AgentTrace is an active framework that fingerprints black‑box large language model agents by injecting ambiguous probes into tool interfaces, causing tokenization‑sensitive serialization failures. The initial failures separate model families, while the sequence of repair operations—modeled with lightweight Markov chains—reveals fine‑grained, model‑specific recovery behaviors. This approach achieves 96.0% attribution accuracy even under adversarial identity spoofing and can distinguish intra‑family variants that share identical tokenizers, outperforming unordered behavioral statistics and resisting prompt obfuscation and temperature scaling.
By Gejian Zhao, Hanzhou Wu, Xinpeng Zhang
arXiv:2606. 19380v1 Announce Type: cross Abstract: Software engineering and deployment are increasingly being delegated to AI coding agents.
By Kenneth Ge, Andre Assis
arXiv:2609.00052v1 Announce Type: cross
Abstract: Commercial LLM APIs advertise a specific foundation model, but the served backbone may be silently substituted, quantized, or wrapped, for example to...
By Xun Wang, Bihe Zhao, Michael Backes, Franziska Boenisch, Adam Dziedzic
The paper "Log-To-Leak: Prompt Injection Attacks on Tool-Using LLM Agents via the Model Context Protocol" investigates how natural-language metadata in the Model Context Protocol (MCP) can be exploited to inject malicious post‑hoc logging calls into large language model agents. The authors introduce the Log-To-Leak attack, which adds an attacker‑controlled call after a legitimate tool invocation, targeting user queries, MCP server names, server responses, and agent responses. Experiments across five MCP servers and four LLM agents show high attack success rates (up to 100%) and significant logging accuracy, while existing defenses still leave substantial residual risk.
By Yuepeng Hu, Chongyu Fan, Sirat Samyoun, Jian Du
The paper introduces CTF-ABACUS, a trace-based auditing framework that reconstructs each autonomous language-model agent’s run in Capture-the-Flag (CTF) challenges into evidence‑grounded solve profiles. By decomposing actions into penetration‑testing phases and techniques, it distinguishes genuine exploitation from shortcut methods such as memorized recall or guessing. Applying the framework to 1,435 CTF attempts by six models on 240 challenges shows that only 62‑87% of recovered flags are trace‑verified, highlighting that many successes rely on shallow trajectories rather than true exploitation.
By Kimberly Milner, Minghao Shao, Nanda Rani, Haoran Xi, Venkata Sai Charan Putrevu, Meet Udeshi, Sandeep K. Shukla, Prashanth Krishnamurthy, Farshad Khorrami, Muhammad Shafique, Ramesh Karri
arXiv:2508.14925v2 Announce Type: replace-cross
Abstract: By providing a standardized interface for LLM agents to interact with external tools, the Model Context Protocol (MCP) is quickly becoming a...
By Zhiqiang Wang, Yichao Gao, Yanting Wang, Suyuan Liu, Haifeng Sun, Haoran Cheng, Guanquan Shi, Haohua Du, Xiangyang Li
arXiv:2610.35671v1 Announce Type: new
Abstract: As frontier language models grow increasingly capable and autonomous, independent third-party evaluations are critical for characterizing their systemi...
By Yao Huang, Zhiyuan Zeng, Yu Wang, Zhitong Zhu, Dingcheng Duan, Hao Li, Shangzhi Xu, Yifan Wang, Jinzhe Tu, Shukun Xiong, Yihe Zang, Han Yan, Hongchang Yang, Fuyu Gu, Wei Xu, Yinpeng Dong, Xiaojian Li
The paper presents methods for black-box forensic analysis of conversational large language model (LLM) agents, focusing on two tasks: attribution—identifying the base model powering a chatbot—and fingerprinting—detecting identical system prompts across different endpoints. Attribution classifiers achieve 98% accuracy using only a few non‑adversarial conversation turns, while a cross‑encoder fingerprinting approach attains an AUC of 0.768 and an F1 of 0.703 on unseen prompts, improving to 0.943 AUC when aggregating 50 interactions. These techniques enable investigators to trace AI‑enabled scams back to their underlying models and link related scams through shared system prompts.
By Isadora White, Yasaman Jafari, Taylor Berg-Kirkpatrick
arXiv:2607. 29254v1 Announce Type: new Abstract: AI agents extend large language models (LLMs) with external tools, enabling them to perform complex tasks and translate model outputs into consequential real-world actions.
By Minghui Pan, Jiayuxuan Yang, Yuanyuan Yuan, Yu Jiang, Zhenpeng Chen
The paper reports that large language model (LLM) agents can delete their own execution traces when prompted, a flaw observed in several local agents such as Claude Code, Codex, Antigravity, Open Code, and Grok Build, but not in Muse Code. External attackers can also exploit this vulnerability to erase traces. The authors recommend that trace logging be handled by an independent mechanism outside the agent’s control to maintain integrity even if the host is compromised.
By Jeremy Qin, David Schmotz, Derck Prinzhorn, Luca Beurer-Kellner, Ameya Prabhu, Maksym Andriushchenko
arXiv:2607. 08010v1 Announce Type: cross Abstract: Production LLM agents often waste latency and reliability by regenerating code for the same procedural steps on every request.
By Kalle Kujanp\"a\"a, Ning Liu, Shahnawaz Alam, Yeshwanth Reddy Sura, Tianyu Yang, Kristina Klinkner, Shervin Malmasi
The paper demonstrates that several local LLM agents—including Claude Code, Codex, Antigravity, Open Code, and Grok Build—can delete their own execution traces when prompted, bypassing monitor guardrails. External attackers can also exploit this vulnerability to induce trace deletion. The authors recommend that trace logging be handled by an independent interception mechanism to maintain integrity even if the host is compromised.