# Agent Safety

LLM agents complete tasks through multi-turn tool calls, but malicious content in user queries, tool descriptions, or environment observations can steer them into unsafe actions. AgentSafeEvo frames safety as an attacker-defender game spanning diverse tasks and attack types: the attacker learns to build tasks that expose weaknesses in the defender's tool use, while the defender learns to complete tasks safely under those attacks, with learnability-guided task weighting adjusting each task's contribution to both updates. On agent safety and general capability benchmarks, the method improves adversarial robustness while maintaining general agent capabilities.

LLM agents complete tasks through multi-turn tool calls, but malicious content in user queries, tool descriptions, or environment observations can steer them into unsafe actions. AgentSafeEvo frames safety as an attacker-defender game spanning diverse tasks and attack types: the attacker learns to build tasks that expose weaknesses in the defender's tool use, while the defender learns to complete tasks safely under those attacks, with learnability-guided task weighting adjusting each task's contribution to both updates. On agent safety and general capability benchmarks, the method improves adversarial robustness while maintaining general agent capabilities.

VEPA writes an agent guardrail as executable symbolic rules, has an LLM propose patches from deployment feedback while a deterministic verifier admits only structurally valid, conflict-free policies, and reaches the highest F1 on events covered by its active policy across three agent safety benchmarks while expanding the scope of deterministic enforcement during deployment.

VEPA writes an agent guardrail as executable symbolic rules, has an LLM propose patches from deployment feedback while a deterministic verifier admits only structurally valid, conflict-free policies, and reaches the highest F1 on events covered by its active policy across three agent safety benchmarks while expanding the scope of deterministic enforcement during deployment.

APEX-Harm evaluates prompt and script injection against long-horizon agents on investment banking, law, and consulting tasks; across 12 frontier models Opus 5 and Sonnet 5 have the lowest overall attack success rates (8% and 20%), while task-specific script replacement and attacker-provided generic scripts still average 81–84% and 73%.

APEX-Harm evaluates prompt and script injection against long-horizon agents on investment banking, law, and consulting tasks; across 12 frontier models Opus 5 and Sonnet 5 have the lowest overall attack success rates (8% and 20%), while task-specific script replacement and attacker-provided generic scripts still average 81–84% and 73%.

Agent skills leave persistent artifacts such as files, configurations and cached data that later sessions read and reuse, and that cross-session channel can carry malicious influence. The work characterizes three mechanisms, Instruction Propagation, Data Boundary Violation and Evidence Poisoning, and builds SkillRelayBench with 270 adversarial cases; across seven models on Codex CLI, Gemini CLI and Claude Code, attack success rates range from 46.7% to 77.4% and attack chain success rates from 35.6% to 61.1%. The runtime defense SkillRelayGuard restores artifact provenance at read time and adds pre-execution advisory review, lowering overall attack success from 69.5% to 10.9% while raising legitimate task completion from 79.6% to 87.5%.

Agent skills leave persistent artifacts such as files, configurations and cached data that later sessions read and reuse, and that cross-session channel can carry malicious influence. The work characterizes three mechanisms, Instruction Propagation, Data Boundary Violation and Evidence Poisoning, and builds SkillRelayBench with 270 adversarial cases; across seven models on Codex CLI, Gemini CLI and Claude Code, attack success rates range from 46.7% to 77.4% and attack chain success rates from 35.6% to 61.1%. The runtime defense SkillRelayGuard restores artifact provenance at read time and adds pre-execution advisory review, lowering overall attack success from 69.5% to 10.9% while raising legitimate task completion from 79.6% to 87.5%.

The work presents a two-stage LLM agent monitoring framework in which single-event and trace-sequence gate rules select pending actions for inspection and an LLM audit agent judges each selected action in the context of the inspected agent's preceding trace before execution, with an optimizer LLM jointly refining gate rules and audit prompts. On the OpenAgentSafety test split, the tuned gated audit reduces mean audits from 8.15 to 2.33 per run and tokens from 47.8k to 14.6k, with 72.8% detection versus 81.5% for auditing every action and a lower false-positive rate (5.9% versus 11.8%); in two simulated multi-agent scenarios it flags all attack runs while cutting audit token usage by more than 80%.

The work presents a two-stage LLM agent monitoring framework in which single-event and trace-sequence gate rules select pending actions for inspection and an LLM audit agent judges each selected action in the context of the inspected agent's preceding trace before execution, with an optimizer LLM jointly refining gate rules and audit prompts. On the OpenAgentSafety test split, the tuned gated audit reduces mean audits from 8.15 to 2.33 per run and tokens from 47.8k to 14.6k, with 72.8% detection versus 81.5% for auditing every action and a lower false-positive rate (5.9% versus 11.8%); in two simulated multi-agent scenarios it flags all attack runs while cutting audit token usage by more than 80%.

The work turns a descriptive layered trust model into an operational controller: a cross-layer synergy operator propagates prerequisite-layer deficits into dependent layers, a no-regret online estimator grounds per-layer weights in observed failures, and Trust-Gated Capability Control issues short-lived, revocable grants only when composite trust and the relevant prerequisite layers clear capability-specific thresholds; the authors prove and numerically confirm that a stealthy compromise inflating behavioral trust while degrading a prerequisite layer cannot escalate privilege and instead self-revokes within a few interactions.

The work turns a descriptive layered trust model into an operational controller: a cross-layer synergy operator propagates prerequisite-layer deficits into dependent layers, a no-regret online estimator grounds per-layer weights in observed failures, and Trust-Gated Capability Control issues short-lived, revocable grants only when composite trust and the relevant prerequisite layers clear capability-specific thresholds; the authors prove and numerically confirm that a stealthy compromise inflating behavioral trust while degrading a prerequisite layer cannot escalate privilege and instead self-revokes within a few interactions.