mlsanityData to 7 Oct 2026

Stop Fixating on Prompts: Reasoning Hijacking and Constraint Tightening for Red-Teaming LLM Agents

arXiv 2604.05549 ↗First posted 7 Apr 2026cs.CLcited by 1

On the map: LLM reasoning → Reasoning for agents, planning and code

also in 2 more
Abstract (arXiv)

With the widespread application of LLM-based agents across various domains, their complexity has introduced new security threats. Existing red-team methods mostly rely on modifying user prompts, which lack adaptability to new data and may impact the agent's performance. To address the challenge, this paper proposes the JailAgent framework, which completely avoids modifying the user prompt. Specifically, it implicitly manipulates the agent's reasoning trajectory and memory retrieval with three key stages: Trigger Extraction, Reasoning Hijacking, and Constraint Tightening. Through precise trigger identification, real-time adaptive mechanisms, and an optimized objective function, JailAgent demonstrates outstanding performance in cross-model and cross-scenario environments.

Key facts. Cited by 1 paper in the map (data through 7 Oct 2026). Placed in Reasoning for agents, planning and code, one of 17 directions in LLM reasoning. Builds on 6 of its 51 references that are in the map. First posted on arXiv 7 Apr 2026.

Builds on

6 of 51 references.

References · 6

  1. 2020Measuring Massive Multitask Language Understandingcited by 7,768
  2. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 2,914
  3. 2023Baseline Defenses for Adversarial Attacks Against Aligned Language Modelscited by 608
  4. 2025AutoRedTeamer: Autonomous Red Teaming with Lifelong Attack Integrationcited by 38
  5. 2025From LLMs to MLLMs to Agents: A Survey of Emerging Paradigms in Jailbreak Attacks and Defenses within LLM Ecosystemcited by 11
  6. 2024Divide and Conquer: A Hybrid Strategy Defeats Multimodal Large Language Modelscited by 1

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2026: 1.

1 paper.

  1. 2026Connecting the Dots in Agentic AI Security: A Cross-Dimensional Threat Taxonomy, Evaluation Maturity, and Open Challengescited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2024AgentPoison: Red-teaming LLM Agents via Poisoning Memory or Knowledge Bases
  2. 2026RedEvoAgent: Automatic Red-Teaming Agent with Experience-Driven Skill Evolution
  3. 2025UDora: A Unified Red Teaming Framework against LLM Agents by Dynamically Hijacking Their Own Reasoning
  4. 2025SIRAJ: Diverse and Efficient Red-Teaming for LLM Agents via Distilled Structured Reasoning
  5. 2025AgentVigil: Generic Black-Box Red-teaming for Indirect Prompt Injection against LLM Agents
  6. 2026REDAgentBench: Executable Red Teaming and Faithful Measurement of LLM Agent Systems
  7. 2025CoP: Agentic Red-teaming for Large Language Models using Composition of Principles
  8. 2026Co-RedTeam: Orchestrated Security Discovery and Exploitation with LLM Agents