{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,23]],"date-time":"2026-10-23T19:15:18Z","timestamp":1792782918773,"version":"4.5.0"},"reference-count":408,"publisher":"Springer Science and Business Media LLC","issue":"8","license":[{"start":{"date-parts":[[2026,5,9]],"date-time":"2026-05-09T00:00:00Z","timestamp":1778284800000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2026,7,3]],"date-time":"2026-07-03T00:00:00Z","timestamp":1783036800000},"content-version":"vor","delay-in-days":55,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"funder":[{"name":"Smart Gird-National Science and Technology MajorProject","award":["No.2024ZD0803000"],"award-info":[{"award-number":["No.2024ZD0803000"]}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Artif Intell Rev"],"abstract":"<jats:title>Abstract<\/jats:title>\n                  <jats:p>Large language model (LLM) agents are rapidly being integrated into real-world systems. Their autonomy and tool-use capabilities generate substantial value while simultaneously expanding the security attack surface. This survey provides a comprehensive overview of the opportunities and challenges of LLM agents in security, focusing on two core areas: (1) threats to LLM agents themselves and corresponding mitigation strategies (LLM agents self-security), and (2) the role of LLM agents in empowering the cybersecurity lifecycle across offense and defense (LLM agents empowered cybersecurity). We first examine the internal and external attack surfaces of agents, propose a taxonomy organized by threat sources, and analyze associated mitigations and evaluation frameworks. We then investigate how agent capabilities are applied in cybersecurity practice and present, to our knowledge, the first agent-empowerment framework aligned with the full cyber offense\u2013defense lifecycle. By systematically surveying these two areas, we are the first to highlight a positive feedback synergy between LLM agents self-security and empowered cybersecurity, offering new insights for the advancement of both. We further identify current limitations and outline promising directions for future research. The insights provided aim to catalyze the coordinated development of LLM agents self-security and agent empowered cybersecurity, paving the way for more capable and robust agent applications.<\/jats:p>","DOI":"10.1007\/s10462-026-11563-0","type":"journal-article","created":{"date-parts":[[2026,5,9]],"date-time":"2026-05-09T13:45:26Z","timestamp":1778334326000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":3,"title":["LLM agents security duality: a comprehensive survey of self-security and empowered cybersecurity"],"prefix":"10.1007","volume":"59","author":[{"given":"Yiwei","family":"Xu","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yong","family":"Zhuang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Xuanming","family":"Liu","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Tian","family":"Zhang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Bowen","family":"Xiao","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Xiaoyang","family":"Xu","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Delong","family":"Jiang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Juan","family":"Wang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Hongxin","family":"Hu","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2026,5,9]]},"reference":[{"key":"11563_CR1","unstructured":"Abdelnabi S, Fay A, Salem A, et al. (2025) Llmail-inject: a dataset from a realistic adaptive prompt injection challenge. arXiv:2506.09956"},{"key":"11563_CR2","unstructured":"Abdelnabi S, Fritz M (2023) Fact-saboteurs: a taxonomy of evidence manipulation attacks against fact-verification systems. In: 32nd USENIX security symposium (USENIX Security 23). USENIX Association, Anaheim, CA, pp 6719\u20136736, https:\/\/www.usenix.org\/conference\/usenixsecurity23\/presentation\/abdelnabi"},{"key":"11563_CR3","unstructured":"Abdelnabi S, Gomaa A, Sivaprasad S, et al. (2024) Llm-deliberation: evaluating llms with interactive multi-agent negotiation game. In: ICLR 2024 Workshop on Large Language Model (LLM) Agents"},{"key":"11563_CR4","doi-asserted-by":"publisher","first-page":"69941","DOI":"10.1109\/ACCESS.2024.3393548","volume":"12","author":"AH Abdi","year":"2024","unstructured":"Abdi AH, Audah L, Salh A et al. (2024) Security control and data planes of sdn: a comprehensive review of traditional, ai, and mtd approaches to security solutions. IEEE Access 12:69941\u201369980. https:\/\/doi.org\/10.1109\/ACCESS.2024.3393548","journal-title":"IEEE Access"},{"key":"11563_CR5","doi-asserted-by":"publisher","unstructured":"Afane K, Wei W, Mao Y, et al. (2024) Next-generation phishing: how llm agents empower cyber attackers. In: 2024 IEEE International Conference on Big Data (BigData), pp 2558\u20132567, https:\/\/doi.org\/10.1109\/BigData62323.2024.10825018","DOI":"10.1109\/BigData62323.2024.10825018"},{"key":"11563_CR6","doi-asserted-by":"publisher","unstructured":"Agarwal D, Fabbri A, Risher B, et al. (2024) Prompt leakage effect and mitigation strategies for multi-turn LLM applications. In: Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing: Industry Track, pp 1255\u20131275, https:\/\/doi.org\/10.18653\/v1\/2024.emnlp-industry.94","DOI":"10.18653\/v1\/2024.emnlp-industry.94"},{"issue":"6","key":"11563_CR7","first-page":"717","volume":"35","author":"A Ahmad","year":"2015","unstructured":"Ahmad A, Maynard SB, Shanks G (2015) A case analysis of information systems and security incident responses. Int J Inf Manage 35(6):717\u2013723","journal-title":"Int J Inf Manage"},{"issue":"10","key":"11563_CR8","doi-asserted-by":"publisher","first-page":"10733","DOI":"10.1007\/s10462-023-10437-z","volume":"56","author":"R Ahmad","year":"2023","unstructured":"Ahmad R, Alsmadi I, Alhamdani W et al. (2023) Zero-day attack detection: a systematic literature review. Artif Intell Rev 56(10):10733\u201310811. https:\/\/doi.org\/10.1007\/s10462-023-10437-z","journal-title":"Artif Intell Rev"},{"key":"11563_CR9","doi-asserted-by":"publisher","unstructured":"Ai L, Kumarage TS, Bhattacharjee A, et al. (2024) Defending against social engineering attacks in the age of LLMs. In: Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pp 12880\u201312902, https:\/\/doi.org\/10.18653\/v1\/2024.emnlp-main.716","DOI":"10.18653\/v1\/2024.emnlp-main.716"},{"key":"11563_CR10","doi-asserted-by":"publisher","first-page":"66","DOI":"10.1016\/j.artint.2018.01.002","volume":"258","author":"SV Albrecht","year":"2018","unstructured":"Albrecht SV, Stone P (2018) Autonomous agents modelling other agents: a comprehensive survey and open problems. Artif Intell 258:66\u201395. https:\/\/doi.org\/10.1016\/j.artint.2018.01.002","journal-title":"Artif Intell"},{"key":"11563_CR11","unstructured":"Ali T (2024) Next-generation intrusion detection systems with llms: real-time anomaly detection, explainable ai, and adaptive data generation. Master\u2019s thesis, T. Ali"},{"issue":"1","key":"11563_CR12","doi-asserted-by":"publisher","first-page":"8842","DOI":"10.1038\/s41598-022-10841-5","volume":"12","author":"A Aljofey","year":"2022","unstructured":"Aljofey A, Jiang Q, Rasool A et al. (2022) An effective detection approach for phishing websites using URL and HTML features. Sci Rep 12(1):8842","journal-title":"Sci Rep"},{"key":"11563_CR13","doi-asserted-by":"publisher","unstructured":"Amayuelas A, Yang X, Antoniades A, et al. (2024) MultiAgent collaboration attack: investigating adversarial attacks in large language model collaborations via debate. In: Findings of the Association for Computational Linguistics: EMNLP 2024, pp 6929\u20136948, https:\/\/doi.org\/10.18653\/v1\/2024.findings-emnlp.407","DOI":"10.18653\/v1\/2024.findings-emnlp.407"},{"key":"11563_CR14","unstructured":"Andriushchenko M, Souly A, Dziemian M, et al. (2024) Agentharm: a benchmark for measuring harmfulness of llm agents. arXiv preprint arXiv:2410.09024"},{"key":"11563_CR15","unstructured":"Anthropic (2024) Model context protocol(mcp). https:\/\/docs.anthropic.com\/en\/docs\/agents-and-tools\/mcp"},{"key":"11563_CR16","unstructured":"Anurin A, Ng J, Schaffer K, et al. (2024) Catastrophic cyber capabilities benchmark (3cb): robustly evaluating llm agent cyber offense capabilities. arXiv preprint arXiv:2410.09114"},{"key":"11563_CR17","unstructured":"Athalye A, Carlini N, Wagner D (2018) Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. In: Proceedings of the 35th International Conference on Machine Learning, pp 274\u2013283, https:\/\/proceedings.mlr.press\/v80\/athalye18a.html"},{"key":"11563_CR18","unstructured":"AutoGPT (2023) Autogpt. https:\/\/github.com\/Significant-Gravitas\/AutoGPT"},{"key":"11563_CR19","unstructured":"Ayzenshteyn D, Weiss R, Mirsky Y (2025) Cloak, honey, trap: Proactive defenses against $$\\{$$LLM$$\\}$$ agents. In: 34th USENIX Security Symposium (USENIX Security 25), pp 8095\u20138114"},{"key":"11563_CR20","unstructured":"Ayzenshteyn D, Weiss R, Mirsky Y (2024) The best defense is a good offense: countering llm-powered cyberattacks. arXiv preprint arXiv:2410.15396"},{"key":"11563_CR21","doi-asserted-by":"crossref","unstructured":"Bagdasarian E, Yi R, Ghalebikesabi S, et al. (2024) Airgapagent: protecting privacy-conscious conversational agents. In: Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, pp 3868\u20133882","DOI":"10.1145\/3658644.3690350"},{"key":"11563_CR22","unstructured":"Bagdasaryan E, Hsieh TY, Nassi B, et al. (2023) Abusing images and sounds for indirect instruction injection in multi-modal llms. arXiv preprint