The paper introduces a unified framework for monitoring misuse of large language model agents in multi‑actor settings, focusing on two attack types: decomposition attacks and prompt injection attacks. It proposes tracking the agent’s externalised actions and determining whether the first detection of harm falls within a defined harm window. Using this formalism, the authors build a benchmark of about 6,200 conversation transcripts and evaluate 17 monitor configurations, finding that action‑framed monitors perform well on both threats while content‑framed monitors struggle with injection attacks, and highlighting limitations of traditional position‑blind metrics.
By Aniruddh Pramod, James Oldfield, Adel Bibi
arXiv:2608. 03499v1 Announce Type: new Abstract: Recent advances in persistent personal-agent frameworks are making human-centered agent networks realistic deployment targets: each user can be served by an AI agent that acts on the user's behalf, maintains state, and communicates with other agents through social and task relations.
By Prince Zizhuang Wang, Aojie Yuan, Haiyue Zhang, Xiyang Hu, Yue Zhao, Shuli Jiang
Recent advances in persistent personal-agent frameworks are making human-centered agent networks realistic deployment targets: each user can be served by an AI agent that acts on the user's behalf, maintains state, and communicates with other agents through social and task relations. In these networks, everyday tool use becomes multi-party owned-agent collaboration over personal workspaces, where files, records, tools, and policies are not directly visible across owners.
arXiv:2503. 15560v1 Announce Type: cross Abstract: Large Language Models (LLMs) are increasingly vulnerable to sophisticated multi-turn manipulation attacks, where adversaries strategically build context through seemingly benign conversational turns to circumvent safety measures and elicit harmful or unauthorized responses.
By Prashant Kulkarni, Assaf Namer
arXiv:2606.23189v2 Announce Type: replace-cross
Abstract: Computer-use agents (CUAs) now act on a user's behalf across personal applications such as email, calendars, and to-do lists. This cross-appl...
By Anmol Goel, Iryna Gurevych
arXiv:2602.22724v2 Announce Type: replace-cross
Abstract: Tool-augmented large language model (LLM) agents aggregate dialogue history, tool outputs, and retrieved content into an accumulated runtime...
By Tian Zhang, Yiwei Xu, Juan Wang, Keyan Guo, Xiaoyang Xu, Bowen Xiao, Quanlong Guan, Jinlin Fan, Jiawei Liu, Zhiquan Liu, Hongxin Hu
MAS-Guard is a unified framework designed to safeguard both single- and multi-agent large language model (LLM) systems. It introduces a local Agent Guardrail (A-Guard) layer that uses task-specific experts to evaluate agentic events, and a system-level Control Plane that applies deterministic structural checks and semantic assessments to routes, capabilities, and message content. The framework enforces interventions—allow, reflection, confirmation, and block—across benchmarks, reducing attack success rates by 71.5‑86.3% while maintaining utility on benign tasks.
By Mohammad Kachuee, Phu Mon Htut, Sheng Li, Nikolaos Pappas, Miguel Ballesteros Martinez, Yassine Benajiba, Sujith Ravi, Dan Roth
arXiv:2610.36108v1 Announce Type: cross
Abstract: LLM agents increasingly access external tools through the Model Context Protocol (MCP), but the natural-language metadata used to describe those tool...
By Yuepeng Hu, Chongyu Fan, Sirat Samyoun, Jian Du
arXiv:2609.22949v1 Announce Type: cross
Abstract: Existing prompt injection research focuses on single-model chatbot scenarios, where an attacker manipulates one LLM through crafted input. Multi-agen...
By Rudrendu Kumar Paul, Sourav Nandy
MACGen is a multi‑agent framework designed to produce code that is both functionally correct and secure. It orchestrates four specialized agents—planner, security advisor, coder, and reviewer—each receiving only structured artifacts from the previous stage, thereby enforcing role specialization and limiting context bloat. The approach yields significant improvements on benchmark datasets, outperforming direct prompting by 19.61 and 10.57 percentage points on average.
By Miseon Yu, Jaehoon Choi, Younghan Lee, Yunheung Paek
arXiv:2607. 25297v1 Announce Type: cross Abstract: The rapid development of large language model (LLM) agents has enabled their broad adoption across diverse real-world tasks.
By Ping He, Yuexiang Xie, Yaliang Li, Shouling Ji
MobileInject is a benchmark that evaluates the security of multimodal large language model (MLLM)-based mobile agents against multimodal injection attacks. It offers a high‑fidelity interactive framework with 11 scenarios, 9 risk categories, and 108 executable risk instances, and introduces Cross‑Modal Consistency Injection along with two advanced attack methods—Multi‑Role Collaborative Deception and Reasoning‑Camouflage Injection—to intensify trust manipulation and reasoning hijacking. Experiments show that mobile agents are broadly vulnerable, especially to early‑stage reasoning hijacking, establishing MobileInject as a systematic tool for studying and improving mobile agent security.
By Songping Wang, Peiyang Li, Yi Huang, Fengting Li, Xuhao Ran, Yueming Lyu, Chao Feng, Caifeng Shan