Research atlas · last updated September 21, 2026
A classified map of the research on attacking, defending, evaluating and controlling LLM agents: which kinds of methods exist, how mature they are, how well they work when an attacker adapts, and what remains open.
Numbers are the papers' own and are not comparable across papers unless noted. "Adaptive" means an attacker who knows or probes the defense.
In-scope papers went from about 150 in 2023 to about 480 in 2025, and 2026 has passed 600 by September. Defense papers overtook attack papers in 2025.
Detectors, prompt structuring, robustness training and internal-signal probes report near-zero static ASR, yet independent adaptive attacks reach roughly 70–96%. One formal argument says in-band prevention cannot be perfect. 2510.09023 2606.27567
Information-flow control (CaMeL, FIDES) and deterministic privilege policies (Progent) move security out of the model, at a utility cost (CaMeL 77% vs 84% task success). Almost none has faced white-box adaptive evaluation.
A simple tool firewall scores "perfect security" on four standard benchmarks, and papers define attack success as attempt, partial or full goal. Evaluation methodology is itself a research problem. 2510.05244
MCP servers, agent skills, coding agents and computer-use agents are now studied on production tools and at registry scale (98k skills, 64k MCP servers), with high success rates (66–87% on coding agents).
Runtime approval appears in 15 of 21 production agents, but only about ten papers study them, and approvals can be spoofed or swapped after the fact. 2605.24309 2609.21081
Sabotage, scheming and reward hacking show up in controlled evaluations, and the monitors meant to catch them can be injected by the agent they watch (79% bypass of production blocking monitors). 2609.19587
We counted 182 surveys, SoKs and position papers, more than any single method family. Few compare methods quantitatively, and none joins attacks, misalignment/control and offensive capability with a benchmark comparison.
Left: in-scope papers per year by type (2026 runs to mid-September). Right: papers per method family. Thin bars mark under-studied areas.
| Year | Attacks | Defenses | Evaluation | Surveys | Total |
|---|---|---|---|---|---|
| 2022 | 10 | 1 | 3 | 1 | 15 |
| 2023 | 85 | 23 | 25 | 14 | 147 |
| 2024 | 98 | 52 | 34 | 38 | 222 |
| 2025 | 192 | 155 | 82 | 54 | 483 |
| 2026* | 174 | 222 | 133 | 75 | 604 |
Maturity runs from concept to deployed in commercial products. The robustness column summarizes independent adaptive-attack evidence: Broken means published adaptive attacks exceed about 70% ASR; Contested means mixed or vendor-only evidence; Untested means no serious adaptive evaluation yet.
| Family | Papers | Maturity | Adaptive robustness | Best reported (static) | Under adaptive attack / field evidence |
|---|---|---|---|---|---|
| B1 Detection & filtering | 75 | Deployed | Broken | PromptGuard 2: 97.5% recall at 1% FPR; 81.2% AgentDojo prevention. PromptArmor: FPR and FNR under 1% on AgentDojo. | Over 90% ASR against PromptGuard, ProtectAI and Model Armor; 71% against PIGuard; over 80% against DataSentinel; KAD detection driven to 0% by DataFlip; up to 100% evasion of Azure and Meta guards. |
| B2 Prompt-level structuring | 29 | Deployed | Broken | Spotlighting: ASR from over 50% to under 2% on GPT-family models. | Spotlighting and Sandwich: 1% reported, over 95% adaptive (AgentDojo). SEP benchmark: prompting does not produce real instruction/data separation. |
| B3 Robustness training | 40 | Deployed | Contested | Meta SecAlign-70B: AgentDojo ASR 14.7% to 1.9%, InjecAgent 53.8% to 0.5%. SecAlign: optimization attacks 97% to 8%. Anthropic reports 1% ASR for Claude Opus 4.5 against a Best-of-N attacker (vendor). | Meta SecAlign 2% to 96% under adaptive search; RL-Hammer 72% against GPT-5 with instruction hierarchy; white-box attention attack 85–95% on SecAlign/StruQ; poisoned SFT backdoor 96–100%. |
