mlsanityData to 14 Oct 2026

CoSec: Benchmarking Agent Security in Communities

arXiv 2609.34790 ↗First posted 28 Sep 2026cs.CR cs.AIcited by 0

On the map: LLM agents and tool use → Agent threats, guardrails and governance

Abstract (arXiv)

LLM agents operate in persistent collaborative environments involving multiple users, communities, memories, files, and tools. Community boundaries may remain fixed or evolve with changes in membership, roles, composition, and relationships. Agents must complete legitimate tasks and prevent unauthorized disclosure of protected information. Existing evaluations do not fully examine these risks in agent systems. We introduce CoSec, an executable benchmark for evaluating privacy and authorization enforcement in LLM agent systems operating within and across communities. CoSec contains 208 canonical scenarios spanning fixed and evolving boundaries, protected information belonging to the agent owner or other participants, and attacks through dialogue, environmental content, persistent memory, and composed workflows. CoSec executes complete agent systems with persistent sessions, memory, files and tools. It verifies information flows against the active authorization state using execution traces and artifacts. Across harness and model configurations, agents frequently complete benign tasks but violate privacy and authorization boundaries. Privacy behavior varies across harnesses, attack surfaces, and community states, revealing how memory, files, tools, and workflows can carry protected information beyond its authorized scope. These findings show that task utility does not imply privacy or authorization compliance and that authorization in community settings remains an unresolved security challenge for persistent LLM agents.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 22 of its 37 references that are in the map. First posted on arXiv 28 Sep 2026.

Builds on

22 of 37 references.

Closest ancestors · 16

Same direction, newest first

  1. 2026REDAgentBench: Executable Red Teaming and Faithful Measurement of LLM Agent Systems11 Aug
  2. 2026MemSecBench: Tracking Agent Memory Poisoning from Persistence to Consequence and Repair29 Jul
  3. 2026ToolPrivacyBench: Benchmarking Purpose-Bound Privacy in Tool-Using LLM Agents26 Jun
  4. 2026MuPPET: A Benchmark for Contextual Privacy of LLM Assistants in Multi-Party Conversations22 Jun
  5. 2026Got a Secret? LLM Agents Can't Keep It: Evaluating Privacy in Multi-Agent Systems26 May
  6. 2026POLAR-Bench: A Diagnostic Benchmark for Privacy-Utility Trade-offs in LLM Agents18 May
  7. 2026LITMUS: Benchmarking Behavioral Jailbreaks of LLM Agents in Real OS Environments11 May
  8. 2026AgentSocialBench: Evaluating Privacy Risks in Human-Centered Agentic Social Networks1 Apr
  9. 2025ConVerse: Benchmarking Contextual Safety in Agent-to-Agent Conversations7 Nov
  10. 2025MAGPIE: A benchmark for Multi-AGent contextual PrIvacy Evaluation16 Oct
  11. 2025Privacy in Action: Towards Realistic Privacy Mitigation and Evaluation for LLM-Powered Agents22 Sep
  12. 2024AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agents11 Oct
4 more
  1. 2024Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agents3 Oct
  2. 2024AgentPoison: Red-teaming LLM Agents via Poisoning Memory or Knowledge Bases17 Jul
  3. 2024InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents5 Mar
  4. 2023Identifying the Risks of LM Agents with an LM-Emulated Sandbox25 Sep

Other references · 6

  1. 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,443
  2. 2023SOTOPIA: Interactive Evaluation for Social Intelligence in Language Agentscited by 367
  3. 2025MultiAgentBench: Evaluating the Collaboration and Competition of LLM agentscited by 178
  4. 2024PrivacyLens: Evaluating Privacy Norm Awareness of Language Models in Actioncited by 171
  5. 2025OrgAccess: A Benchmark for Role Based Access Control in Organization Scale LLMscited by 8
  6. 2026PAC-BENCH: Evaluating Multi-Agent Collaboration under Privacy Constraintscited by 7

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2026PiSAs: Benchmarking Contextual Integrity in Multi-User Agentic Systems
  2. 2026AgentCIScope: Grounded Contextual Integrity Evaluation for LLM Agents
  3. 2026When Agents Talk, Secrets Travel: Topology-Driven Leakage and Recipient-Conditioned Sanitization in Multi-Agent LLM Systems
  4. 2026AgentLeak: A Benchmark for Internal-Channel Privacy Leakage in Multi-Agent LLM Systems
  5. 2026Agents That Know Too Much: A Data-Centric Survey of Privacy in LLM Agents
  6. 2025Collaborative Shadows: Distributed Backdoor Attacks in LLM-Based Multi-Agent Systems
  7. 2026Delegation Without Trust: An Empirical Gap Analysis of Identity, Authorization, and Runtime Governance in Multi-Agent LLM Systems
  8. 2026AgentSCOPE: Evaluating Contextual Privacy Across Agentic Workflows