arXiv:2307.10490"},{"issue":"11","key":"11563_CR23","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1007\/s10462-025-11338-z","volume":"58","author":"P Balasubramanian","year":"2025","unstructured":"Balasubramanian P, Liyana S, Sankaran H et al. (2025) Generative ai for cyber threat intelligence: applications, challenges, and analysis of real-world case studies. Artif Intell Rev 58(11):1\u2013134. https:\/\/doi.org\/10.1007\/s10462-025-11338-z","journal-title":"Artif Intell Rev"},{"key":"11563_CR24","doi-asserted-by":"crossref","unstructured":"Beretas C (2024) Information systems security, detection and recovery from cyber attacks. Universal Library of Engineering Technology 1(1)","DOI":"10.70315\/uloap.ulete.2024.0101005"},{"key":"11563_CR25","doi-asserted-by":"publisher","unstructured":"Bianou SG, Batogna RG (2024) Pentest-ai, an llm-powered multi-agents framework for penetration testing automation leveraging mitre attack. In: 2024 IEEE International Conference on Cyber Security and Resilience (CSR), pp 763\u2013770, https:\/\/doi.org\/10.1109\/CSR61664.2024.10679480","DOI":"10.1109\/CSR61664.2024.10679480"},{"key":"11563_CR26","unstructured":"Biggio B, Nelson B, Laskov P, et al. (2012) Poisoning attacks against support vector machines. In: Proceedings of the 29th International Conference on Machine Learning, ICML 2012, ArXiv e-prints, pp 1807\u20131814"},{"issue":"6","key":"11563_CR27","doi-asserted-by":"publisher","DOI":"10.1073\/pnas.2218523120","volume":"120","author":"M Binz","year":"2023","unstructured":"Binz M, Schulz E (2023) Using cognitive psychology to understand gpt-3. Proc Natl Acad Sci 120(6):e2218523120","journal-title":"Proc Natl Acad Sci"},{"key":"11563_CR28","unstructured":"Bisson D (2015) Sony hackers used phishing emails to breach company networks. https:\/\/www.tripwire.com\/state-of-security\/sony-hackers-used-phishing-emails-to-breach-company-networks"},{"key":"11563_CR29","unstructured":"Brown T, Mann B, Ryder N, et al. (2020a) Language models are few-shot learners. In: Larochelle H, Ranzato M, Hadsell R, et al. (eds) Advances in Neural Information Processing Systems, vol\u00a033. Curran Associates, Inc., pp 1877\u20131901, https:\/\/proceedings.neurips.cc\/paper_files\/paper\/2020\/file\/1457c0d6bfcb4967418bfb8ac142f64a-Paper.pdf"},{"key":"11563_CR30","first-page":"1877","volume":"33","author":"T Brown","year":"2020","unstructured":"Brown T, Mann B, Ryder N et al. (2020b) Language models are few-shot learners. Adv Neural Inf Process Syst 33:1877\u20131901","journal-title":"Adv Neural Inf Process Syst"},{"key":"11563_CR31","unstructured":"Bryniarski O, Hingun N, Pachuca P, et al. (2022) Evading adversarial example detection defenses with orthogonal projected gradient descent. In: International Conference on Learning Representations"},{"key":"11563_CR32","unstructured":"C D (2025) Prompt injection is not sql injection (it may be worse). https:\/\/www.ncsc.gov.uk\/blog-post\/prompt-injection-is-not-sql-injection"},{"key":"11563_CR33","doi-asserted-by":"publisher","unstructured":"Cao T, Huang C, Li Y, et al. (2025) Phishagent: a robust multimodal agent for phishing webpage detection. In: Proceedings of the AAAI Conference on Artificial Intelligence, pp 27869\u201327877, https:\/\/doi.org\/10.1609\/aaai.v39i27.35003","DOI":"10.1609\/aaai.v39i27.35003"},{"key":"11563_CR34","unstructured":"Carauleanu M, Vaiana M, Rosenblatt J, et al. (2024) Towards safe and honest ai agents with neural self-other overlap. In: Neurips Safe Generative AI Workshop 2024"},{"key":"11563_CR35","unstructured":"Carlini N (2023) A llm assisted exploitation of ai-guardian. arXiv preprint arXiv:2307.15008"},{"key":"11563_CR36","unstructured":"Carlini N, Rando J, Debenedetti E, et al. (2025) Autoadvexbench: benchmarking autonomous exploitation of adversarial example defenses. arXiv preprint arXiv:2503.01811"},{"key":"11563_CR37","unstructured":"Cemri M, Pan MZ, Yang S, et al. (2025) Why do multi-agent llm systems fail? arXiv preprint arXiv:2503.13657"},{"key":"11563_CR38","doi-asserted-by":"crossref","unstructured":"Cha SK, Avgerinos T, Rebert A, et al. (2012) Unleashing mayhem on binary code. In: 2012 IEEE Symposium on Security and Privacy, IEEE, pp 380\u2013394","DOI":"10.1109\/SP.2012.31"},{"key":"11563_CR39","unstructured":"Chan CM, Yu J, Chen W, et al. (2024) Agentmonitor: a plug-and-play framework for predictive and secure multi-agent systems. arXiv preprint arXiv:2408.14972"},{"key":"11563_CR40","first-page":"74325","volume":"37","author":"M Chang","year":"2024","unstructured":"Chang M, Zhang J, Zhu Z et al. (2024) Agentboard: an analytical evaluation board of multi-turn llm agents. Adv Neural Inf Process Syst 37:74325\u201374362","journal-title":"Adv Neural Inf Process Syst"},{"key":"11563_CR41","unstructured":"Changjiang L, Jiacheng L, Bochuan C, et al. (2025) Your agent can defend itself against backdoor attacks. arXiv:2506.08336"},{"key":"11563_CR42","doi-asserted-by":"publisher","unstructured":"Chao P, Robey A, Dobriban E, et al. (2025) Jailbreaking black box large language models in twenty queries. In: 2025 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML), pp 23\u201342, https:\/\/doi.org\/10.1109\/SaTML64287.2025.00010","DOI":"10.1109\/SaTML64287.2025.00010"},{"key":"11563_CR43","doi-asserted-by":"publisher","unstructured":"Chen H, Lu G, Wu X, et al. (2021) Joint extraction of entities and relations by adversarial training and mixup data augmentation. In: 2021 7th International Conference on Computer and Communications (ICCC), pp 1486\u20131490, https:\/\/doi.org\/10.1109\/ICCC54389.2021.9674630","DOI":"10.1109\/ICCC54389.2021.9674630"},{"key":"11563_CR44","doi-asserted-by":"publisher","first-page":"130185","DOI":"10.52202\/079017-4136","volume":"37","author":"Z Chen","year":"2024","unstructured":"Chen Z, Xiang Z, Xiao C et al. (2024) Agentpoison: red-teaming llm agents via poisoning memory or knowledge bases. Adv Neural Inf Process Syst 37:130185\u2013130213","journal-title":"Adv Neural Inf Process Syst"},{"key":"11563_CR45","doi-asserted-by":"crossref","unstructured":"Chen Y, Hu X, Yin K, et al. (2025a) Evaluating the robustness of multimodal agents against active environmental injection attacks. arXiv preprint arXiv:2502.13053","DOI":"10.1145\/3746027.3755646"},{"key":"11563_CR46","doi-asserted-by":"publisher","unstructured":"Cheng X, Li J, Zhao X, et al. (2024) Small agent can also rock! empowering small language models as hallucination detector. In: Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pp 14600\u201314615, https:\/\/doi.org\/10.18653\/v1\/2024.emnlp-main.809","DOI":"10.18653\/v1\/2024.emnlp-main.809"},{"key":"11563_CR47","unstructured":"Chen Z, Kang M, Li B (2025b) Shieldagent: shielding agents via verifiable safety policy reasoning. arXiv preprint arXiv:2503.22738"},{"key":"11563_CR48","doi-asserted-by":"crossref","unstructured":"Chen Z, Kang F, Xiong X et al. (2024) A survey on penetration path planning in automated penetration testing. Appl Sci","DOI":"10.3390\/app14188355"},{"key":"11563_CR49","unstructured":"Chen L, Li S, Yan J, et al. (2024a) Alpagasus: training a better alpaca with fewer data. In: The Twelfth International Conference on Learning Representations"},{"key":"11563_CR50","unstructured":"Chen S, Piet J, Sitawarin C, et al. (2024b) Struq: defending against prompt injection with structured queries. arXiv preprint arXiv:2402.06363"},{"key":"11563_CR51","unstructured":"Chen W, Su Y, Zuo J, et al. (2024c) Agentverse: facilitating multi-agent collaboration and exploring emergent behaviors. In: The Twelfth International Conference on Learning Representations"},{"key":"11563_CR52","unstructured":"Chern S, Fan Z, Liu A (2024) Combating adversarial attacks with multi-agent debate. arXiv preprint arXiv:2401.05998"},{"key":"11563_CR53","doi-asserted-by":"publisher","first-page":"93","DOI":"10.1613\/jair.1391","volume":"22","author":"H Chockler","year":"2004","unstructured":"Chockler H, Halpern JY (2004) Responsibility and blame: a structural-model approach. J Artif Intell Res 22:93\u2013115","journal-title":"J Artif Intell Res"},{"issue":"61","key":"11563_CR54","first-page":"1","volume":"800","author":"P Cichonski","year":"2012","unstructured":"Cichonski P, Millar T, Grance T et al. (2012) Computer security incident handling guide. NIST Spec Publ 800(61):1\u2013147","journal-title":"NIST Spec Publ"},{"key":"11563_CR55","unstructured":"Cline (n.d.) Mcp marketplace. https:\/\/cline.bot\/mcp-marketplace"},{"key":"11563_CR56","doi-asserted-by":"publisher","unstructured":"Conti M, Dargahi T, Dehghantanha A (2018) Cyber threat intelligence: challenges and opportunities, Springer International Publishing, Cham, pp 1\u20136. https:\/\/doi.org\/10.1007\/978-3-319-73951-9_1","DOI":"10.1007\/978-3-319-73951-9_1"},{"key":"11563_CR57","unstructured":"Cui C, Deng G, Zhang A, et al. (2024) Safe+ safe= unsafe? Exploring how safe images can be exploited to jailbreak large vision-language models. arXiv preprint arXiv:2411.11496arXiv:2411.11496"},{"key":"11563_CR58","unstructured":"Curvo PM (2025) The traitors: deception and trust in multi-agent language model simulations. arXiv preprint arXiv:2505.12923"},{"key":"11563_CR59","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2019.101613","volume":"88","author":"CMR da Silva","year":"2020","unstructured":"da Silva CMR, Feitosa EL, Garcia VC (2020) Heuristic-based strategy for phishing prediction: a survey of url-based approach. Comput Secur 88:101613","journal-title":"Comput Secur"},{"key":"11563_CR60","unstructured":"DARPA (2016) Cgc: cyber grand challenge. https:\/\/www.darpa.mil\/research\/programs\/cyber-grand-challenge"},{"key":"11563_CR61","doi-asserted-by":"publisher","unstructured":"De\u00a0Capitani\u00a0di