SafePro: Evaluating the Safety of Professional-Level AI Agents
On the map: LLM agents and tool use → Agent threats, guardrails and governance
also in 1 more
Abstract (arXiv)
Large language model-based agents are rapidly evolving from simple conversational assistants into autonomous systems capable of performing complex, professional-level tasks in various domains. While these advancements promise significant productivity gains, they also introduce critical safety risks that remain under-explored. Existing safety evaluations primarily focus on simple, daily assistance tasks, failing to capture the intricate decision-making processes and potential consequences of misaligned behaviors in professional settings. To address this gap, we introduce SafePro, a comprehensive benchmark designed to evaluate the safety alignment of AI agents performing professional activities. SafePro features a dataset of high-complexity tasks across diverse professional domains with safety risks, developed through a rigorous iterative creation and review process. Our evaluation of state-of-the-art AI models reveals significant safety vulnerabilities and uncovers new unsafe behaviors in professional contexts. We further show that these models exhibit both insufficient safety judgment and weak safety alignment when executing complex professional tasks. In addition, we investigate safety mitigation strategies for improving agent safety in these scenarios and observe encouraging improvements. Together, our findings highlight the urgent need for robust safety mechanisms tailored to the next generation of professional AI agents.
Key facts. Cited by 10 papers in the map (data through 14 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 22 of its 35 references that are in the map. First posted on arXiv 10 Jan 2026.
Builds on
22 of 35 references.
Closest ancestors · 8
Same direction, newest first
- 2025SIRAJ: Diverse and Efficient Red-Teaming for LLM Agents via Distilled Structured Reasoning30 Oct
- 2025OpenAgentSafety: A Comprehensive Framework for Evaluating Real-World AI Agent Safety8 Jul
- 2025SHADE-Arena: Evaluating Sabotage and Monitoring in LLM Agents17 Jun
- 2025OS-Harm: A Benchmark for Measuring Safety of Computer Use Agents17 Jun
- 2025SafeScientist: Toward Risk-Aware Scientific Discoveries by LLM Agents29 May
- 2025AgentVigil: Generic Black-Box Red-teaming for Indirect Prompt Injection against LLM Agents9 May
- 2024AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agents11 Oct
- 2024InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents5 Mar
Other references · 14
- 2023SWE-bench: Can Language Models Resolve Real-World GitHub Issues?cited by 3,373
- 2023ToolLLM: Facilitating Large Language Models to Master 16000+ Real-world APIscited by 1,947
- 2024τ-bench: A Benchmark for Tool-Agent-User Interaction in Real-World Domainscited by 1,402
- 2023Mind2Web: Towards a Generalist Agent for the Webcited by 1,242
- 2024OSWorld: Benchmarking Multimodal Agents for Open-Ended Tasks in Real Computer Environmentscited by 1,195
- 2024OpenHands: An Open Platform for AI Software Developers as Generalist Agentscited by 1,002
- 2024GPT-4V(ision) is a Generalist Web Agent, if Groundedcited by 563
- 2024TravelPlanner: A Benchmark for Real-World Planning with Language Agentscited by 392
- 2024Agent S: An Open Agentic Framework that Uses Computers Like a Humancited by 187
- 2025GDPval: Evaluating AI Model Performance on Real-World Economically Valuable Taskscited by 158
- 2025Qwen3Guard Technical Reportcited by 155
- 2024AI Sandbagging: Language Models can Strategically Underperform on Evaluationscited by 145
2 more
Built on by
Citing papers per year: 2026: 10.
10 papers.
- 2026Your Agent is More Brittle Than You Think: Uncovering Indirect Injection Vulnerabilities in Agentic LLMscited by 4
- 2026Taxonomy and Consistency Analysis of Safety Benchmarks for AI Agentscited by 4
- 2026Mind the GAP: Text Safety Does Not Transfer to Tool-Call Safety in LLM Agentscited by 3
- 2026From Reward-Hack Activations to Agentic Risk States: Context-Calibrated Mechanistic Monitoring in LLM Agentscited by 3
- 2026Don't Make Models Guess Security and Safety: Symbolic Guardrails for Domain-Specific AI Agentscited by 2
- 2026HARP: Measuring Harm Amplification in Multi-Agent LLM Systemscited by 2
- 2026Agent Hacks Agent: Autoresearch for Production-Agent Red-Teamingcited by 2
- 2026RAIL Guard: Closing the Evaluation-to-Remediation Gap in Responsible AI for LLM Agentscited by 0
- 2026AtomRec: Evolving Atomic Memory for Agentic Recommendationcited by 0
- 2026"You're Right, Let Me Fix It": How LLM Agents Damage Correct Work When Falsely Accusedcited by 0
- 2026"You're Right, Let Me Fix It": How LLM Agents Damage Correct Work When Falsely Accused26 Sep 2026
- 2026AtomRec: Evolving Atomic Memory for Agentic Recommendation4 Sep 2026
- 2026Agent Hacks Agent: Autoresearch for Production-Agent Red-Teaming13 Jul 2026
- 2026From Reward-Hack Activations to Agentic Risk States: Context-Calibrated Mechanistic Monitoring in LLM Agents4 Jun 2026
- 2026RAIL Guard: Closing the Evaluation-to-Remediation Gap in Responsible AI for LLM Agents28 May 2026
- 2026HARP: Measuring Harm Amplification in Multi-Agent LLM Systems26 May 2026
- 2026Don't Make Models Guess Security and Safety: Symbolic Guardrails for Domain-Specific AI Agents16 Apr 2026
- 2026Taxonomy and Consistency Analysis of Safety Benchmarks for AI Agents11 Apr 2026
- 2026Your Agent is More Brittle Than You Think: Uncovering Indirect Injection Vulnerabilities in Agentic LLMs4 Apr 2026
- 2026Mind the GAP: Text Safety Does Not Transfer to Tool-Call Safety in LLM Agents18 Feb 2026
Similar, not cited
Close in wording, no citation either way
- 2024Safeguarding AI Agents: Developing and Analyzing Safety Architectures
- 2026Boiling the Frog: A Multi-Turn Benchmark for Agentic Safety
- 2026Risky-Bench: Probing Agentic Safety Risks under Real-World Deployment
- 2026SafetyALFRED: Evaluating Safety-Conscious Planning of Multimodal Large Language Models
- 2024SafeAgentBench: A Benchmark for Safe Task Planning of Embodied LLM Agents
- 2025A Framework for Benchmarking and Aligning Task-Planning Safety in LLM-Based Embodied Agents
- 2026The Cold-Start Safety Gap in LLM Agents
- 2024R-Judge: Benchmarking Safety Risk Awareness for LLM Agents