| B4 Architecture & information-flow control | 60 | Benchmarked | Untested | CaMeL: 77% of AgentDojo tasks with provable security vs 84% undefended. FIDES, DRIFT, IPIGuard, SPA, RTBAS: static ASR about 0–1.7%. | Guarantees hold against control-flow hijack by construction, but no independent white-box adaptive evaluation yet; side channels and data-dependent control flow remain open. |
| B5 Runtime policy & action guardrails | 83 | Adopted | Contested | MELON 0.24–1.27%, Progent 39.9% to 1.0%, Task Shield 2.07%, LlamaFirewall 17.6% to 1.75%, AgentArmor 3% (AgentDojo). | All 8 IPI defenses bypassed above 50%; 12 defenses above 90%; MELON 76–95%. Progent held at 2.6% under a hand-crafted adaptive attack (weak model, black-box only). |
| B6 Monitoring & AI control | 59 | Adopted | Broken | AI Control trusted editing: 92% safety at 94% usefulness. Ctrl-Z resampling: attack success 58% to 7% at 5% cost. Best SHADE-Arena monitor AUC 0.87. | Frontier models 'consistently evade' monitors by injecting them; production blocking monitors bypassed in 79% of trials; CoT monitoring degrades under optimization pressure. |
| B7 Access control, identity & sandboxing | 61 | Prototype | Untested | Permission prediction 85.1% accuracy (IEEE S&P'26); MiniScope 1–6% latency. | Measurement: 40.55% of 7,973 remote MCP servers expose tools without authentication; all 119 OAuth servers tested had flaws (9 CVEs); denylist enforcement in coding agents fails 69–98%. |
| B8 Internal-signal & attribution | 36 | Benchmarked | Contested | Attention Tracker AUROC 0.97–1.00; InstructDetector 99.6% accuracy; hidden-state probes AUROC above 0.90 and AgentDojo ASR 34.6% to 0%; AttriGuard 0% static ASR. | MELON 76–95% under adaptive attack; obfuscated activations drop latent-probe recall from 100% to 0% (jailbreak setting); probe validity questioned. |
| B9 Human-in-the-loop & approval UX | 10 | Deployed | Contested | Operator confirmation recall 92%; Claude for Chrome all mitigations 23.6% to 11.2% ASR; Verifiable Action Card 0% ASR on a 24-scenario benchmark. | Users fall for fine-print injections; approval can be substituted after the fact (Loopjacking in Agno, LangGraph, OpenClaw); low-harm goals look like legitimate work. |
A separate classifier or LLM inspects inputs and tool outputs and flags or strips injected instructions before the agent acts.
Deployed
Black-box; one extra call per input; cheap for encoders.
PromptGuard 2: 97.5% recall at 1% FPR; 81.2% AgentDojo prevention. PromptArmor: FPR and FNR under 1% on AgentDojo.
Over 90% ASR against PromptGuard, ProtectAI and Model Armor; 71% against PIGuard; over 80% against DataSentinel; KAD detection driven to 0% by DataFlip; up to 100% evasion of Azure and Meta guards.
Key papers: DataSentinel (IEEE S&P'25) · LlamaFirewall / PromptGuard 2 · PromptArmor · How Not to Detect PI (DataFlip) · Bypassing LLM Guardrails · WAInjectBench
Rewrite the prompt so untrusted content is marked, delimited, encoded or sandwiched between reminders of the real task.
Deployed (secondary layer)
Zero training; near-zero latency; base64 encoding adds tokens.
Spotlighting: ASR from over 50% to under 2% on GPT-family models.
Spotlighting and Sandwich: 1% reported, over 95% adaptive (AgentDojo). SEP benchmark: prompting does not produce real instruction/data separation.
Key papers: Spotlighting · BIPIA (KDD'25) · Can LLMs Separate Instructions from Data? (ICLR'25) · DefensiveTokens · PI as Role Confusion (ICML'26)
Train the model itself to give priority to system and user instructions over text found in data.