Vimercati S (2025) Least Privilege, Springer Nature Switzerland, Cham, pp 1413\u20131414. https:\/\/doi.org\/10.1007\/978-3-030-71522-9_820,","DOI":"10.1007\/978-3-030-71522-9_820"},{"key":"11563_CR62","doi-asserted-by":"publisher","unstructured":"De\u00a0Santis F, Huang K, Valentim R, et al. (2025) Cfa-bench: cybersecurity forensic llm agent benchmark and testing. In: 2025 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW), pp 217\u2013225https:\/\/doi.org\/10.1109\/EuroSPW67616.2025.00031","DOI":"10.1109\/EuroSPW67616.2025.00031"},{"key":"11563_CR63","unstructured":"de\u00a0Witt CS (2025) Open challenges in multi-agent security: towards secure systems of interacting ai agents. arXiv preprint arXiv:2505.02077"},{"key":"11563_CR64","doi-asserted-by":"crossref","unstructured":"Debenedetti E, Zhang J, Balunovic M, et al. (2024) Agentdojo: a dynamic environment to evaluate prompt injection attacks and defenses for llm agents. In: The Thirty-eight Conference on Neural Information Processing Systems Datasets and Benchmarks Track","DOI":"10.52202\/079017-2636"},{"key":"11563_CR65","unstructured":"Deng G, Liu Y, Mayoral-Vilches V, et al. (2024b) $$\\{$$PentestGPT$$\\}$$: Evaluating and harnessing large language models for automated penetration testing. In: 33rd USENIX Security Symposium (USENIX Security 24), pp 847\u2013864"},{"key":"11563_CR66","unstructured":"Deng G, Ou H, Liu Y, et al. (2024c) Oedipus: Llm-enchanced reasoning captcha solver. arXiv preprint arXiv:2405.07496"},{"key":"11563_CR67","doi-asserted-by":"publisher","unstructured":"Deng Z, Guo Y, Han C, et al. (2025) Ai agents under threat: a survey of key security challenges and future pathways. ACM Comput Surv 57(7). https:\/\/doi.org\/10.1145\/3716628","DOI":"10.1145\/3716628"},{"key":"11563_CR68","doi-asserted-by":"crossref","unstructured":"Deng G, Liu Y, Li Y, et al. (2024a) Masterkey: automated jailbreaking of large language model chatbots. In: NDSS","DOI":"10.14722\/ndss.2024.24188"},{"issue":"3","key":"11563_CR69","doi-asserted-by":"publisher","DOI":"10.1016\/j.tbench.2023.100139","volume":"3","author":"S Dhingra","year":"2023","unstructured":"Dhingra S, Singh M et al. (2023) Mind meets machine: unravelling gpt-4\u2019s cognitive psychology. BenchCouncil Trans Benchmarks Standards Evaluat 3(3):100139. https:\/\/doi.org\/10.1016\/j.tbench.2023.100139","journal-title":"BenchCouncil Trans Benchmarks Standards Evaluat"},{"key":"11563_CR70","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2020.101947","volume":"97","author":"A Dionysiou","year":"2020","unstructured":"Dionysiou A, Athanasopoulos E (2020) Sok: machine vs. machine\u2013a systematic classification of automated machine learning-based captcha solvers. Comput Secur 97:101947. https:\/\/doi.org\/10.1016\/j.cose.2020.101947","journal-title":"Comput Secur"},{"key":"11563_CR71","unstructured":"Dong S, Xu S, He P, et al. (2025) Memory injection attacks on LLM agents via query-only interaction. In: The Thirty-ninth Annual Conference on Neural Information Processing Systems, https:\/\/openreview.net\/forum?id=QINnsnppv8"},{"key":"11563_CR72","unstructured":"Dong T, Xue M, Chen G, et al. (2023) The philosopher\u2019s stone: trojaning plugins of large language models. arXiv preprint arXiv:2312.00374"},{"key":"11563_CR73","unstructured":"Dorn D, Variengien A, Segerie CR, et al. (2024) Bells: a framework towards future proof benchmarks for the evaluation of llm safeguards. In: ICML 2024 Next Generation of AI Safety Workshop"},{"key":"11563_CR74","doi-asserted-by":"publisher","first-page":"28573","DOI":"10.1109\/ACCESS.2018.2831228","volume":"6","author":"A Dorri","year":"2018","unstructured":"Dorri A, Kanhere SS, Jurdak R (2018) Multi-agent systems: a survey. IEEE Access 6:28573\u201328593. https:\/\/doi.org\/10.1109\/ACCESS.2018.2831228","journal-title":"IEEE Access"},{"key":"11563_CR75","unstructured":"Druva (2025) Druva introduces industry\u2019s first ai agents to simplify cyber resilience. https:\/\/www.druva.com\/about\/press-releases\/druva-introduces-ai-agents-to-simplify-cyber-resilience"},{"key":"11563_CR76","doi-asserted-by":"publisher","unstructured":"Du Y, Li S, Torralba A, et al. (2024) Improving factuality and reasoning in language models through multiagent debate. In: Proceedings of the 41st International Conference on Machine Learning, ICML\u201924, https:\/\/doi.org\/10.5555\/3692070.3692537","DOI":"10.5555\/3692070.3692537"},{"key":"11563_CR77","doi-asserted-by":"crossref","unstructured":"Du M, Li F, Zheng G, et al. (2017) Deeplog: anomaly detection and diagnosis from system logs through deep learning. In: Proceedings of the 2017 ACM SIGSAC conference on computer and communications security, pp 1285\u20131298","DOI":"10.1145\/3133956.3134015"},{"issue":"8","key":"11563_CR78","doi-asserted-by":"publisher","first-page":"1035","DOI":"10.1007\/s10514-023-10132-6","volume":"47","author":"A Elhafsi","year":"2023","unstructured":"Elhafsi A, Sinha R, Agia C et al. (2023) Semantic anomaly detection with large language models. Auton Robot 47(8):1035\u20131055. https:\/\/doi.org\/10.1007\/s10514-023-10132-6","journal-title":"Auton Robot"},{"key":"11563_CR79","doi-asserted-by":"publisher","unstructured":"Enoch SY, Kim DD (2024) Model-based attack planning strategies for automated penetration testing exercises. In: 2024 International Conference on Ubiquitous Computing and Communications (IUCC), pp 115\u2013122, https:\/\/doi.org\/10.1109\/IUCC65928.2024.00033","DOI":"10.1109\/IUCC65928.2024.00033"},{"key":"11563_CR80","unstructured":"Evtimov I, Zharmagambetov A, Grattafiori A, et al. (2025) WASP: Benchmarking web agent security against prompt injection attacks. In: The Thirty-ninth Annual Conference on Neural Information Processing Systems Datasets and Benchmarks Track, https:\/\/openreview.net\/forum?id=Ip1cCUAllL"},{"key":"11563_CR81","doi-asserted-by":"publisher","unstructured":"Fairbanks J, Serra E (2024) Generating phishing attacks and novel detection algorithms in the era of large language models. In: 2024 IEEE International Conference on Big Data (BigData), pp 2314\u20132319, https:\/\/doi.org\/10.1109\/BigData62323.2024.10825007","DOI":"10.1109\/BigData62323.2024.10825007"},{"key":"11563_CR82","unstructured":"Fang R, Bindu R, Gupta A, et al. (2024a) Llm agents can autonomously exploit one-day vulnerabilities. arXiv preprint arXiv:2404.08144"},{"key":"11563_CR83","unstructured":"Fang R, Bindu R, Gupta A, et al. (2024b) Llm agents can autonomously hack websites. arXiv preprint arXiv:2402.06664"},{"key":"11563_CR84","unstructured":"Fang R, Bowman D, Kang D (2024c) Voice-enabled ai agents can perform common scams. arXiv preprint arXiv:2410.15650"},{"key":"11563_CR85","doi-asserted-by":"publisher","unstructured":"Feng Z, Guo D, Tang D, et al. (2020) CodeBERT: A pre-trained model for programming and natural languages. In: Cohn T, He Y, Liu Y (eds) Findings of the Association for Computational Linguistics: EMNLP 2020. Association for Computational Linguistics, Online, pp 1536\u20131547, https:\/\/doi.org\/10.18653\/v1\/2020.findings-emnlp.139","DOI":"10.18653\/v1\/2020.findings-emnlp.139"},{"key":"11563_CR86","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1016\/j.iotcps.2025.01.001","volume":"5","author":"MA Ferrag","year":"2025","unstructured":"Ferrag MA, Alwahedi F, Battah A et al. (2025) Generative ai in cybersecurity: a comprehensive review of llm applications and vulnerabilities. Internet Things Cyber Phys Syst 5:1\u201346","journal-title":"Internet Things Cyber Phys Syst"},{"key":"11563_CR87","doi-asserted-by":"publisher","unstructured":"Ferraro A, Galli A, La\u00a0Gatta V, et al. (2024) Agent-based modelling meets generative ai in social network simulations. In: International Conference on Advances in Social Networks Analysis and Mining, pp 155\u2013170, https:\/\/doi.org\/10.1007\/978-3-031-78541-2_10","DOI":"10.1007\/978-3-031-78541-2_10"},{"key":"11563_CR88","doi-asserted-by":"publisher","unstructured":"Fieblinger R, Alam MT, Rastogi N (2024) Actionable cyber threat intelligence using knowledge graphs and large language models. In: 2024 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW), pp 100\u2013111https:\/\/doi.org\/10.1109\/EuroSPW61312.2024.00018","DOI":"10.1109\/EuroSPW61312.2024.00018"},{"key":"11563_CR89","unstructured":"Fu X, Li S, Wang Z, et al. (2024) Imprompter: tricking llm agents into improper tool use. arXiv preprint arXiv:2410.14923"},{"key":"11563_CR90","unstructured":"Fumero S, Huang K, Boffa M, et al. (2025) Cybersleuth: autonomous blue-team llm agent for web attack forensics. arXiv preprint arXiv:2508.20643"},{"key":"11563_CR91","doi-asserted-by":"crossref","unstructured":"Gandhi PA, Shukla A, Tayouri D, et al. (2025) Atag: Ai-agent application threat assessment with attack graphs. arXiv preprint arXiv:2506.02859","DOI":"10.1145\/3779208.3785380"},{"key":"11563_CR92","unstructured":"Gan Y, Yang Y, Ma Z, et al. (2024) Navigating the risks: a survey of security, privacy, and ethics threats in llm-based agents. arXiv preprint arXiv:2411.09523"},{"key":"11563_CR93","doi-asserted-by":"publisher","unstructured":"Gao L, Dai Z, Pasupat P, et al. (2023b) RARR: researching and revising what language models say, using language models. In: Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pp 16477\u201316508, https:\/\/doi.org\/10.18653\/v1\/2023.acl-long.910","DOI":"10.18653\/v1\/2023.acl-long.910"},{"key":"11563_CR94","doi-asserted-by":"crossref","unstructured":"Gao C, Lan X, Lu Z, et al. (2023a) S3: social-network simulation system with large language model-empowered agents. arXiv