arXiv:2605. 27488v2 Announce Type: replace-cross Abstract: Agentic systems increasingly run user-authored orchestration code that invokes tools, spawns subtasks, and delegates work across machines and clouds.
By Qiancheng Wu, Wenhui Zhang, Gan Fang, Sheng Mao, Biao Gao, David Levitsky, Shawna Murphy Butterworth, Rob Cameron
arXiv:2605. 02187v2 Announce Type: replace-cross Abstract: LLM agents convert model outputs into consequential actions, including communications, code changes, and financial transactions.
By Mingyu Luo, Zihan Zhang, Zesen Liu, Yuchong Xie, Zhixiang Zhang, Dung Hiu Hilton Yeung, Wai Ip Lai, Ping Chen, Ming Wen, Dongdong She
arXiv:2607. 23624v1 Announce Type: cross Abstract: Third-party API routers have become a common layer that unifies access across increasingly diverse LLM providers.
By Donghao Fu, Jingxin Li, Xue Jiang, Yihong Dong
arXiv:2608. 09867v1 Announce Type: cross Abstract: Leading large language model providers now conceal their models' step-by-step reasoning, or chain-of-thought, to protect intellectual property and limit information leakage.
By Alexander Panfilov, David Schmotz, Ilia Shumailov, Luca Beurer-Kellner, Joachim Schaeffer, Ameya Prabhu, Jonas Geiping, Maksym Andriushchenko
arXiv:2609.37196v1 Announce Type: cross
Abstract: Tool-using LLM agents remain vulnerable to indirect prompt injection because trusted instructions and untrusted observations share one context, allow...
By Yanjie Li, Xiangyu He, Xuelong Dai, Bin Xiao
The paper investigates how third‑party API routers, which sit between coding agents and large language model providers, can introduce a control gap by inspecting and modifying requests and responses. Through an empirical study using the SIDEL framework, the authors evaluate four levels of router‑side injection (Response Substitution, Response Append, LLM‑Polished Injection, and LLM‑Polished with Distribution Alignment Injection) across 400 curated samples and four representative coding agents. The results show that router‑side interventions significantly alter repository‑level actions and evade existing client‑side safeguards, achieving a 0% defense success rate without additional mitigations.
By Donghao Fu, Jingxin Li, Xue Jiang, Yihong Dong