 2026Reassembling Distributed Risk: Trajectory-Conditioned Action Generation for Multi-Turn Agent Safetycited by 0
- 2026Reassembling Distributed Risk: Trajectory-Conditioned Action Generation for Multi-Turn Agent Safety26 Aug 2026
- 2026Learning When to Act or Refuse: Guarding Agentic Reasoning Models for Safe Multi-Step Tool Use3 Mar 2026
- 2026How Well Can LLM Agents Simulate End-User Security and Privacy Attitudes and Behaviors?6 Feb 2026
- 2026Simulating Complex Multi-Turn Tool Calling Interactions in Stateless Execution Environments6 Jan 2026
- 2025Check Yourself Before You Wreck Yourself: Selectively Quitting Improves LLM Agent Safety18 Oct 2025
- 2025A Survey of Self-Evolving Agents: What, When, How, and Where to Evolve on the Path to Artificial Super Intelligence28 Jul 2025
Similar, not cited
Close in wording, no citation either way
- 2024Agent-SafetyBench: Evaluating the Safety of LLM Agents
- 2025Personalized Safety in LLMs: A Benchmark and A Planning-Based Agent Approach
- 2024Concept-Guided LLM Agents for Human-AI Safety Codesign
- 2026ForesightSafety-SAGE:A Fully Automated Scenario Generation and Safety Evaluation Framework for LLM Agents
- 2025SafetyFlow: An Agent-Flow System for Automated LLM Safety Benchmarking
- 2025A Comprehensive Survey in LLM(-Agent) Full Stack Safety: Data, Training and Deployment
- 2025AgentAlign: Navigating Safety Alignment in the Shift from Informative to Agentic Large Language Models
- 2025Beyond Reactive Safety: Risk-Aware LLM Alignment via Long-Horizon Simulation