preprint arXiv:2307.14984","DOI":"10.2139\/ssrn.4607026"},{"key":"11563_CR95","doi-asserted-by":"publisher","unstructured":"Geissler F, Roscher K, Trapp M (2024) Concept-guided llm agents for human-ai safety codesign. In: Proceedings of the AAAI Symposium Series, pp 100\u2013104, https:\/\/doi.org\/10.1609\/aaaiss.v3i1.31188","DOI":"10.1609\/aaaiss.v3i1.31188"},{"key":"11563_CR96","unstructured":"Ghosh S, Varshney P, Galinkin E, et al. (2024) Aegis: online adaptive ai content safety moderation with ensemble of llm experts. arXiv preprint arXiv:2404.05993"},{"key":"11563_CR97","unstructured":"Gioacchini L, Mellia M, Drago I, et al. (2024) Autopenbench: benchmarking generative agents for penetration testing. arXiv preprint arXiv:2410.03225"},{"key":"11563_CR98","doi-asserted-by":"publisher","unstructured":"Golovan V, Tarasenko S, Budur O, et al. (2021) Substantiation of principles of structure and evaluation of efficiency of perimeter systems of protection of arsenals, bases and warehouses. Collection of scientific works of Odesa Military Academy 1:112\u2013122. https:\/\/doi.org\/10.37129\/2313-7509.2020.14.1.112-122","DOI":"10.37129\/2313-7509.2020.14.1.112-122"},{"key":"11563_CR99","unstructured":"Goodfellow IJ, Shlens J, Szegedy C (2014) Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572"},{"key":"11563_CR100","doi-asserted-by":"publisher","unstructured":"Greshake K, Abdelnabi S, Mishra S, et al. (2023) Not what you\u2019ve signed up for: Compromising real-world llm-integrated applications with indirect prompt injection. In: Proceedings of the 16th ACM Workshop on Artificial Intelligence and Security. Association for Computing Machinery, New York, NY, USA, AISec \u201923, p 79\u201390, https:\/\/doi.org\/10.1145\/3605764.3623985","DOI":"10.1145\/3605764.3623985"},{"key":"11563_CR101","unstructured":"Gu C, Luo L, Zaidi ZR, et al. (2025) Large language model driven agents for simulating echo chamber formation. arXiv preprint arXiv:2502.18138"},{"key":"11563_CR102","doi-asserted-by":"publisher","DOI":"10.1145\/3477142","author":"M Guerar","year":"2021","unstructured":"Guerar M, Verderame L, Migliardi M et al. (2021) Gotta captcha \u2019em all: a survey of 20 years of the human-or-computer dilemma. ACM Comput Surv. https:\/\/doi.org\/10.1145\/3477142","journal-title":"ACM Comput Surv"},{"key":"11563_CR103","doi-asserted-by":"publisher","first-page":"175","DOI":"10.1016\/j.comcom.2022.11.001","volume":"198","author":"Y Guo","year":"2023","unstructured":"Guo Y (2023) A review of machine learning-based zero-day attack detection: challenges and future directions. Comput Commun 198:175\u2013185. https:\/\/doi.org\/10.1016\/j.comcom.2022.11.001","journal-title":"Comput Commun"},{"key":"11563_CR104","unstructured":"Gu X, Zheng X, Pang T, et al. (2024) Agent smith: a single image can jailbreak one million multimodal llm agents exponentially fast. In: Proceedings of the 41st International Conference on Machine Learning, pp 16647\u201316672"},{"key":"11563_CR105","unstructured":"Happe A, Kaplan A, Cito J (2023) Llms as hackers: autonomous linux privilege escalation attacks. arXiv preprint arXiv:2310.11409"},{"key":"11563_CR106","unstructured":"Happer C (2025) Human-in-the-loop vs. fully autonomous ai systems for crisis- driven defense electronics manufacturing"},{"issue":"4","key":"11563_CR107","doi-asserted-by":"publisher","first-page":"36","DOI":"10.1145\/54289.871709","volume":"22","author":"N Hardy","year":"1988","unstructured":"Hardy N (1988) The confused deputy: (or why capabilities might have been invented). ACM SIGOPS Operat Syst Rev 22(4):36\u201338","journal-title":"ACM SIGOPS Operat Syst Rev"},{"key":"11563_CR108","doi-asserted-by":"publisher","unstructured":"Hasan A, Rugina I, Wang A (2024) Pruning for protection: Increasing jailbreak resistance in aligned LLMs without fine-tuning. In: Proceedings of the 7th BlackboxNLP Workshop: analyzing and Interpreting Neural Networks for NLP, pp 417\u2013430, https:\/\/doi.org\/10.18653\/v1\/2024.blackboxnlp-1.26","DOI":"10.18653\/v1\/2024.blackboxnlp-1.26"},{"key":"11563_CR109","unstructured":"Hays S, White J (2024) Employing llms for incident response planning and review. arXiv preprint arXiv:2403.01271"},{"key":"11563_CR110","unstructured":"Hazell J (2023a) Spear phishing with large language models. arXiv preprint arXiv:2305.06972"},{"key":"11563_CR111","unstructured":"Hazell J (2023b) Spear phishing with large language models. arXiv preprint arXiv:2305.06972"},{"key":"11563_CR112","volume":"62","author":"Y He","year":"2022","unstructured":"He Y, Zamani ED, Lloyd S et al. (2022) Agile incident response (air): improving the incident response process in healthcare. Int J Inf Manage 62:102435","journal-title":"Int J Inf Manage"},{"key":"11563_CR113","unstructured":"Heiding F, Lermen S, Kao A, et al. (2024a) Evaluating large language models\u2019 capability to launch fully automated spear phishing campaigns: validated on human subjects. arXiv preprint arXiv:2412.00586"},{"key":"11563_CR114","unstructured":"Heiding F, Lermen S, Kao A, et al. (2024b) Evaluating large language models\u2019 capability to launch fully automated spear phishing campaigns: validated on human subjects. arXiv preprint arXiv:2412.00586"},{"key":"11563_CR115","unstructured":"Henke J (2025) Autopentest: enhancing vulnerability management with autonomous llm agents. arXiv preprint arXiv:2505.10321"},{"issue":"6","key":"11563_CR116","doi-asserted-by":"publisher","first-page":"750","DOI":"10.1007\/s10458-019-09421-1","volume":"33","author":"P Hernandez-Leal","year":"2019","unstructured":"Hernandez-Leal P, Kartal B, Taylor ME (2019) A survey and critique of multiagent deep reinforcement learning. Auton Agent Multi-Agent Syst 33(6):750\u2013797. https:\/\/doi.org\/10.1007\/s10458-019-09421-1","journal-title":"Auton Agent Multi-Agent Syst"},{"key":"11563_CR117","unstructured":"He F, Zhu T, Ye D, et al. (2024) The emerged security and privacy of llm agent: a survey with case studies. arXiv preprint arXiv:2407.19354"},{"key":"11563_CR118","doi-asserted-by":"publisher","DOI":"10.3390\/electronics9101684","author":"H Hindy","year":"2020","unstructured":"Hindy H, Atkinson R, Tachtatzis C et al. (2020) Utilising deep learning techniques for effective zero-day attack detection. Electronics. https:\/\/doi.org\/10.3390\/electronics9101684","journal-title":"Electronics"},{"key":"11563_CR119","unstructured":"Hines K, Lopez G, Hall M, et al. (2024a) Defending against indirect prompt injection attacks with spotlighting. arXiv preprint arXiv:2403.14720"},{"key":"11563_CR120","unstructured":"Hines K, Lopez G, Hall M, et al. (2024b) Defending against indirect prompt injection attacks with spotlighting. arXiv preprint arXiv:2403.14720"},{"key":"11563_CR121","doi-asserted-by":"publisher","first-page":"150199","DOI":"10.1109\/ACCESS.2025.3602681","volume":"13","author":"Y Hmimou","year":"2025","unstructured":"Hmimou Y, Tabaa M, Khiat A et al. (2025) A multi-agent system for cybersecurity threat detection and correlation using large language models. IEEE Access 13:150199\u2013150215. https:\/\/doi.org\/10.1109\/ACCESS.2025.3602681","journal-title":"IEEE Access"},{"key":"11563_CR122","unstructured":"Hong S, Zhuge M, Chen J, et al. (2024) Metagpt: meta programming for a multi-agent collaborative framework. In: The Twelfth International Conference on Learning Representations"},{"key":"11563_CR123","doi-asserted-by":"crossref","unstructured":"Hou X, Zhao Y, Wang S, et al. (2025) Model context protocol (mcp): landscape, security threats, and future research directions. arXiv preprint arXiv:2503.23278","DOI":"10.1145\/3796519"},{"key":"11563_CR124","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2024.103999","volume":"145","author":"Y Hu","year":"2024","unstructured":"Hu Y, Zou F, Han J et al. (2024) Llm-tikg: threat intelligence knowledge graph construction utilizing large language model. Comput Secur 145:103999","journal-title":"Comput Secur"},{"key":"11563_CR125","unstructured":"Huang L, Xiao X (2024) Ctikg: Llm-powered knowledge graph construction from cyber threat intelligence. In: First Conference on Language Modeling"},{"key":"11563_CR126","unstructured":"Huang J, Chen X, Mishra S, et al. (2024a) Large language models cannot self-correct reasoning yet. In: The Twelfth International Conference on Learning Representations, https:\/\/openreview.net\/forum?id=IkmD3fKBPQ"},{"key":"11563_CR127","doi-asserted-by":"publisher","unstructured":"Huang J, Cui L, Wang A, et al. (2024b) Mitigating catastrophic forgetting in large language models with self-synthesized rehearsal. In: Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pp 1416\u20131428, https:\/\/doi.org\/10.18653\/v1\/2024.acl-long.77","DOI":"10.18653\/v1\/2024.acl-long.77"},{"key":"11563_CR128","doi-asserted-by":"publisher","unstructured":"Huang J, Lin H, Ziyan L, et al. (2024c) Towards low-resource harmful meme detection with LMM agents. In: Al-Onaizan Y, Bansal M, Chen YN (eds) Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pp 2269\u20132293, https:\/\/doi.org\/10.18653\/v1\/2024.emnlp-main.136","DOI":"10.18653\/v1\/2024.emnlp-main.136"},{"key":"11563_CR129","doi-asserted-by":"publisher","unstructured":"Huang J, Zhu Q (2024) Penheal: a two-stage llm framework for automated pentesting and optimal remediation. In: Proceedings of the Workshop on Autonomous Cybersecurity, AutonomousCyber \u201924, p 11\u201322, https:\/\/doi.org\/10.1145\/3689933.3690831","DOI":"10.1145\/3689933.3690831"},{"key":"11563_CR130","doi-asserted-by":"crossref","unstructured":"Hua W, Yang X, Jin M, et al. (2024) Trustagent: towards safe and trustworthy llm-based