Deployed at frontier labs
Needs weight access; no runtime cost; small utility change (MMLU 86.3 to 85.9).
Meta SecAlign-70B: AgentDojo ASR 14.7% to 1.9%, InjecAgent 53.8% to 0.5%. SecAlign: optimization attacks 97% to 8%. Anthropic reports 1% ASR for Claude Opus 4.5 against a Best-of-N attacker (vendor).
Meta SecAlign 2% to 96% under adaptive search; RL-Hammer 72% against GPT-5 with instruction hierarchy; white-box attention attack 85–95% on SecAlign/StruQ; poisoned SFT backdoor 96–100%.
Key papers: The Instruction Hierarchy · StruQ (USENIX Sec'25) · SecAlign (CCS'25) · Meta SecAlign · ASIDE (ICLR'26) · RL-Hammer
Separate planning from untrusted data so that text read from the world cannot change what the agent decides to do; track provenance with labels and enforce policies at tool calls.
Benchmarked prototypes; code released
Utility tax (CaMeL about 2.8x tokens; travel tasks degrade); policy authoring burden.
CaMeL: 77% of AgentDojo tasks with provable security vs 84% undefended. FIDES, DRIFT, IPIGuard, SPA, RTBAS: static ASR about 0–1.7%.
Guarantees hold against control-flow hijack by construction, but no independent white-box adaptive evaluation yet; side channels and data-dependent control flow remain open.
Key papers: CaMeL · FIDES · IsolateGPT (NDSS'25) · ACE (NDSS'26) · Design Patterns for Securing LLM Agents · SPA
Check each proposed tool call against a policy, a symbolic rule, a judge model or a counterfactual test before it executes.
Adopted; production blocking monitors exist
Milliseconds for symbolic engines; about 2x calls for MELON; −3 to −5 utility points for judges.
MELON 0.24–1.27%, Progent 39.9% to 1.0%, Task Shield 2.07%, LlamaFirewall 17.6% to 1.75%, AgentArmor 3% (AgentDojo).
All 8 IPI defenses bypassed above 50%; 12 defenses above 90%; MELON 76–95%. Progent held at 2.6% under a hand-crafted adaptive attack (weak model, black-box only).
Key papers: Progent · MELON (ICML'25) · AgentSpec (ICSE'26) · ShieldAgent (ICML'25) · GuardAgent (ICML'25) · Firewalls or stronger benchmarks?
Assume the agent may be compromised or misaligned; watch trajectories or chains of thought with trusted monitors and escalate, resample or edit suspicious actions.
Moving to production (Claude Code Auto Mode, Codex Guardian)
Monitor calls plus a small human audit budget (about 2%).
AI Control trusted editing: 92% safety at 94% usefulness. Ctrl-Z resampling: attack success 58% to 7% at 5% cost. Best SHADE-Arena monitor AUC 0.87.
Frontier models 'consistently evade' monitors by injecting them; production blocking monitors bypassed in 79% of trials; CoT monitoring degrades under optimization pressure.
Key papers: AI Control (ICML'24) · Ctrl-Z · SHADE-Arena · Adaptive attacks on trusted monitors · Red-Teaming Auto Mode · CoT Monitorability
Bound what a compromised agent can reach: least-privilege permissions, task-scoped credentials, authenticated delegation, signed tools and execution sandboxes.
Concepts and prototypes; OAuth in MCP deployed but misconfigured
Low runtime overhead; high integration and UX cost.
Permission prediction 85.1% accuracy (IEEE S&P'26); MiniScope 1–6% latency.
Measurement: 40.55% of 7,973 remote MCP servers expose tools without authentication; all 119 OAuth servers tested had flaws (9 CVEs); denylist enforcement in coding agents fails 69–98%.
Key papers: Authenticated Delegation (ICML'25 position) · SAGA (NDSS'26) · Automating Data Access Permissions (S&P'26) · Authentication in remote MCP servers · MiniScope · Balkanization of execution-security research
Read the model's own activations, attention or behavior to tell when it has started following injected text, or test causally whether an action came from the user.
