# VirtualCrime: Evaluating the Criminal Potential and Agentic Behaviors of Large Language Models via Sandbox Simulation

arXiv: https://arxiv.org/abs/2601.13981 · HTML: https://mlsanity.com/paper/2601.13981/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use.
- Builds on 18 of its 50 references that are in the map.
- First posted on arXiv 20 Jan 2026.

## Placed in

- LLM agents and tool use / [Agent threats, guardrails and governance](https://mlsanity.com/agents/agent-threats-guardrails-and-governance/)
- LLM safety and security / [Prompt injection and agent security](https://mlsanity.com/safety/prompt-injection-and-agent-security/)

## Builds on (most cited first, 18 of 18)

- [Qwen3 Technical Report](https://mlsanity.com/paper/2505.09388/) (2025)
- [DeepSeek-R1: Incentivizing Reasoning Capability in LLMs via Reinforcement Learning](https://mlsanity.com/paper/2501.12948/) (2025)
- [Gemini 2.5: Pushing the Frontier with Advanced Reasoning, Multimodality, Long Context, and Next Generation Agentic Capabilities](https://mlsanity.com/paper/2507.06261/) (2025)
- [Training a Helpful and Harmless Assistant with Reinforcement Learning from Human Feedback](https://mlsanity.com/paper/2204.05862/) (2022)
- [Universal and Transferable Adversarial Attacks on Aligned Language Models](https://mlsanity.com/paper/2307.15043/) (2023)
- [Low-Resource Languages Jailbreak GPT-4](https://mlsanity.com/paper/2310.02446/) (2023)
- [Agent-SafetyBench: Evaluating the Safety of LLM Agents](https://mlsanity.com/paper/2412.14470/) (2024)
- [Model evaluation for extreme risks](https://mlsanity.com/paper/2305.15324/) (2023)
- [Multi-Agent Risks from Advanced AI](https://mlsanity.com/paper/2502.14143/) (2025)
- [Evaluating Frontier Models for Dangerous Capabilities](https://mlsanity.com/paper/2403.13793/) (2024)
- [What is in Your Safe Data? Identifying Benign Data that Breaks Safety](https://mlsanity.com/paper/2404.01099/) (2024)
- [AgentSims: An Open-Source Sandbox for Large Language Model Evaluation](https://mlsanity.com/paper/2308.04026/) (2023)
- [OpenAgentSafety: A Comprehensive Framework for Evaluating Real-World AI Agent Safety](https://mlsanity.com/paper/2507.06134/) (2025)
- [Your Agent May Misevolve: Emergent Risks in Self-evolving LLM Agents](https://mlsanity.com/paper/2509.26354/) (2025)
- [Towards evaluations-based safety cases for AI scheming](https://mlsanity.com/paper/2411.03336/) (2024)
- [Demonstrations of Integrity Attacks in Multi-Agent Systems](https://mlsanity.com/paper/2506.04572/) (2025)
- [CrimeMind: Simulating Urban Crime with Multi-Modal LLM Agents](https://mlsanity.com/paper/2506.05981/) (2025)
- [PRISON: Unmasking the Criminal Potential of Large Language Models](https://mlsanity.com/paper/2506.16150/) (2025)

## Built on by (most cited first, 1 of 1)

- [CREBench: Evaluating Large Language Models in Cryptographic Binary Reverse Engineering](https://mlsanity.com/paper/2604.03750/) (2026)

## Abstract (arXiv)

Large language models (LLMs) have shown strong capabilities in multi-step decision-making, and are increasingly integrated into real-world agentic applications. While existing safety evaluations focus on static interactions or refusal rates, it remains largely underexplored what level of threat these models pose once an adversary successfully assigns them a malicious role. To evaluate this agentic misuse risk, we propose VirtualCrime, a dynamic multi-agent sandbox framework that elicits and measures multi-step criminal behavior from LLMs. We design 40 diverse crime tasks within this framework, covering 11 realistic maps and 14 objectives such as theft, robbery, and kidnapping. We evaluate 8 strong LLMs and find that: (1) even with robust safety alignment, all evaluated models exhibit alarming agentic capabilities to generate and execute detailed multi-step criminal plans when placed in an adversarial red-teaming setting; (2) models frequently suffer from behavioral alignment failures, exhibiting a high propensity for over-harm by escalating to violent means far beyond what the task requires; (3) their most sophisticated criminal behaviors concentrate in social deception and team coordination rather than technical exploitation. Our work highlights a critical gap in current safety paradigms, emphasizing the urgent need for behavioral alignment in autonomous agent deployments.