"Are You Sure?": An Empirical Study of Human Perception Vulnerability in LLM-Driven Agentic Systems
On the map: LLM agents and tool use → Agent threats, guardrails and governance
Abstract (arXiv)
Large language model (LLM) agents are rapidly becoming trusted copilots in high-stakes domains like software development and healthcare. However, this deepening trust introduces a novel attack surface: Agent-Mediated Deception (AMD), where compromised agents are weaponized against their human users. While extensive research focuses on agent-centric threats, human susceptibility to deception by a compromised agent remains unexplored. We present the first large-scale empirical study with 303 participants to measure human susceptibility to AMD. This is based on HAT-Lab (Human-Agent Trust Laboratory), a high-fidelity research platform we develop, featuring nine carefully crafted scenarios spanning everyday and professional domains (e.g., healthcare, software development, human resources). Our 10 key findings reveal significant vulnerabilities and provide future defense perspectives. Specifically, only 8.6% of participants perceive AMD attacks, while domain experts show increased susceptibility in certain scenarios. We identify six cognitive failure modes in users and find that their risk awareness often fails to translate to protective behavior. The defense analysis reveals that effective warnings should interrupt workflows with low verification costs. With experiential learning based on HAT-Lab, over 90% of users who perceive risks report increased caution against AMD. This work provides empirical evidence and a platform for human-centric agent security research.
Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 47 of its 106 references that are in the map. First posted on arXiv 24 Feb 2026.
Builds on
47 of 106 references.
Closest ancestors · 13
Same direction, newest first
- 2025A-MemGuard: A Proactive Defense Framework for LLM-Based Agent Memory29 Sep
- 2025MPMA: Preference Manipulation Attack Against Model Context Protocol16 May
- 2025Prompt Injection Attack to Tool Selection in LLM Agents28 Apr
- 2025The Obvious Invisible Threat: LLM-Powered GUI Agents' Vulnerability to Fine-Print Injections15 Apr
- 2025A Survey on Trustworthy LLM Agents: Threats and Countermeasures12 Mar
- 2024Navigating the Risks: A Survey of Security, Privacy, and Ethics Threats in LLM-Based Agents14 Nov
- 2024Imprompter: Tricking LLM Agents into Improper Tool Use19 Oct
- 2024AgentPoison: Red-teaming LLM Agents via Poisoning Memory or Knowledge Bases17 Jul
- 2024IsolateGPT: An Execution Isolation Architecture for LLM-Based Agentic Systems8 Mar
- 2024InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents5 Mar
- 2024WIPI: A New Web Threat for LLM-Driven Web Agents26 Feb
- 2024Agent Smith: A Single Image Can Jailbreak One Million Multimodal LLM Agents Exponentially Fast13 Feb
1 more
Other references · 34
- 2022ReAct: Synergizing Reasoning and Acting in Language Modelscited by 8,695
- 2023A Survey on Large Language Model based Autonomous Agentscited by 2,242
- 2023MetaGPT: Meta Programming for A Multi-Agent Collaborative Frameworkcited by 1,808
- 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,443
- 2023MemGPT: Towards LLMs as Operating Systemscited by 1,389
- 2020COMET: A Neural Framework for MT Evaluationcited by 1,033
- 2023ChatDev: Communicative Agents for Software Developmentcited by 919
- 2024A Survey on the Memory Mechanism of Large Language Model based Agentscited by 634
- 2023Prompt Injection attack against LLM-integrated Applicationscited by 605
- 2024PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Modelscited by 267
- 2025Large Language Model Agent: A Survey on Methodology, Applications and Challengescited by 205
- 2024The Landscape of Emerging AI Agent Architectures for Reasoning, Planning, and Tool Calling: A Surveycited by 168
22 more
- 2024AI Agents Under Threat: A Survey of Key Security Challenges and Future Pathwayscited by 127
- 2025Advances and Challenges in Foundation Agents: From Brain-Inspired Intelligence to Evolutionary, Collaborative, and Safe Systemscited by 126
- 2024Automatic and Universal Prompt Injection Attacks against Large Language Modelscited by 119
- 2024WebPilot: A Versatile and Autonomous Multi-Agent System for Web Task Execution with Strategic Explorationcited by 101
- 2025PlanGenLLMs: A Modern Survey of LLM Planning Capabilitiescited by 83
- 2024Risk Taxonomy, Mitigation, and Assessment Benchmarks of Large Language Model Systemscited by 66
- 2024Are We There Yet? Revealing the Risks of Utilizing Large Language Models in Scholarly Peer Reviewcited by 53
- 2025Open Deep Search: Democratizing Search with Open-source Reasoning Agentscited by 49
- 2024Believing Anthropomorphism: Examining the Role of Anthropomorphic Cues on Trust in Large Language Modelscited by 37
- 2024Human-Imperceptible Retrieval Poisoning Attacks in LLM-Powered Applicationscited by 33
- 2019Detecting and Characterizing Lateral Phishing at Scalecited by 21
- 2024SelfGoal: Your Language Agents Already Know How to Achieve High-level Goalscited by 21
- 2024Objection Overruled! Lay People can Distinguish Large Language Models from Lawyers, but still Favour Advice from an LLMcited by 16
- 2018We Value Your Privacy ... Now Take Some Cookies: Measuring the GDPR's Impact on Web Privacycited by 15
- 2025Malicious LLM-Based Conversational AI Makes Users Reveal Personal Informationcited by 13
- 2023Do You Trust ChatGPT? -- Perceived Credibility of Human and AI-Generated Contentcited by 9
- 2025Understanding Users' Security and Privacy Concerns and Attitudes Towards Conversational AI Platformscited by 9
- 2023DocXChain: A Powerful Open-Source Toolchain for Document Parsing and Beyondcited by 8
- 2024Healthcare Voice AI Assistants: Factors Influencing Trust and Intention to Usecited by 6
- 2024Content, Nudges and Incentives: A Study on the Effectiveness and Perception of Embedded Phishing Trainingcited by 5
- 2024"Are Adversarial Phishing Webpages a Threat in Reality?" Understanding the Users' Perception of Adversarial Webpagescited by 4
- 2023Children, Parents, and Misinformation on Social Mediacited by 2
Built on by
Not cited yet.
Similar, not cited
Close in wording, no citation either way
- 2025The Trust Paradox in LLM-Based Multi-Agent Systems: When Collaboration Becomes a Security Vulnerability
- 2025OpenDeception: Learning Deception and Trust in Human-AI Interaction via Multi-Agent Simulation
- 2026DecepEval: A Benchmark for Evaluating Deception in LLM Agents
- 2026SPADE-Bench: Evaluating Spontaneous Strategic Deception in Agents via Plan-Action Divergence
- 2026Intentional Deception as Controllable Capability in LLM Agents
- 2025To trust or not to trust: Attention-based Trust Management for LLM Multi-Agent Systems
- 2025The Silicon Psyche: Anthropomorphic Vulnerabilities in Large Language Models
- 2026Honeyquest for LLMs: Rethinking Cyber Deception for AI Attackers