mlsanityData to 7 Oct 2026

DUMA-Bench: A Dual-Control Multi-Agent Benchmark for Evaluating LLM Agent Security

arXiv 2609.24662 ↗First posted 21 Sep 2026cs.AIcited by 0

On the map: LLM agents and tool use → Agent threats, guardrails and governance

Abstract (arXiv)

LLM-based agents increasingly operate in environments where they interact with users, tools, and external systems. Yet most security evaluations assume passive users and static control, ignoring the interactive dynamics that shape real agent behavior. We introduce DUMA-Bench, a benchmark and evaluation protocol for measuring agent security under dual-control interaction, where both the agent and the user can influence the shared environment state. DUMA-Bench extends τ2-bench ~citebarres2025tau with adversarial environments covering eight vulnerability classes, including RAG poisoning, cross-agent manipulation, and unsafe output handling. We evaluate 14 models from five model families (OpenAI, Anthropic, DeepSeek, Qwen, and Z.ai) across eight domains and multiple user-behavior regimes. Across our experiments, introducing dual-control interaction increases the attack success rate from 26.9% to 41.1%. These results show that agent security is not solely a property of the model but emerges from the interaction between the model, the user, and the environment. DUMA-Bench provides a missing evaluation layer for studying security in realistic agent deployments.

Key facts. No citing papers in the map yet (data through 7 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 8 of its 17 references that are in the map. First posted on arXiv 21 Sep 2026.

Builds on

8 of 17 references.

Closest ancestors · 2

Same direction, newest first

  1. 2024AgentPoison: Red-teaming LLM Agents via Poisoning Memory or Knowledge Bases17 Jul
  2. 2024BadAgent: Inserting and Activating Backdoor Attacks in LLM Agents5 Jun

Other references · 6

  1. 2023Toolformer: Language Models Can Teach Themselves to Use Toolscited by 4,072
  2. 2023Generative Agents: Interactive Simulacra of Human Behaviorcited by 3,500
  3. 2024τ-bench: A Benchmark for Tool-Agent-User Interaction in Real-World Domainscited by 1,280
  4. 2025τ2-Bench: Evaluating Conversational Agents in a Dual-Control Environmentcited by 558
  5. 2025MultiAgentBench: Evaluating the Collaboration and Competition of LLM agentscited by 169
  6. 2025REALM-Bench: A Benchmark for Evaluating Multi-Agent Systems on Real-world, Dynamic Planning and Scheduling Taskscited by 16

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2025TAMAS: Benchmarking Adversarial Risks in Multi-Agent LLM Systems
  2. 2025Exposing Weak Links in Multi-Agent Systems under Adversarial Prompting
  3. 2026AgentLAB: Benchmarking LLM Agents against Long-Horizon Attacks
  4. 2024Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agents
  5. 2025Breaking Agent Backbones: Evaluating the Security of Backbone LLMs in AI Agents
  6. 2026Adversarial Attacks in Multi-Agent LLM Pipelines: Unveiling Structural Vulnerabilities in Agentic AI Architectures
  7. 2026SoK: When Safe Agents Fail Together: The Security of Multi Agent LLM Systems
  8. 2026Connecting the Dots in Agentic AI Security: A Cross-Dimensional Threat Taxonomy, Evaluation Maturity, and Open Challenges