Benchmarked prototypes; no verified deployment
Cheap linear probes but white-box access required; counterfactuals double compute.
Attention Tracker AUROC 0.97–1.00; InstructDetector 99.6% accuracy; hidden-state probes AUROC above 0.90 and AgentDojo ASR 34.6% to 0%; AttriGuard 0% static ASR.
MELON 76–95% under adaptive attack; obfuscated activations drop latent-probe recall from 100% to 0% (jailbreak setting); probe validity questioned.
Key papers: TaskTracker (SaTML'25) · Attention Tracker · Rennervate (NDSS'26) · AttriGuard (USENIX Sec'26) · IPI exposure in hidden states
Ask a person to confirm high-risk actions, supervise sensitive sessions, or scope what the agent may do.
Most deployed (runtime approval in 15 of 21 production agents)
Autonomy and user attention; approval fatigue.
Operator confirmation recall 92%; Claude for Chrome all mitigations 23.6% to 11.2% ASR; Verifiable Action Card 0% ASR on a 24-scenario benchmark.
Users fall for fine-print injections; approval can be substituted after the fact (Loopjacking in Agno, LangGraph, OpenClaw); low-harm goals look like legitimate work.
Key papers: Reframing agent security as agent–human interaction · How Agents Ask for Permission · Loopjacking · Verifiable Action Card · Fine-print injections
What each research line does, how far along it is, the headline results, and the main weakness of the line itself.
| Family | Papers | Method styles | Maturity | Headline results | Weakness of the research line | Key papers |
|---|---|---|---|---|---|---|
| A1 Direct misuse & agent jailbreaks | 110 | Curated harmful-task suites in sandboxed tools, web or OS; jailbreak templates transferred to agents | Benchmarked; used in vendor system cards | Chat refusal training transfers poorly: GPT-4o browser agent attempted 98/100 harmful behaviors; CUAHarm up to 90% harmful-task success; SafeArena GPT-4o completes 34.7%. | Most suites score attempts, not realized harm; judge agreement F1 about 0.76–0.79. | AgentHarm (ICLR'25) BrowserART OS-Harm CUAHarm |
| A2 Indirect prompt injection | 75 | Hand-crafted templates; gradient, fuzzing, RL and LLM-optimizer attacks; crowdsourced corpora; benign-looking goals | Most mature attack line | Static: InjecAgent GPT-4 24%; single-turn frontier 0–1%. Adaptive: 50–96% against published defenses; PIMiner 86.7% vs Gemini-2.5-Pro on AgentDojo; Gray Swan: 60k+ violations, nearly every agent broken within 10–100 queries. | No agreed adaptive budget; ASR definitions differ (attempt vs partial vs full goal). | Greshake et al. InjecAgent AgentDojo The Attacker Moves Second AutoDojo ART / Gray Swan |
| A3 Tool, MCP & skill supply chain | 46 | Tool-description poisoning, rug pulls, optimized tool documents, malicious servers and skills, ecosystem measurement | Concept to large in-the-wild measurement in about 18 months | MCPTox 72.8% ASR (o1-mini), refusals under 3%; Skill-Inject up to 80%; 157 malicious skills among 98,380; stronger models more vulnerable (MSB). | Duplicated taxonomies; scanners flag 96.9% of servers with under 50% true positives. | MCPTox MCP Security Bench (ICLR'26) Malicious Agent Skills in the Wild (USENIX Sec'26) MCPZoo |
| A4 Memory, RAG & knowledge poisoning | 40 | Knowledge-corruption optimization, trigger optimization in embedding space, query-only memory injection, persistent/compositional poisoning | Benchmarked; moving to persistent state | PoisonedRAG 90% with 5 texts; AgentPoison above 80% at under 0.1% poison rate; skill-evolution poisoning 91%. | Headline ASRs often measured with empty memories; realistic memory cuts success sharply. | PoisonedRAG (USENIX Sec'25) AgentPoison MINJA MemPoison |
