mlsanityData to 14 Oct 2026

Mind the Gap: Evaluating Model- and Agentic-Level Vulnerabilities in LLMs with Action Graphs

arXiv 2509.04802 ↗First posted 5 Sep 2025cs.CLcited by 0

On the map: LLM agents and tool use → Agent threats, guardrails and governance

also in 1 more
Abstract (arXiv)

As large language models increasingly deployed into agentic systems, existing methods face critical gaps in observing, assessing, and mitigating deployment-specific risks. We present a comprehensive, observability-driven workflow: we introduce AgentSeer, observability tool which decomposes agentic executions into granular action-component graphs; we use this decomposition to rigorously quantify the gap between model-level and agent-level jailbreaking risk via cross-model validation on GPT-OSS-20B and Gemini-2.0-flash with HarmBench under single-turn and iterative-refinement attacks; we leverage action-graph risk signals to automate iterative prompt hardening against direct and iterative jailbreak attacks. Stark differences is revealed between model-level and agentic-level vulnerability profiles. Model-level evaluation reveals baseline differences: GPT-OSS-20B (39.47% ASR) versus Gemini-2.0-flash (50.00% ASR), with both models showing susceptibility to social engineering. However, agentic-level assessment exposes agent-specific risks invisible to traditional evaluation. We discover "agentic-only" vulnerabilities that emerge exclusively in agentic contexts, with tool-calling showing 24-60% higher ASR across both models. Cross-model analysis reveals universal agentic patterns, where agent transfer operations as highest-risk tools, with semantic pattern revealed rather than syntactic vulnerability mechanisms. Direct attack transfer from model-level to agentic contexts shows degraded performance of successful prompts (GPT-OSS-20B: 57% human injection ASR; Gemini-2.0-flash: 28%), while context-aware iterative attacks successfully compromise objectives that failed at model-level, confirming systematic vulnerabilities gaps. Action-based prompt improvement substantially reduces action-averaged agentic jailbreak success on GPT-OSS-20B (direct: 45.3%

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 17 of its 20 references that are in the map. First posted on arXiv 5 Sep 2025.

Builds on

17 of 20 references.

Closest ancestors · 5

Same direction, newest first

  1. 2025A Survey on Trustworthy LLM Agents: Threats and Countermeasures12 Mar
  2. 2025In-Context Defense in Computer Agents: An Empirical Study12 Mar
  3. 2024AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agents11 Oct
  4. 2024AgentPoison: Red-teaming LLM Agents via Poisoning Memory or Knowledge Bases17 Jul
  5. 2024Watch Out for Your Agents! Investigating Backdoor Threats to LLM-Based Agents17 Feb

Other references · 12

  1. 2022ReAct: Synergizing Reasoning and Acting in Language Modelscited by 8,695
  2. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 3,104
  3. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,429
  4. 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,420
  5. 2023Gorilla: Large Language Model Connected with Massive APIscited by 1,332
  6. 2023AgentBench: Evaluating LLMs as Agentscited by 1,267
  7. 2024OpenHands: An Open Platform for AI Software Developers as Generalist Agentscited by 1,002
  8. 2023SmoothLLM: Defending Large Language Models Against Jailbreaking Attackscited by 469
  9. 2023Jailbreak and Guard Aligned Language Models with Only Few In-Context Demonstrationscited by 431
  10. 2024A StrongREJECT for Empty Jailbreakscited by 385
  11. 2023Multi-Agent Collaboration: Harnessing the Power of Intelligent LLM Agentscited by 333
  12. 2024AI Agents Under Threat: A Survey of Key Security Challenges and Future Pathwayscited by 127

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2026LITMUS: Benchmarking Behavioral Jailbreaks of LLM Agents in Real OS Environments
  2. 2026On Understanding, Identifying, and Mitigating Vulnerabilities in Agentic Large Language Models
  3. 2025Mind the Gap: Comparing Model- vs Agentic-Level Red Teaming with Action-Graph Observability on GPT-OSS-20B
  4. 2025From LLMs to MLLMs to Agents: A Survey of Emerging Paradigms in Jailbreak Attacks and Defenses within LLM Ecosystem
  5. 2026The Landscape of Prompt Injection Threats in LLM Agents: From Taxonomy to Analysis
  6. 2025Evaluating Multi-Agent Defences Against Jailbreaking Attacks on Large Language Models
  7. 2025Bridging AI and Software Security: A Comparative Vulnerability Assessment of LLM Agent Deployment Paradigms
  8. 2026Assessing Automated Prompt Injection Attacks in Agentic Environments