agents. arXiv:2402.01586","DOI":"10.18653\/v1\/2024.findings-emnlp.585"},{"key":"11563_CR131","unstructured":"Hubinger E, Denison C, Mu J, et al. (2024) Sleeper agents: training deceptive llms that persist through safety training. arXiv preprint arXiv:2401.05566"},{"key":"11563_CR132","doi-asserted-by":"publisher","unstructured":"Hu S, Huang T, \u0130lhan F, et al. (2023) Large language model-powered smart contract vulnerability detection: new perspectives. In: 2023 5th IEEE International Conference on Trust, Privacy and Security in Intelligent Systems and Applications (TPS-ISA), pp 297\u2013306, https:\/\/doi.org\/10.1109\/TPS-ISA58951.2023.00044","DOI":"10.1109\/TPS-ISA58951.2023.00044"},{"issue":"1","key":"11563_CR133","first-page":"80","volume":"1","author":"EM Hutchins","year":"2011","unstructured":"Hutchins EM, Cloppert MJ, Amin RM et al. (2011) Intelligence-driven computer network defense informed by analysis of adversary campaigns and intrusion kill chains. Leading Issues Inform Warfare Secur Res 1(1):80","journal-title":"Leading Issues Inform Warfare Secur Res"},{"key":"11563_CR134","unstructured":"IBM (2024) Cost of a data breach report 2024. https:\/\/www.ibm.com\/downloads\/documents\/us-en\/107a02e94948f4echttps:\/\/www.ibm.com\/security\/digital-assets\/cost-data-breach-report\/1Cost of a Data Breach Report 2020.pdf"},{"key":"11563_CR135","unstructured":"Inan H, Upasani K, Chi J, et al. (2023) Llama guard: Llm-based input-output safeguard for human-ai conversations. arXiv preprint arXiv:2312.06674"},{"key":"11563_CR136","doi-asserted-by":"publisher","unstructured":"\u0130\u015e H (2024) Llm-driven sat impact on phishing defense: a cross-sectional analysis. In: 2024 12th International Symposium on Digital Forensics and Security (ISDFS), pp 1\u20135, https:\/\/doi.org\/10.1109\/ISDFS60797.2024.10527274","DOI":"10.1109\/ISDFS60797.2024.10527274"},{"key":"11563_CR137","doi-asserted-by":"publisher","DOI":"10.3390\/info16050365","author":"KR Ismail","year":"2025","unstructured":"Ismail KR, Brata ZA et al. (2025) Toward robust security orchestration and automated response in security operations centers with a hyper-automation approach using agentic artificial intelligence. Information. https:\/\/doi.org\/10.3390\/info16050365","journal-title":"Information"},{"key":"11563_CR138","doi-asserted-by":"crossref","unstructured":"Isozaki I, Shrestha M, Console R, et al. (2024) Towards automated penetration testing: introducing llm benchmark, analysis, and improvements. arXiv preprint arXiv:2410.17141","DOI":"10.1145\/3708319.3733804"},{"key":"11563_CR139","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2024.104077","volume":"147","author":"E Iturbe","year":"2024","unstructured":"Iturbe E, Llorente-Vazquez O, Rego A et al. (2024) Unleashing offensive artificial intelligence: automated attack technique code generation. Comput Secur 147:104077","journal-title":"Comput Secur"},{"key":"11563_CR140","doi-asserted-by":"publisher","unstructured":"Ji Z, Yu T, Xu Y, et al. (2023) Towards mitigating LLM hallucination via self reflection. In: Findings of the Association for Computational Linguistics: EMNLP 2023, pp 1827\u20131843, https:\/\/doi.org\/10.18653\/v1\/2023.findings-emnlp.123","DOI":"10.18653\/v1\/2023.findings-emnlp.123"},{"key":"11563_CR141","unstructured":"Ji Z, Wu D, Ma P, et al. (2024) Testing and understanding erroneous planning in llm agents through synthesized user inputs. arXiv preprint arXiv:2404.17833"},{"key":"11563_CR142","doi-asserted-by":"crossref","unstructured":"Jia F, Wu T, Qin X, et al. (2025) The task shield: Enforcing task alignment to defend against indirect prompt injection in LLM agents. In: Che W, Nabende J, Shutova E, et al. (eds) Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers). Association for Computational Linguistics, Vienna, Austria, pp 29680\u201329697, https:\/\/doi.org\/10.18653\/v1\/2025.acl-long.1435, https:\/\/aclanthology.org\/2025.acl-long.1435\/","DOI":"10.18653\/v1\/2025.acl-long.1435"},{"key":"11563_CR143","unstructured":"Jiang Y, Aggarwal K, Laud T, et al. (2024) Red queen: safeguarding large language models against concealed multi-turn jailbreaking. arXiv preprint arXiv:2409.17458"},{"key":"11563_CR144","unstructured":"Jiao R, Xie S, Yue J, et al. (2025) Can we trust embodied agents? Exploring backdoor attacks against embodied llm-based decision-making systems. In: The Thirteenth International Conference on Learning Representations"},{"key":"11563_CR145","unstructured":"Huang Jt, Zhou J, Jin T, et al. (2024d) On the resilience of llm-based multi-agent collaboration with faulty agents. arXiv preprint arXiv:2408.00989"},{"key":"11563_CR146","unstructured":"Huang Jt, Zhou J, Jin T, et al. (2024e) On the resilience of multi-agent systems with malicious agents. arXiv preprint arXiv:2408.00989"},{"key":"11563_CR147","doi-asserted-by":"crossref","unstructured":"Ju T, Wang Y, Ma X, et al. (2024) Flooding spread of manipulated knowledge in llm-based multi-agent communities. arXiv preprint arXiv:2407.07791","DOI":"10.21203\/rs.3.rs-5292520\/v1"},{"key":"11563_CR148","unstructured":"Kim K, Lee S, Huang KH, et al. (2024a) Can llms produce faithful explanations for fact-checking? towards faithful explainable fact-checking via multi-agent debate. arXiv preprint arXiv:2402.07401"},{"key":"11563_CR149","unstructured":"Kim H, Song M, Na SH, et al. (2025a) When llms go online: the emerging threat of web-enabled llms. In: Proceedings of the 34th USENIX Conference on Security Symposium. USENIX Association, USA, SEC \u201925"},{"key":"11563_CR150","unstructured":"Kim H, Song M, Na SH, et al. (2025b) When $$\\{$$LLMs$$\\}$$ go online: The emerging threat of $$\\{$$Web-Enabled$$\\}$$$$\\{$$LLMs$$\\}$$. In: 34th USENIX Security Symposium (USENIX Security 25), pp 1729\u20131748"},{"key":"11563_CR151","unstructured":"Kim J, Choi W, Lee B (2025c) Prompt flow integrity to prevent privilege escalation in llm agents. arXiv preprint arXiv:2503.15547"},{"key":"11563_CR152","doi-asserted-by":"publisher","unstructured":"Kim M, Kim J, Kim J, et al. (2024b) QuBE: question-based belief enhancement for agentic LLM reasoning. In: Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pp 21403\u201321423, https:\/\/doi.org\/10.18653\/v1\/2024.emnlp-main.1193","DOI":"10.18653\/v1\/2024.emnlp-main.1193"},{"key":"11563_CR153","doi-asserted-by":"crossref","unstructured":"Koh JY, Lo R, Jang L, et al. (2024) Visualwebarena: evaluating multimodal agents on realistic visual web tasks. arXiv preprint arXiv:2401.13649","DOI":"10.18653\/v1\/2024.acl-long.50"},{"key":"11563_CR154","doi-asserted-by":"crossref","unstructured":"Kokulu FB, Soneji A, Bao T, et al. (2019) Matched and mismatched socs: a qualitative study on security operations center issues. In: Proceedings of the 2019 ACM SIGSAC conference on computer and communications security, pp 1955\u20131970","DOI":"10.1145\/3319535.3354239"},{"key":"11563_CR155","unstructured":"Kong H, Hu D, Ge J, et al. (2025) Vulnbot: autonomous penetration testing for a multi-agent collaborative framework. arXiv preprint arXiv:2501.13411"},{"key":"11563_CR156","unstructured":"Kramer D, Rosique L, Narotam A, et al. (2025) Integrating large language models into security incident response. In: Twenty-First Symposium on Usable Privacy and Security (SOUPS 2025), pp 133\u2013148"},{"key":"11563_CR157","unstructured":"Kuntz T, Duzan A, Zhao H, et al. (2025) Os-harm: a benchmark for measuring safety of computer use agents. arXiv preprint arXiv:2506.14866"},{"key":"11563_CR158","unstructured":"Kwa T, West B, Becker J, et al. (2025) Measuring ai ability to complete long tasks. arXiv preprint arXiv:2503.14499"},{"key":"11563_CR159","unstructured":"Kwartler T, Berman M, Aqrawi A (2024) Good parenting is all you need\u2013multi-agentic llm hallucination mitigation. arXiv preprint arXiv:2410.14262"},{"key":"11563_CR160","unstructured":"Labs K (2025) 2025 verizon data breach investigations report. https:\/\/keepnetlabs.com\/blog\/2025-verizon-data-breach-investigations-report"},{"key":"11563_CR161","unstructured":"LangChain (2022) Langchain: Framework for developing applications powered by language models. https:\/\/github.com\/langchain-ai\/langchain"},{"key":"11563_CR162","unstructured":"Learn P (2023a) Instruction defense. https:\/\/learnprompting.org\/docs\/prompt_hacking\/defensive_measures\/instruction"},{"key":"11563_CR163","unstructured":"Learn P (2023b) Sandwich defense. https:\/\/learnprompting.org\/docs\/prompt_hacking\/defensive_measures\/sandwich_defense"},{"issue":"10","key":"11563_CR164","doi-asserted-by":"publisher","first-page":"2320","DOI":"10.3390\/math11102320","volume":"11","author":"M Lee","year":"2023","unstructured":"Lee M (2023) A mathematical investigation of hallucination and creativity in gpt models. Mathematics 11(10):2320. https:\/\/doi.org\/10.3390\/math11102320","journal-title":"Mathematics"},{"key":"11563_CR165","unstructured":"Lee D, Tiwari M (2024) Prompt infection: Llm-to-llm prompt injection within multi-agent systems. arXiv preprint arXiv:2410.07283"},{"key":"11563_CR166","unstructured":"Lee N, Madotto A, Fung P (2019) Exploring social bias in chatbots using stereotype knowledge. In: Proceedings of the 2019 Workshop on Widening NLP, pp 177\u2013180, https:\/\/aclanthology.org\/W19-3655\/"},{"key":"11563_CR167","doi-asserted-by":"crossref","unstructured":"Lee N, Ping W, Xu P, et al. (2022) Factuality enhanced language models for open-ended text generation. In: Advances in Neural Information Processing Systems, pp 34586\u201334599, https:\/\/proceedings.neurips.cc\/paper_files\/paper\/2022\/file\/df438caa36714f69277daa92d608dd63-Paper-Conference.pdf","DOI":"10.52202\/068431-2506"},{"key":"11563_CR168","doi-asserted-by":"publisher","unstructured":"Lee