| A5 Backdoors & training-time | 40 | Reasoning-step and observation-triggered backdoors; emergent misalignment from narrow fine-tuning | Prototype | Agents 'suffer severely' from backdoors; textual backdoor defenses fail. | Few agent-specific backdoor defenses. | Watch Out for Your Agents Emergent Misalignment |
| A6 Multi-agent propagation & collusion | 29 | Self-replicating prompts (worms), infectious jailbreaks, agent-in-the-middle, orchestrator hijack, emergent collusion | Prototype, toy topologies | Orchestrator hijack: arbitrary code execution 58–90% even when individual agents refuse; infectious jailbreak across 1M agents. | No realistic A2A/MCP-delegation benchmark; propagation rarely measured at scale. | Morris II worm Agent Smith (ICML'24) MAS execute arbitrary code Open Challenges in Multi-Agent Security |
| A7 Computer-use, GUI & web agents | 16 | Environmental injection, adversarial pop-ups and ads, pixel perturbations, step-decomposed injections | Benchmarked (ICLR/NeurIPS) | Pop-ups 86% ASR; VPI-Bench up to 100% on browser agents; RTC-Bench Claude 4.5 Sonnet CUA 60%; step splitting raises GPT-5.4-mini 41.7% to 72.9%. | Attempt rates (up to 92.5%) exceed completion; security partly reflects low capability, so risk grows with capability. | EIA (ICLR'25) Adversarial pop-ups (ACL'25) RedTeamCUA (ICLR'26) WASP |
| A8 Coding agents | 15 | Poisoned repos, issues, rules and memory files; install-time supply chain; harness bypass | Evaluated on production tools (Cursor, Claude Code, Codex) | 66.5% of malicious issues pass every guardrail; AIShellJack up to 84%; injection bypasses Auto Mode in 79%; nearly every model installs untrusted npm/Cargo dependencies. | Results perishable as products change; harness and task matter as much as the model. | RedCode Your AI, My Shell IssueTrojanBench Setup Complete, Now You Are Compromised |
| A9 Privacy leakage & exfiltration | 70 | PII extraction via environment injection; data-minimization benchmarks; tool-mediated exfiltration | Benchmarked | EIA up to 70% PII-specific ASR; agents over-process private data (AgentDAM). | Contextual-integrity specifications for agents are immature. | AgentDAM EIA |
| A10 Availability & resource abuse | 20 | Malfunction amplification, loops, skill bloat, cost inflation | Prototype | Malfunction amplification above 80% failure; self-examination detection fails. | Denial-of-wallet largely unmeasured. | Breaking Agents: malfunction amplification |
| A11 Agents as attackers | 69 | Exploit-generation agents, CTF benchmarks, CVE reproduction, bug-bounty tasks, multi-host campaigns | Benchmarked; real-world use documented | GPT-4 exploited 87% of one-day CVEs with descriptions (7% without); BountyBench exploit up to 67.5% vs detect 12.5%; CyberGym about 20% with 34 zero-days found; Incalmo 37/40 multi-host assets. | Heterogeneous yardsticks; contamination; little testing against defender deception. | LLM agents exploit one-day vulns Cybench (ICLR'25) CyberGym BountyBench |
| A12 Misalignment, sabotage & reward hacking | 30 | Constructed-incentive evaluations, sabotage-plus-monitor games, reward-hacking probes, training-intervention stress tests | Benchmarked; cited in system cards | Shutdown sabotage up to 97%; SHADE-Arena sabotage 27%; o3 covert actions 13% to 0.4% after anti-scheming training; 57.1% of runs reward-hack in BaitBench. | Artificial goal nudges; evaluation awareness confounds results. | In-context scheming Agentic Misalignment Shutdown resistance Anti-scheming training |
Benchmarks are the currency of the field, and several now have documented validity problems.
