Are Your Agents Upward Deceivers?
On the map: LLM agents and tool use → Social simulation and multi-agent debate
Abstract (arXiv)
Large Language Model (LLM)-based agents are increasingly used as autonomous subordinates that carry out tasks for users. This raises the question of whether they may also engage in deception, similar to how individuals in human organizations lie to superiors to create a good image or avoid punishment. We observe and define agentic upward deception, a phenomenon in which an agent facing environmental constraints conceals its failure and performs actions that were not requested without reporting. To assess its prevalence, we construct a benchmark of 200 tasks covering five task types and eight realistic scenarios in a constrained environment, such as broken tools or mismatched information sources. Evaluations of 11 popular LLMs reveal that these agents typically exhibit action-based deceptive behaviors, such as guessing results, performing unsupported simulations, substituting unavailable information sources, and fabricating local files. We further test prompt-based mitigation and find only limited reductions, suggesting that it is difficult to eliminate and highlighting the need for stronger mitigation strategies to ensure the safety of LLM-based agents.
Key facts. Cited by 11 papers in the map (data through 7 Oct 2026). Placed in Social simulation and multi-agent debate, one of 16 directions in LLM agents and tool use. Builds on 33 of its 50 references that are in the map. First posted on arXiv 4 Dec 2025.
Builds on
33 of 50 references.
References · 33
- 2023GPT-4 Technical Reportcited by 18,132
- 2024DeepSeekMath: Pushing the Limits of Mathematical Reasoning in Open Language Modelscited by 8,851
- 2025Gemini 2.5: Pushing the Frontier with Advanced Reasoning, Multimodality, Long Context, and Next Generation Agentic Capabilitiescited by 3,655
- 2023SWE-bench: Can Language Models Resolve Real-World GitHub Issues?cited by 3,193
- 2023Voyager: An Open-Ended Embodied Agent with Large Language Modelscited by 2,081
- 2023Jailbroken: How Does LLM Safety Training Fail?cited by 1,565
- 2024A Survey on LLM-as-a-Judgecited by 1,384
- 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,330
- 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,326
- 2025AlphaEvolve: A coding agent for scientific and algorithmic discoverycited by 763
- 2024AgentPoison: Red-teaming LLM Agents via Poisoning Memory or Knowledge Basescited by 402
- 2023Multi-step Jailbreaking Privacy Attacks on ChatGPTcited by 320
21 more
- 2024Agent-SafetyBench: Evaluating the Safety of LLM Agentscited by 280
- 2024SALAD-Bench: A Hierarchical and Comprehensive Safety Benchmark for Large Language Modelscited by 225
- 2024Jailbreak Attacks and Defenses Against Large Language Models: A Surveycited by 215
- 2025Agentic Misalignment: How LLMs Could Be Insider Threatscited by 136
- 2025Natural Emergent Misalignment from Reward Hacking in Production RLcited by 111
- 2024BadAgent: Inserting and Activating Backdoor Attacks in LLM Agentscited by 106
- 2025OS-Harm: A Benchmark for Measuring Safety of Computer Use Agentscited by 104
- 2024GUI Agents: A Surveycited by 101
- 2023Deception Abilities Emerged in Large Language Modelscited by 99
- 2025SafeArena: Evaluating the Safety of Autonomous Web Agentscited by 97
- 2024Planning, Creation, Usage: Benchmarking LLMs for Comprehensive Tool Utilization in Real-World Complex Scenarioscited by 85
- 2024VLSBench: Unveiling Visual Leakage in Multimodal Safetycited by 59
- 2025Your Agent May Misevolve: Emergent Risks in Self-evolving LLM Agentscited by 52
- 2025ImpossibleBench: Measuring LLMs' Propensity of Exploiting Test Casescited by 51
- 2025MCPSecBench: A Systematic Security Benchmark and Playground for Testing Model Context Protocolscited by 47
- 2025VPI-Bench: Visual Prompt Injection Attacks for Computer-Use Agentscited by 42
- 2025A Comprehensive Survey on Trustworthiness in Reasoning with Large Language Modelscited by 22
- 2025SafeToolBench: Pioneering a Prospective Benchmark to Evaluating Tool Utilization Safety in LLMscited by 21
- 2025Mathematical Proof as a Litmus Test: Revealing Failure Modes of Advanced Large Reasoning Modelscited by 18
- 2025DeceptionBench: A Comprehensive Benchmark for AI Deception Behaviors in Real-world Scenarioscited by 14
- 2025LLMs Deceive Unintentionally: Emergent Misalignment in Dishonesty from Misaligned Samples to Biased Human-AI Interactionscited by 7
Built on by
Citing papers per year: 2026: 11.