J, Jeong Y, Han T, et al. (2025) Logresp-agent: a recursive ai framework for context-aware log anomaly detection and ttp analysis. Applied Sciences 15(13). https:\/\/doi.org\/10.3390\/app15137237","DOI":"10.3390\/app15137237"},{"key":"11563_CR169","doi-asserted-by":"publisher","unstructured":"Lee S, Park SH, Jo Y, et al. (2024) Volcano: mitigating multimodal hallucination through self-feedback guided revision. In: Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers), pp 391\u2013404, https:\/\/doi.org\/10.18653\/v1\/2024.naacl-long.23","DOI":"10.18653\/v1\/2024.naacl-long.23"},{"key":"11563_CR170","doi-asserted-by":"publisher","first-page":"156","DOI":"10.1109\/ACCESS.2016.2633983","volume":"5","author":"C Lei","year":"2017","unstructured":"Lei C, Ma DH, Zhang HQ (2017) Optimal strategy selection for moving target defense based on Markov game. IEEE Access 5:156\u2013169. https:\/\/doi.org\/10.1109\/ACCESS.2016.2633983","journal-title":"IEEE Access"},{"key":"11563_CR171","unstructured":"Lei D, Li Y, Hu M, et al. (2023) Chain of natural language inference for reducing large language model ungrounded hallucinations. arXiv preprint arXiv:2310.03951"},{"key":"11563_CR172","unstructured":"Levy I, Wiesel B, Marreed S, et al. (2024) St-webagentbench: a benchmark for evaluating safety and trustworthiness in web agents. arXiv preprint arXiv:2410.06703"},{"key":"11563_CR173","unstructured":"Lewis P, Perez E, Piktus A, et al. (2020) Retrieval-augmented generation for knowledge-intensive nlp tasks. In: Advances in Neural Information Processing Systems, pp 9459\u20139474, https:\/\/proceedings.neurips.cc\/paper_files\/paper\/2020\/file\/6b493230205f780e1bc26945df7481e5-Paper.pdf"},{"key":"11563_CR174","doi-asserted-by":"crossref","unstructured":"Li K, Patel O, Vi\u00e9gas F, et al. (2023) Inference-time intervention: Eliciting truthful answers from a language model. In: Advances in Neural Information Processing Systems, pp 41451\u201341530, https:\/\/proceedings.neurips.cc\/paper_files\/paper\/2023\/file\/81b8390039b7302c909cb769f8b6cd93-Paper-Conference.pdf","DOI":"10.52202\/075280-1797"},{"key":"11563_CR175","unstructured":"Li H, Dong Q, Chen J, et al. (2024a) Llms-as-judges: a comprehensive survey on llm-based evaluation methods. arXiv preprint arXiv:2412.05579"},{"key":"11563_CR176","unstructured":"Li N, Han Z, Steneker I, et al. (2024b) Llm defenses are not robust to multi-turn human jailbreaks yet. arXiv preprint arXiv:2408.15221"},{"key":"11563_CR177","unstructured":"Li X, Xu Y, Zhang Y, et al. (2024c) Large language model-driven multi-agent simulation for news diffusion under different network structures. arXiv preprint arXiv:2410.13909"},{"key":"11563_CR178","unstructured":"Li C, Liang J, Cao B, et al. (2025a) Your agent can defend itself against backdoor attacks. arXiv preprint arXiv:2506.08336"},{"key":"11563_CR179","doi-asserted-by":"publisher","unstructured":"Liang S, Zhang B, Zhao J, et al. (2024) ABSEval: an agent-based framework for script evaluation. In: Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pp 12418\u201312434, https:\/\/doi.org\/10.18653\/v1\/2024.emnlp-main.691","DOI":"10.18653\/v1\/2024.emnlp-main.691"},{"key":"11563_CR180","unstructured":"Liao Z, Mo L, Xu C, et al. (2024) Eia: Environmental injection attack on generalist web agents for privacy leakage. arXiv preprint arXiv:2409.11295"},{"key":"11563_CR181","unstructured":"Lin G, Tanaka T, Zhao Q (2024a) Large language model sentinel: Llm agent for adversarial purification. arXiv preprint arXiv:2405.20770"},{"key":"11563_CR182","unstructured":"Lin G, Tanaka T, Zhao Q (2024b) Large language model sentinel: Llm agent for adversarial purification. arXiv preprint arXiv:2405.20770"},{"key":"11563_CR183","doi-asserted-by":"crossref","unstructured":"Lin N, Yang Q, Shuai Z et al. (2024) Optimization and implementation of network security incident handling process based on secure arrangement. 2024 IEEE 2nd International Conference on Sensors. IEEE, Electronics and Computer Engineering (ICSECE), pp 472\u2013478","DOI":"10.1109\/ICSECE61636.2024.10729589"},{"key":"11563_CR184","unstructured":"Lin X, Zhang J, Deng G, et al. (2025) Ircopilot: automated incident response with large language models. arXiv preprint arXiv:2505.20945"},{"key":"11563_CR185","unstructured":"Lipton E, Sanger DE, Shane S (2016) The perfect weapon: How Russian cyberpower invaded the us. The New York Times"},{"key":"11563_CR186","doi-asserted-by":"crossref","unstructured":"G. Lira O, Marroquin A, To MA, (2024) Harnessing the advanced capabilities of llm for adaptive intrusion detection systems. In: Barolli L (ed) Advanced Information Networking and Applications. Springer Nature Switzerland, Cham, pp 453\u2013464","DOI":"10.1007\/978-3-031-57942-4_44"},{"key":"11563_CR187","unstructured":"Li Y, Shezan FH, Wei B, et al. (2025b) Sok: towards effective automated vulnerability repair. arXiv preprint arXiv:2501.18820"},{"key":"11563_CR188","doi-asserted-by":"publisher","unstructured":"Liu Z (2025) Autobnb: multi-agent incident response with large language models. In: 2025 13th International Symposium on Digital Forensics and Security (ISDFS), pp 1\u20136, https:\/\/doi.org\/10.1109\/ISDFS65363.2025.11012055","DOI":"10.1109\/ISDFS65363.2025.11012055"},{"key":"11563_CR189","unstructured":"Liu R, Lin Y, Zhang Y, et al. (2023a) Knowledge expansion and counterfactual interaction for Reference-Based phishing detection. In: 32nd USENIX Security Symposium (USENIX Security 23), pp 4139\u20134156, https:\/\/www.usenix.org\/conference\/usenixsecurity23\/presentation\/liu-ruofan"},{"key":"11563_CR190","unstructured":"Liu Y, Deng G, Li Y, et al. (2023b) Prompt injection attack against llm-integrated applications. arXiv preprint arXiv:2306.05499"},{"key":"11563_CR191","unstructured":"Liu J, Lim KH, Lee RKW (2024b) Towards objective and unbiased decision assessments with llm-enhanced hierarchical attention networks. arXiv preprint arXiv:2411.08504"},{"key":"11563_CR192","doi-asserted-by":"crossref","unstructured":"Liu Z, Wang Z, Xu L, et al. (2024f) Protecting your llms with information bottleneck. In: Advances in Neural Information Processing Systems, pp 29723\u201329753, https:\/\/proceedings.neurips.cc\/paper_files\/paper\/2024\/file\/34a1fc7890141f1ada3d8bc6199cce07-Paper-Conference.pdf","DOI":"10.52202\/079017-0935"},{"key":"11563_CR193","unstructured":"Liu F, Zhang Y, Luo J, et al. (2025a) Make agent defeat agent: Automatic detection of $$\\{$$Taint-Style$$\\}$$ vulnerabilities in $$\\{$$LLM-based$$\\}$$ agents. In: 34th USENIX Security Symposium (USENIX Security 25), pp 3767\u20133786"},{"key":"11563_CR194","doi-asserted-by":"publisher","unstructured":"Liu Y, Yuan Y, Zhu Y, et al. (2025c) Research on design and implementation of an intelligent network asset search system based on llm agent and fofa. In: Proceedings of the 2025 4th International Conference on Cyber Security, Artificial Intelligence and the Digital Economy. Association for Computing Machinery, New York, NY, USA, CSAIDE \u201925, p 483\u2013488, https:\/\/doi.org\/10.1145\/3729706.3729783","DOI":"10.1145\/3729706.3729783"},{"key":"11563_CR195","doi-asserted-by":"crossref","unstructured":"Liu Z, Anwar A (2025) Autobnb-rag: enhancing multi-agent incident response with retrieval-augmented generation. arXiv preprint arXiv:2508.13118","DOI":"10.1109\/ICDMW69685.2025.00141"},{"key":"11563_CR196","unstructured":"Liu F, Feng Y, Xu Z, et al. (2024a) Jailjudge: a comprehensive jailbreak judge benchmark with multi-agent enhanced explanation evaluation framework. arXiv preprint arXiv:2410.12855"},{"key":"11563_CR197","unstructured":"Liu X, Li P, Suh GE, et al. (2025b) Autodan-turbo: a lifelong agent for strategy self-exploration to jailbreak llms. In: The Thirteenth International Conference on Learning Representations"},{"key":"11563_CR198","unstructured":"Liu Y, Song Z, Zhang X, et al. (2024e) From a tiny slip to a giant leap: an llm-based simulation for fake news evolution. arXiv preprint arXiv:2410.19064"},{"key":"11563_CR199","unstructured":"Liu X, Xu N, Chen M, et al. (2024d) Autodan: generating stealthy jailbreak prompts on aligned large language models. In: The Twelfth International Conference on Learning Representations"},{"key":"11563_CR200","doi-asserted-by":"crossref","unstructured":"Liu S, Yao D, Fang L, et al. (2024c) Anomalyllm: few-shot anomaly edge detection for dynamic graphs using large language models. arXiv preprint arXiv:2405.07626","DOI":"10.1109\/ICDM59182.2024.00093"},{"key":"11563_CR201","unstructured":"Li Y, Xiang Z, Bastian ND, et al. (2024d) Ids-agent: an llm agent for explainable intrusion detection in iot networks. In: NeurIPS 2024 Workshop on Open-World Agents"},{"key":"11563_CR202","doi-asserted-by":"publisher","unstructured":"Loevenich JF, Adler E, H\u00fcrten T, et al. (2025) Automating cyber threat intelligence and attack chain generation using cyber security knowledge graphs and large language models. In: 2025 International Conference on Military Communication and Information Systems (ICMCIS), pp 1\u201310, https:\/\/doi.org\/10.1109\/ICMCIS64378.2025.11047951","DOI":"10.1109\/ICMCIS64378.2025.11047951"},{"key":"11563_CR203","unstructured":"Long Q, Deng Y, Gan L, et al. (2024) Whispers in grammars: injecting covert backdoors to compromise dense retrieval systems. arXiv preprint arXiv:2402.13532"},{"key":"11563_CR204","doi-asserted-by":"publisher","unstructured":"Lu J, Holleis T, Zhang Y, et al. (2025) ToolSandbox: A stateful, conversational, interactive evaluation benchmark for LLM tool use capabilities. In: Chiruzzo