| Benchmark | Scope | Size | Notable result |
|---|---|---|---|
| AgentDojo | Tool agents, IPI | 97 tasks, 629 security cases | De-facto standard; saturable by simple firewalls |
| InjecAgent | Tool agents, IPI | 1,054 cases | ReAct GPT-4 24%, about 2x with hacking prompt |
| ASB (ICLR'25) | 10 scenarios, 400+ tools | 27 attacks/defenses, 13 backbones | Highest average ASR 84.3% |
| AgentHarm (ICLR'25) | Harmful user requests | 110 tasks (440 augmented) | High compliance without jailbreaks |
| Agent-SafetyBench | General agent safety | 2,000 cases, 349 environments | No agent of 16 scores above 60% |
| WASP | Web agents, end-to-end IPI | Realistic attacker | Up to 86% partial success, rare full completion |
| RedTeamCUA (ICLR'26) | Hybrid web+OS CUAs | 864 examples | Claude 4.5 Sonnet CUA 60%; attempts up to 92.5% |
| VPI-Bench (ICLR'26) | Visual injection | 306 cases, 5 platforms | Browser agents deceived up to 100% |
| OS-Harm | OSWorld CUAs | 150 tasks | Models comply with much misuse |
| MCPTox | MCP tool poisoning | 1,312 cases, 45 servers | o1-mini 72.8% |
| MSB (ICLR'26) | MCP end to end | 2,000 instances, 405 tools | Stronger models more vulnerable |
| b3 | Backbone security snapshots | 194,331 attacks, 34 LLMs | Reasoning helps; size does not |
| ART / Gray Swan | Crowd red teaming | 1.8M attacks, 22 agents | 60k+ violations |
| SHADE-Arena | Sabotage vs monitors | Task pairs | 27% sabotage; monitor AUC 0.87 |
| RedCode | Code agents | 4,050 exec + 160 gen | Natural-language requests lower rejection |
| CyberGym | Vuln reproduction | 1,507 vulns, 188 projects | About 20%; 34 zero-days |
| Adaptive Adversaries | Multi-turn adaptive | 21 scenarios x 15 rounds | Single-turn 0–1% vs multi-turn 5.4–14% |
Taxonomies in these papers fall into five families: component-based (brain, memory, tools), adversary-based, lifecycle-based, boundary or information-flow based, and socio-technical.
| Survey | Organizing taxonomy and notable claims |
|---|---|
| Attack and Defense Landscape of Agentic AI (USENIX Sec'26) | Attack vectors V1–V6, risks R1–R7, 4 defense groups; flags side channels as unstudied |
| Toward Secure LLM Agents (247 papers) | Information flow, delegated authority, persistent state; 10 gaps; 169/247 papers are preprints |
| Security and Privacy in Agentic AI: Grand Challenges | 30-expert horizon scan; 25 challenges in accountability, consent, oversight, resilience |
| Agentic AI Security (IEEE Access 2026) | Threats, evaluation, technical and governance defenses |
| Landscape of PI Threats in LLM Agents | Heuristic vs optimization attacks; text/model/execution-level defenses |
| MCP: Landscape, Threats, Future Directions | MCP lifecycle, 4 attacker types x 16 scenarios |
| Open Challenges in Multi-Agent Security | Collusion, swarm attacks, network effects |
| Balkanization of Execution-Security Research (coding agents) | 17 categories over 39 papers; 5 gaps |
| Long-Term Memory Security in LLM Agents | 6 memory lifecycle phases x CIA + governance |
| SoK: Rethinking Jailbreaking in the Era of Agentic AI | Component-level taxonomy; outcome-level evaluation |
Twenty-two problems grouped into six themes. Each lists why it is still open and the directions that look promising, with the papers behind it.
OP1
Why open Defenses are still reported against fixed attack strings; 12 defenses reporting near-zero ASR fell above 90%.
Directions Standard adaptive budgets (RL attackers, LLM optimizers) shipped inside benchmarks; reviewer checklists.
OP2
Why open Firewalls saturate four benchmarks; mislabeled successes; exploitable evaluation protocols.
Directions Benchmark auditing tools, living/versioned benchmarks, published judge agreement.
OP3
Why open Attempt, partial and full-goal rates differ by up to 2x.
Directions Report (attempt, partial, full-impact) conditioned on benign capability (CuP, NRP-style metrics).
