mlsanityData to 14 Oct 2026

Deep Research Agents Brings Deeper Harm

arXiv 2510.11851 ↗First posted 13 Oct 2025cs.CR cs.CLcited by 2

On the map: LLM agents and tool use → Agent threats, guardrails and governance

Abstract (arXiv)

We reveal that Deep Research (DR) agents systematically expose safety risks: simply submitting harmful queries that a standalone LLM would reject outright can elicit detailed and dangerous reports from DR agents. Empirical analysis reveals that the advantages that make DR agents powerful unintentionally make them vulnerable: both the research role assignment (e.g., Planner) and the multi-step execution mechanism weaken alignment of the base LLM, leading to severe safety breaches. Through linear probe analysis of internal hidden states, we demonstrate that role assignment suppresses refusal awareness by shifting representations away from safety boundaries. Besides, multi-step execution distributes harmfulness across individual steps, preventing alignment mechanisms from being activated throughout the research process. Exploiting these vulnerabilities, we design Intent Hijack (i.e., rephrasing harmful queries as academic research) and Plan Injection (i.e., manipulating execution plans) to further examine the safety risks of DR agents. Extensive experiments show that our methods achieve near-perfect compliance and elicit detailed, actionable reports that significantly exceed standalone LLM outputs in technical depth and applicability. These results demonstrate alarming misalignment in DR agents and underscore the urgent need for tailored alignment techniques. Our code is available in https://schen.app/deeper-harm.

Key facts. Cited by 2 papers in the map (data through 14 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 32 of its 48 references that are in the map. First posted on arXiv 13 Oct 2025.

Builds on

32 of 48 references.

Closest ancestors · 3

Same direction, newest first

  1. 2025SafeScientist: Toward Risk-Aware Scientific Discoveries by LLM Agents29 May
  2. 2024JAILJUDGE: A Comprehensive Jailbreak Judge Benchmark with Multi-Agent Enhanced Explanation Evaluation Framework11 Oct
  3. 2024AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents19 Jun

Other references · 29

  1. 2023Reflexion: Language Agents with Verbal Reinforcement Learningcited by 4,276
  2. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 3,104
  3. 2025Search-R1: Training LLMs to Reason and Leverage Search Engines with Reinforcement Learningcited by 1,444
  4. 2024The AI Scientist: Towards Fully Automated Open-Ended Scientific Discoverycited by 1,071
  5. 2023Enhancing Chat Language Models by Scaling High-quality Instructional Conversationscited by 839
  6. 2024JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Modelscited by 536
  7. 2023XSTest: A Test Suite for Identifying Exaggerated Safety Behaviours in Large Language Modelscited by 505
  8. 2025Search-o1: Agentic Search-Enhanced Large Reasoning Modelscited by 433
  9. 2024A StrongREJECT for Empty Jailbreakscited by 385
  10. 2025R1-Searcher: Incentivizing the Search Capability in LLMs via Reinforcement Learningcited by 336
  11. 2025WebThinker: Empowering Large Reasoning Models with Deep Research Capabilitycited by 335
  12. 2025DeepResearcher: Scaling Deep Research via Reinforcement Learning in Real-world Environmentscited by 286
17 more
  1. 2025Agentic Retrieval-Augmented Generation: A Survey on Agentic RAGcited by 249
  2. 2024OR-Bench: An Over-Refusal Benchmark for Large Language Modelscited by 244
  3. 2024WildTeaming at Scale: From In-the-Wild Jailbreaks to (Adversarially) Safer Language Modelscited by 223
  4. 2025ZeroSearch: Incentivize the Search Capability of LLMs without Searchingcited by 208
  5. 2025WebDancer: Towards Autonomous Information Seeking Agencycited by 188
  6. 2023Take a Step Back: Evoking Reasoning via Abstraction in Large Language Modelscited by 159
  7. 2025Deep Research Agents: A Systematic Examination And Roadmapcited by 128
  8. 2025MMSearch-R1: Incentivizing LMMs to Searchcited by 124
  9. 2025WebWatcher: Breaking New Frontier of Vision-Language Deep Research Agentcited by 119
  10. 2025Deep Research: A Survey of Autonomous Research Agentscited by 66
  11. 2025Open Deep Search: Democratizing Search with Open-source Reasoning Agentscited by 49
  12. 2024Cheating Automatic LLM Benchmarks: Null Models Achieve High Win Ratescited by 45
  13. 2024Red Teaming GPT-4V: Are GPT-4V Safe Against Uni/Multi-Modal Jailbreak Attacks?cited by 34
  14. 2023Benchmarking Robustness of Adaptation Methods on Pre-trained Vision-Language Modelscited by 31
  15. 2024Stop Reasoning! When Multimodal LLM with Chain-of-Thought Reasoning Meets Adversarial Imagecited by 26
  16. 2024SciSafeEval: A Comprehensive Benchmark for Safety Alignment of Large Language Models in Scientific Taskscited by 18
  17. 2024Multimodal Pragmatic Jailbreak on Text-to-image Modelscited by 13

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2026: 2.

2 papers.

  1. 2026SciHazard: A Benchmark for Measuring Scientific Safety Risks with Decomposed Harm Scoringcited by 1
  2. 2026Struct-Searcher: Agentic Structural Thinking Advances Multimodal Deep Information Seekingcited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026Delegated Misalignment: How Multi-Agent Structures Amplify LLM Safety Risks
  2. 2025How Brittle is Agent Safety? Rethinking Agent Risk under Intent Concealment and Task Complexity
  3. 2026An Evaluation of Data Leakage Risks in Tool-Using LLM Agents in Realistic Scenarios
  4. 2026Deep-Research Agents Can Be Poisoned via User-Generated Content
  5. 2025HarmTransform: Transforming Explicit Harmful Queries into Stealthy via Multi-Agent Debate
  6. 2026ToolAlignBench: Investigating Alignment Conflicts in Tool-Calling Enabled LLMs
  7. 2026You Told Me to Do It: Measuring Instructional Text-induced Private Data Leakage in LLM Agents
  8. 2025AgentAlign: Navigating Safety Alignment in the Shift from Informative to Agentic Large Language Models