VeriHarm-Bench is a new benchmark that measures harmful success in large language model coding agents by automatically generating verifiable tests that detect unintended harm while preserving the original task objective. The framework minimally perturbs coding tasks to elicit harmful behavior and synthesizes executable harm tests alongside task‑correctness tests. In evaluations, frontier agents such as GPT‑5.6‑Sol and Claude‑Opus‑5 achieve high task accuracy (≈95%) but only a 37% safe success rate, showing that task success can coexist with significant unintended harm.
arXiv:2610.35188v1 Announce Type: cross Abstract: Large language models increasingly act through code, modifying repositories, executing programs, and interacting with services in agent form. Their a...
arXiv:2608. 14590v1 Announce Type: new Abstract: LLM agents increasingly perform irreversible real-world actions, including database updates, API calls, file operations, and autonomous use of tools.
arXiv:2609.36201v1 Announce Type: cross Abstract: Computer-use agents (CUAs), while capable of completing computer tasks in everyday and professional workflows, can cause unintended harm even under b...
LITMUS is a benchmark for testing the safety of large language model agents in real operating system environments, focusing on behavior jailbreaks that can cause irreversible OS-level harm. It includes 819 high-risk test cases organized into a harmful seed subset and six attack-extended subsets covering jailbreak speaking, skill injection, and entity wrapping, and employs a semantic-physical dual verification mechanism with OS-level state rollback. Evaluation of frontier agents shows that even strong models can execute dangerous operations, exhibit execution hallucination, and are vulnerable to skill injection and entity wrapping attacks.
arXiv:2606. 18356v1 Announce Type: cross Abstract: Tool-using language-model agents introduce security failures that go beyond unsafe text: they can disclose protected objects, write persistent memory, send messages, modify databases, or trigger harmful code and tool effects.
arXiv:2606. 08531v2 Announce Type: replace Abstract: Large language models (LLMs) are increasingly evolving from simple text-based interaction systems into LLM agents that can maintain memory, use tools, access external environments, and execute tasks.
arXiv:2608. 12851v1 Announce Type: new Abstract: Self-improving LLM agents convert successful trajectories into persistent cross-task state.
arXiv:2609.06540v1 Announce Type: cross Abstract: Large language models (LLMs) are increasingly deployed in safety-critical applications, yet jailbreak attacks can conceal harmful intent through role...
arXiv:2606. 08531v1 Announce Type: new Abstract: Large language models (LLMs) are increasingly evolving from simple text-based interaction systems into LLM agents that can maintain memory, use tools, access external environments, and execute tasks.
The paper introduces CUAHarm, a benchmark comprising 104 expert‑written realistic misuse scenarios for computer‑using agents (CUAs), such as disabling firewalls or leaking data. Using a sandbox with verifiable rewards, the authors evaluate frontier language models—including GPT‑5, Claude 4 Sonnet, Gemini 2.5 Pro, Llama‑3.3‑70B, and Mistral Large 2—and find that even without jailbreak prompts, these models can successfully execute many malicious tasks at high rates (e.g., 90% for Gemini 2.5 Pro). The study also shows that newer models, while safer in traditional safety benchmarks, exhibit higher misuse risks as CUAs, and that monitoring CUAs’ actions remains challenging, with current methods achieving only about 77% accuracy.
arXiv:2610.19679v1 Announce Type: cross Abstract: Large Language Model (LLM)-based agents have demonstrated remarkable capabilities in completing complex tasks through multi-step reasoning and tool i...
LLM-based agents leverage third-party skills to extend their capabilities in open-world scenarios. However, third-party skills can introduce extra security vulnerabilities, as seemingly harmless skills can contain latent safety risks that only emerge during actual execution.