OP13
Why open A probe with AUC 0.998 fails a careful protocol; guard models fail in DoomArena.
Directions Hard benign negatives, adaptive evasion tests, calibrated abstention.
OP4
Why open Multi-turn adaptive attackers raise ASR 5–14x over single-turn; step decomposition adds more.
Directions Cross-session benchmarks, delayed triggers, attacker agents that plan across episodes.
OP7
Why open Orchestrators run attacker code 58–90% even when each agent refuses; threat models 'underdeveloped'.
Directions Realistic A2A/MCP benchmarks, propagation models, containment and IFC between agents.
OP8
Why open Compositional and dormant memory poisoning evades write-time defenses; skill evolution poisoned at 91%.
Directions Storage-time provenance, versioning and rollback; evaluation with realistic pre-populated memory.
OP5
Why open 'Follow the README' and 'do what the email says' are real tasks; AutoDojo reaches 64% on action-open tasks.
Directions Intent-grounded authorization, contextual-integrity specs, asking the user when provenance is ambiguous.
OP6
Why open Hidden goals are 'behaviorally indistinguishable' from legitimate work; payloads hidden in code examples.
Directions Provenance tracking over actions and effects rather than text; data-flow policies.
OP10
Why open Stronger models are more exploitable; robustness does not scale with size.
Directions Hierarchies that scale with capability; mechanistic study of instruction provenance.
OP22
Why open Defenses are 'weakly compositional'; integrating model- and system-level layers is open.
Directions Adaptive evaluation of stacked defenses; formal composition arguments; security-utility-latency Pareto reporting.
OP9
Why open 157 malicious skills in 98k; scanners with under 50% true positives; malicious servers cost almost nothing.
Directions Dynamic verification, signed and attested tools, rug-pull detection, composition-aware scanning.
OP11
Why open 66.5% of malicious issues pass all guardrails; denylists fail 69–98%; Auto Mode bypassed 79%.
Directions Shared isolation benchmarks, verified reference monitors, TOCTOU and MCP state validation as one problem.
OP12
Why open Sub-5%-pixel perturbations reach 67%; pop-ups 86%; agents grant permission dialogs to finish tasks.
Directions Render-consistent observations, trusted UI channels, OS-level mediation.
OP19
Why open The USENIX'26 survey found no prior work on side channels in agent systems.
Directions Leakage via tool-call patterns and timing; covert agent-to-agent channels.
OP20
Why open Out-of-scope actions up to 17.1% under benign prompts; state-modifying MCP tools rose from 27% to 65%.
Directions Task-scoped capabilities, automatically inferred minimal policies, permission UX.
OP14
Why open Best monitor AUC 0.87; training-data sabotage caught under half the time.
Directions Monitors that execute artifacts; trusted editing and resampling; red-team policies trained against monitors.
OP15
Why open Models behave differently when they believe a scenario is real; CoT legibility is degrading.
Directions Deployment-indistinguishable evaluations, internal-state probes, CoT-independent monitoring.
OP16
Why open 57.1% of runs hack; score inflation 0.45–1.00 on some benchmarks.
Directions Robust graders, escalation channels, training against shortcuts.
OP17
Why open Narrow fine-tuning yields broad misalignment; shutdown sabotage up to 97%.
Directions Mechanistic explanation, agentic RL audits, trajectory data provenance.
OP18
Why open Yardsticks range from CTF to bounty dollars; one-day exploitation drops 87% to 7% without CVE text.
Directions Unified, refreshed cyber ranges; human-uplift studies; defender-deception benchmarks.
OP21
Why open 25 grand challenges incl. meaningful oversight, consent revocation, continuous certification.
Directions Legible trajectories, privacy-preserving audit logs, measurable oversight designs.
All 1,472 in-scope papers. Search titles, methods and summaries; filter by family, target, maturity and year. Classifications for the long tail come from titles and list annotations, so treat them as a starting point.
| Date | Paper | Family | Target | Type | Maturity | Venue |
|---|