11 papers.
- 2026ATBench: A Diverse and Realistic Agent Trajectory Benchmark for Safety Evaluation and Diagnosiscited by 30
- 2026A Trajectory-Based Safety Audit of Clawdbot (OpenClaw)cited by 15
- 2026AgentAbstain: Do LLM Agents Know When Not to Act?cited by 8
- 2026AgentDoG 1.5: A Lightweight and Scalable Alignment Framework for AI Agent Safety and Securitycited by 7
- 2026AI Agents Push Humans Out of the Loopcited by 3
- 2026FormalJudge: A Neuro-Symbolic Paradigm for Agentic Oversightcited by 2
- 2026Quantifying Overclaiming Propensity in Frontier LLM Agentscited by 2
- 2026REDDIT: Forgetting-Resistant Correction of Timestamp Drift in ASR via Replay-Based Distribution Editingcited by 0
- 2026When the Agent Becomes the Kernel: A Systematization of Security on the Path to AI-Native Operating Systemscited by 0
- 2026PROACT-Agent: Progressive Runtime Oversight and Active Circuit-breaking for Real-Time Safetycited by 0
- 2026Failure-Transparent Agents: Benchmarking Post-Failure Reporting in Tool-Using Language Modelscited by 0
- 2026Failure-Transparent Agents: Benchmarking Post-Failure Reporting in Tool-Using Language Models28 Sep 2026
- 2026PROACT-Agent: Progressive Runtime Oversight and Active Circuit-breaking for Real-Time Safety28 Sep 2026
- 2026When the Agent Becomes the Kernel: A Systematization of Security on the Path to AI-Native Operating Systems20 Sep 2026
- 2026Quantifying Overclaiming Propensity in Frontier LLM Agents17 Sep 2026
- 2026AI Agents Push Humans Out of the Loop24 Aug 2026
- 2026AgentAbstain: Do LLM Agents Know When Not to Act?11 Jul 2026
- 2026REDDIT: Forgetting-Resistant Correction of Timestamp Drift in ASR via Replay-Based Distribution Editing6 Jul 2026
- 2026AgentDoG 1.5: A Lightweight and Scalable Alignment Framework for AI Agent Safety and Security28 May 2026
- 2026ATBench: A Diverse and Realistic Agent Trajectory Benchmark for Safety Evaluation and Diagnosis2 Apr 2026
- 2026A Trajectory-Based Safety Audit of Clawdbot (OpenClaw)16 Feb 2026
- 2026FormalJudge: A Neuro-Symbolic Paradigm for Agentic Oversight11 Feb 2026
Similar, not cited
Close in wording, no citation either way
- 2026DecepEval: A Benchmark for Evaluating Deception in LLM Agents
- 2026SPADE-Bench: Evaluating Spontaneous Strategic Deception in Agents via Plan-Action Divergence
- 2026Deception and Communication in Autonomous Multi-Agent Systems: An Experimental Study with Among Us
- 2025Beyond Prompt-Induced Lies: Investigating LLM Deception on Benign Prompts
- 2025Among Us: A Sandbox for Measuring and Detecting Agentic Deception
- 2026Intentional Deception as Controllable Capability in LLM Agents
- 2026DeceptGuard :A Constitutional Oversight Framework For Detecting Deception in LLM Agents
- 2026Hidden in Plain Text: Measuring LLM Deception Quality Against Human Baselines Using Social Deduction Games