L, Ritter A, Wang L (eds) Findings of the Association for Computational Linguistics: NAACL 2025. Association for Computational Linguistics, Albuquerque, New Mexico, pp 1160\u20131183, https:\/\/doi.org\/10.18653\/v1\/2025.findings-naacl.65","DOI":"10.18653\/v1\/2025.findings-naacl.65"},{"issue":"2","key":"11563_CR205","doi-asserted-by":"publisher","first-page":"305","DOI":"10.1038\/s41562-024-02046-9","volume":"9","author":"X Luo","year":"2025","unstructured":"Luo X, Rechardt A, Sun G et al. (2025) Large language models surpass human experts in predicting neuroscience results. Nat Hum Behav 9(2):305\u2013315. https:\/\/doi.org\/10.1038\/s41562-024-02046-9","journal-title":"Nat Hum Behav"},{"key":"11563_CR206","doi-asserted-by":"crossref","unstructured":"Luo W, Dai S, Liu X, et al. (2025a) Agrail: a lifelong agent guardrail with effective and adaptive safety detection. arXiv preprint arXiv:2502.11448","DOI":"10.18653\/v1\/2025.acl-long.399"},{"key":"11563_CR207","unstructured":"Lupinacci M, Pironti FA, Blefari F, et al. (2025) The dark side of llms: agent-based attacks for complete computer takeover. arXiv preprint arXiv:2507.06850"},{"key":"11563_CR208","doi-asserted-by":"publisher","unstructured":"Ma W, Wu D, Sun Y, et al. (2024a) Combining fine-tuning and llm-based agents for intuitive smart contract auditing with justifications. In: 2025 IEEE\/ACM 47th International Conference on Software Engineering (ICSE), pp 330\u2013342, https:\/\/doi.org\/10.1109\/ICSE55347.2025.00027","DOI":"10.1109\/ICSE55347.2025.00027"},{"key":"11563_CR209","doi-asserted-by":"publisher","first-page":"46534","DOI":"10.52202\/075280-2019","volume":"36","author":"A Madaan","year":"2023","unstructured":"Madaan A, Tandon N, Gupta P et al. (2023) Self-refine: iterative refinement with self-feedback. Adv Neural Inf Process Syst 36:46534\u201346594","journal-title":"Adv Neural Inf Process Syst"},{"key":"11563_CR210","unstructured":"Mao J, Meng F, Duan Y, et al. (2025) Agentsafe: safeguarding large language model-based multi-agent systems via hierarchical data management. arXiv preprint arXiv:2503.04392"},{"key":"11563_CR211","unstructured":"Martin L (2011) Cyber kill chain. https:\/\/www.lockheedmartin.com\/en-us\/capabilities\/cyber\/cyber-kill-chain.html"},{"key":"11563_CR212","unstructured":"Mathew Y, Matthews O, McCarthy R, et al. (2024) Hidden in plain text: emergence & mitigation of steganographic collusion in llms. arXiv preprint arXiv:2410.03768"},{"key":"11563_CR213","unstructured":"Ma X, Wang Y, Yao Y, et al. (2024b) Caution for the environment: multimodal agents are susceptible to environmental distractions. arXiv preprint arXiv:2408.02544"},{"key":"11563_CR214","unstructured":"Mazeika M, Phan L, Yin X, et al. (2024) Harmbench: a standardized evaluation framework for automated red teaming and robust refusal. In: Proceedings of the 41st International Conference on Machine Learning, pp 35181\u201335224"},{"key":"11563_CR215","doi-asserted-by":"publisher","first-page":"175","DOI":"10.1016\/j.compeleceng.2019.02.022","volume":"75","author":"DR McKinnel","year":"2019","unstructured":"McKinnel DR, Dargahi T, Dehghantanha A et al. (2019) A systematic literature review and meta-analysis on artificial intelligence in penetration testing and vulnerability assessment. Comput Electr Eng 75:175\u2013188","journal-title":"Comput Electr Eng"},{"key":"11563_CR216","unstructured":"MCPMarket (n.d.) Mcp market. https:\/\/mcpmarket.com"},{"key":"11563_CR217","doi-asserted-by":"crossref","unstructured":"Mehrotra A, Zampetakis M, Kassianik P, et al. (2024) Tree of attacks: jailbreaking black-box llms automatically. In: Advances in Neural Information Processing Systems, pp 61065\u201361105, https:\/\/proceedings.neurips.cc\/paper_files\/paper\/2024\/file\/70702e8cbb4890b4a467b984ae59828a-Paper-Conference.pdf","DOI":"10.52202\/079017-1952"},{"key":"11563_CR218","doi-asserted-by":"publisher","unstructured":"Men T, Cao P, Jin Z, et al. (2025) A troublemaker with contagious jailbreak makes chaos in honest towns. In: Che W, Nabende J, Shutova E, et al. (eds) Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers). Association for Computational Linguistics, Vienna, Austria, pp 17561\u201317587, https:\/\/doi.org\/10.18653\/v1\/2025.acl-long.859,","DOI":"10.18653\/v1\/2025.acl-long.859"},{"key":"11563_CR219","unstructured":"Meta (2025) Cyberseceval 4. https:\/\/meta-llama.github.io\/PurpleLlama\/CyberSecEval\/"},{"key":"11563_CR220","unstructured":"Mialon G, Fourrier C, Wolf T, et al. (2024) GAIA: a benchmark for general AI assistants. In: The Twelfth International Conference on Learning Representations, https:\/\/openreview.net\/forum?id=fibxvahvs3"},{"key":"11563_CR221","unstructured":"Microsoft (n.d.) Azure content moderator. https:\/\/learn.microsoft.com\/en-us\/azure\/ai-services\/content-moderator"},{"key":"11563_CR222","doi-asserted-by":"publisher","first-page":"63","DOI":"10.1007\/978-3-031-87496-3_5","volume-title":"Foundations and practice of security","author":"S Mitra","year":"2025","unstructured":"Mitra S, Neupane S, Chakraborty T et al. (2025) Localintel: Generating organizational threat intelligence from global and local cyber knowledge. In: Adi K, Bourdeau S, Durand C et al. (eds) Foundations and practice of security. Springer Nature Switzerland, Cham, pp 63\u201378"},{"key":"11563_CR223","unstructured":"MITRE (2024a) Active scanning: scanning ip blocks. https:\/\/attack.mitre.org\/techniques\/T1595\/001\/"},{"key":"11563_CR224","unstructured":"MITRE (2024b) Mitre att&ck. https:\/\/attack.mitre.org"},{"key":"11563_CR225","unstructured":"Mo L, Liao Z, Zheng B, et al. (2024) A trembling house of cards? Mapping adversarial attacks against language agents. arXiv preprint arXiv:2402.10196"},{"key":"11563_CR226","unstructured":"Molleti R, Goje V, Luthra P, et al. (2024) Automated threat detection and response using llm agents. World J Adv Res Rev"},{"key":"11563_CR227","doi-asserted-by":"publisher","first-page":"487","DOI":"10.1007\/978-3-031-17551-0_32","volume-title":"Science of cyber security","author":"R Montanez Rodriguez","year":"2022","unstructured":"Montanez Rodriguez R, Xu S (2022) Cyber social engineering kill chain. In: Su C, Sakurai K, Liu F (eds) Science of cyber security. Springer International Publishing, Cham, pp 487\u2013504"},{"key":"11563_CR228","unstructured":"Motwani SR, Baranchuk M, Hammond L, et al. (2023) A perfect collusion benchmark: How can ai agents be prevented from colluding with information-theoretic undetectability? In: Multi-Agent Security Workshop@ NeurIPS\u201923"},{"key":"11563_CR229","doi-asserted-by":"publisher","first-page":"73439","DOI":"10.52202\/079017-2336","volume":"37","author":"S Motwani","year":"2024","unstructured":"Motwani S, Baranchuk M, Strohmeier M et al. (2024) Secret collusion among ai agents: multi-agent deception via steganography. Adv Neural Inf Process Syst 37:73439\u201373486","journal-title":"Adv Neural Inf Process Syst"},{"key":"11563_CR230","unstructured":"Muzsai L, Imolai D, Luk\u00e1cs A (2024) Hacksynth: Llm agent and evaluation framework for autonomous penetration testing. arXiv preprint arXiv:2412.01778"},{"key":"11563_CR231","doi-asserted-by":"crossref","unstructured":"Nakash I, Kour G, Uziel G, et al. (2024) Breaking react agents: Foot-in-the-door attack will get you in. arXiv preprint arXiv:2410.16950","DOI":"10.18653\/v1\/2025.findings-naacl.363"},{"key":"11563_CR232","unstructured":"Nakatani S (2025) Rapidpen: Fully automated ip-to-shell penetration testing with llm-based agents. arXiv preprint arXiv:2502.16730"},{"key":"11563_CR233","doi-asserted-by":"crossref","unstructured":"Narajala VS, Habler I (2025) Enterprise-grade security for the model context protocol (mcp): frameworks and mitigation strategies. arXiv preprint arXiv:2504.08623","DOI":"10.1109\/ICAIC67076.2026.11395723"},{"key":"11563_CR234","doi-asserted-by":"crossref","unstructured":"Narajala VS, Huang K, Habler I (2025) Securing genai multi-agent systems against tool squatting: a zero trust registry-based approach. arXiv preprint arXiv:2504.19951","DOI":"10.1109\/AIxDKE67294.2026.00022"},{"key":"11563_CR235","doi-asserted-by":"crossref","unstructured":"Narajala VS, Narayan O (2025) Securing agentic ai: a comprehensive threat model and mitigation framework for generative ai agents. arXiv preprint arXiv:2504.19956","DOI":"10.1109\/ACAI68217.2025.11406310"},{"key":"11563_CR236","unstructured":"Network H (n.d.) Detecting post-breach threats using the cyber kill chain. https:\/\/www.hillstonenet.com\/wp-content\/uploads\/Detecting-post-breach-threats-using-the-Cyber-Kill-Chain.pdf"},{"key":"11563_CR237","doi-asserted-by":"publisher","first-page":"18827","DOI":"10.1109\/ACCESS.2025.3532999","volume":"13","author":"W Nowakowski","year":"2025","unstructured":"Nowakowski W (2025) Social engineering analysis framework: a comprehensive playbook for human hacking. IEEE Access 13:18827\u201318849. https:\/\/doi.org\/10.1109\/ACCESS.2025.3532999","journal-title":"IEEE Access"},{"key":"11563_CR238","unstructured":"Nunez A, Islam NT, Jha SK, et al. (2024) Autosafecoder: a multi-agent framework for securing llm code generation through static analysis and fuzz testing. arXiv preprint arXiv:2409.10737"},{"key":"11563_CR239","unstructured":"OpenAI (2023a) Funcation calling. https:\/\/platform.openai.com\/docs\/guides\/function-calling?api-mode=responses"},{"key":"11563_CR240","unstructured":"OpenAI (n.d.) Moderation. https:\/\/platform.openai.com\/docs\/guides\/moderation"},{"key":"11563_CR241","unstructured":"OpenAI (2023b) Gpt-4. https:\/\/openai.com\/index\/gpt-4-research\/"},{"key":"11563_CR242","unstructured":"OpenAI (2024) Gpt-4o. https:\/\/openai.com\/index\/hello-gpt-4o\/"},{"key":"11563_CR243","unstructured":"Ou X, Govindavajhala S, Appel AW (2005a) Mulval: a logic-based network security analyzer. In: Proceedings of the 14th Conference on USENIX Security Symposium - Volume 14. USENIX Association, USA, SSYM\u201905, p\u00a08"},{"key":"11563_CR244","unstructured":"Ou X, Govindavajhala S, Appel AW et al. (2005) Mulval: a logic-based network security analyzer. USENIX security symposium. Baltimore, MD, pp 113\u2013128"},{"key":"11563_CR245","unstructured":"OverTheWire (2024) Overthewire wargames. https:\/\/overthewire.org\/wargames\/"},{"key":"11563_CR246","unstructured":"Packer C, Wooders S, Lin K, et al. (2023) Memgpt: towards llms as operating systems. arXiv preprint arXiv:2310.08560"},{"key":"11563_CR247","doi-asserted-by":"publisher","DOI":"10.1145\/3439950","author":"G Pang","year":"2021","unstructured":"Pang G, Shen C, Cao L et al. (2021) Deep learning for anomaly detection: a review. ACM Comput Surv. https:\/\/doi.org\/10.1145\/3439950","journal-title":"ACM Comput Surv"},{"key":"11563_CR248","doi-asserted-by":"publisher","unstructured":"Park JS, O\u2019Brien J, Cai CJ, et al. (2023a) Generative agents: interactive simulacra of human behavior. In: Proceedings of the 36th Annual ACM Symposium on User Interface Software and Technology. Association for Computing Machinery, New York, NY, USA, UIST \u201923, https:\/\/doi.org\/10.1145\/3586183.3606763","DOI":"10.1145\/3586183.3606763"},{"key":"11563_CR249","doi-asserted-by":"crossref","unstructured":"Park JS, O\u2019Brien J, Cai CJ, et al. (2023b) Generative agents: interactive simulacra of human behavior. In: Proceedings of the 36th annual acm symposium on user interface software and technology, pp 1\u201322","DOI":"10.1145\/3586183.3606763"},{"key":"11563_CR250","unstructured":"Park T (2024) Enhancing anomaly detection in financial markets with an llm-based multi-agent framework. arXiv preprint arXiv:2403.19735"},{"key":"11563_CR251","unstructured":"Pasquini D, Kornaropoulos EM, Ateniese G (2024) Hacking back the ai-hacker: prompt injection as a defense against llm-driven cyberattacks. arXiv preprint arXiv:2410.20911"},{"key":"11563_CR252","unstructured":"Perez F, Ribeiro I (2022) Ignore previous prompt: attack techniques for language models. arXiv preprint arXiv:2211.09527"},{"key":"11563_CR253","unstructured":"Perspective (n.d.) Perspective api. https:\/\/perspectiveapi.com\/#\/home"},{"key":"11563_CR254","unstructured":"Phelps S, Ranson R (2023) Of models and tin men: a behavioural economics study of principal-agent problems in ai alignment using large-language models. arXiv preprint arXiv:2307.11137"},{"key":"11563_CR255","unstructured":"Phuong M, Aitchison M, Catt E, et al. (2025) Evaluating frontier models for dangerous capabilities. arXiv preprint arXiv:2507.14201"},{"key":"11563_CR256","unstructured":"Phute M, Helbling A, Hull M, et al. (2023) Llm self defense: by self examination, llms know they are being tricked. arXiv preprint arXiv:2308.07308"},{"key":"11563_CR257","unstructured":"Piao J, Lu Z, Gao C, et al. (2025) Emergence of human-like polarization among large language model agents. arXiv preprint arXiv:2501.05171"},{"key":"11563_CR258","doi-asserted-by":"crossref","unstructured":"Piatti G, Jin Z, Kleiman-Weiner M, et al. (2024) Cooperate or collapse: Emergence of sustainable cooperation in a society of llm agents. In: Globerson A, Mackey L, Belgrave D, et al. (eds) Advances in Neural Information Processing Systems, vol\u00a037. Curran Associates, Inc., pp 111715\u2013111759, https:\/\/proceedings.neurips.cc\/paper_files\/paper\/2024\/file\/ca9567d8ef6b2ea2da0d7eed57b933ee-Paper-Conference.pdf","DOI":"10.52202\/079017-3548"},{"key":"11563_CR259","doi-asserted-by":"publisher","unstructured":"Piet J, Alrashed M, Sitawarin C, et al. (2024) Jatmo: prompt injection defense by task-specific finetuning. In: European Symposium on Research in Computer Security, pp 105\u2013124, https:\/\/doi.org\/10.1007\/978-3-031-70879-4_6","DOI":"10.1007\/978-3-031-70879-4_6"},{"key":"11563_CR260","unstructured":"Portnoy A, Azikri E, Kels S (2024) Towards automatic hands-on-keyboard attack detection using llms in edr solutions. arXiv preprint arXiv:2408.01993"},{"key":"11563_CR261","doi-asserted-by":"publisher","unstructured":"Press O, Zhang M, Min S, et al. (2023) Measuring and narrowing the compositionality gap in language models. In: Findings of the Association for Computational Linguistics: EMNLP 2023, pp 5687\u20135711https:\/\/doi.org\/10.18653\/v1\/2023.findings-emnlp.378","DOI":"10.18653\/v1\/2023.findings-emnlp.378"},{"key":"11563_CR262","doi-asserted-by":"publisher","DOI":"10.1016\/j.inffus.2025.103176","volume":"122","author":"Q Qi","year":"2025","unstructured":"Qi Q, Luo Y, Xu Y et al. (2025) Spearbot: leveraging large language models in a generative-critique framework for spear-phishing email generation. Inform Fusion 122:103176. https:\/\/doi.org\/10.1016\/j.inffus.2025.103176","journal-title":"Inform Fusion"},{"key":"11563_CR263","doi-asserted-by":"crossref","unstructured":"Radosevich B, Halloran J (2025) Mcp safety audit: Llms with the model context protocol allow major security exploits. arXiv preprint arXiv:2504.03767","DOI":"10.1117\/12.3097390"},{"key":"11563_CR264","doi-asserted-by":"crossref","unstructured":"Rajivan P, Gonzalez C (2018) Creative persuasion: a study on adversarial behaviors and strategies in phishing attacks. Front Psychol 9\u20132018","DOI":"10.3389\/fpsyg.2018.00135"},{"key":"11563_CR265","unstructured":"Reid A, O\u2019Callaghan S, Carroll L, et al. (2025) Risk analysis techniques for governed llm-based multi-agent systems. arXiv preprint arXiv:2508.05687"},{"key":"11563_CR266","doi-asserted-by":"publisher","unstructured":"Ren Q, Li H, Liu D, et al. (2025) LLMs know their vulnerabilities: Uncover safety gaps through natural distribution shifts. In: Che W, Nabende J, Shutova E, et al. (eds) Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers). Association for Computational Linguistics, Vienna, Austria, pp 24763\u201324785, https:\/\/doi.org\/10.18653\/v1\/2025.acl-long.1207","DOI":"10.18653\/v1\/2025.acl-long.1207"},{"key":"11563_CR267","unstructured":"Robey A, Wong E, Hassani H, et al. (2023) Smoothllm: defending large language models against jailbreaking attacks. arXiv preprint arXiv:2310.03684"},{"key":"11563_CR268","unstructured":"Ross S, Gordon G, Bagnell D (2011) A reduction of imitation learning and structured prediction to no-regret online learning. In: Proceedings of the fourteenth international conference on artificial intelligence and statistics, JMLR Workshop and Conference Proceedings, pp 627\u2013635"},{"key":"11563_CR269","doi-asserted-by":"publisher","unstructured":"Ross H, Mahabaleshwarkar AS, Suhara Y (2025) When2Call: When (not) to call tools. In: Chiruzzo L, Ritter A, Wang L (eds) Proceedings of the 2025 Conference of the Nations of the Americas Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers). Association for Computational Linguistics, Albuquerque, New Mexico, pp 3391\u20133409, https:\/\/doi.org\/10.18653\/v1\/2025.naacl-long.174","DOI":"10.18653\/v1\/2025.naacl-long.174"},{"key":"11563_CR270","unstructured":"Roy SS, Thota P, Naragam KV, et al. (2023) From chatbots to phishbots?\u2013preventing phishing scams created using chatgpt, google bard and claude. arXiv preprint arXiv:2310.19181"},{"key":"11563_CR271","unstructured":"Ruan Y, Dong H, Wang A, et al. (2023) Identifying the risks of lm agents with an lm-emulated sandbox. arXiv preprint arXiv:2309.15817"},{"key":"11563_CR272","unstructured":"Sabir B, Babar MA, Abuadbba S (2023) Interpretability and transparency-driven detection and transformation of textual adversarial examples (it-dt). arXiv preprint arXiv:2307.01225"},{"key":"11563_CR273","doi-asserted-by":"publisher","unstructured":"Sadhu T, Pesaranghader A, Chen Y, et al. (2024) Athena: safe autonomous agents with verbal contrastive learning. In: Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing: Industry Track, pp 1121\u20131130, https:\/\/doi.org\/10.18653\/v1\/2024.emnlp-industry.84","DOI":"10.18653\/v1\/2024.emnlp-industry.84"},{"issue":"2","key":"11563_CR274","doi-asserted-by":"publisher","first-page":"590","DOI":"10.1016\/j.jksuci.2023.01.004","volume":"35","author":"A Safi","year":"2023","unstructured":"Safi A, Singh S (2023) A systematic literature review on phishing website detection techniques. J King Saud Univ Comput Inform Sci 35(2):590\u2013611","journal-title":"J King Saud Univ Comput Inform Sci"},{"key":"11563_CR275","unstructured":"Saha B, Shukla SK (2025) Malgen: a generative agent framework for modeling malicious software in cybersecurity. arXiv preprint arXiv:2506.07586"},{"issue":"9","key":"11563_CR276","doi-asserted-by":"publisher","first-page":"1278","DOI":"10.1109\/PROC.1975.9939","volume":"63","author":"JH Saltzer","year":"1975","unstructured":"Saltzer JH, Schroeder MD (1975) The protection of information in computer systems. Proc IEEE 63(9):1278\u20131308","journal-title":"Proc IEEE"},{"key":"11563_CR277","doi-asserted-by":"publisher","DOI":"10.1109\/TCNS.2025.3570931","author":"G Shaaban","year":"2025","unstructured":"Shaaban G, Fourati H, Kibangou A et al. (2025) Active defense strategy in cyber-physical systems: misleading unauthorized observers. IEEE Trans Control Netw Syst. https:\/\/doi.org\/10.1109\/TCNS.2025.3570931","journal-title":"IEEE Trans Control Netw Syst"},{"key":"11563_CR278","unstructured":"Shafran A, Schuster R, Shmatikov V (2025) Machine against the $$\\{$$RAG$$\\}$$: Jamming $$\\{$$Retrieval-Augmented$$\\}$$ generation with blocker documents. In: 34th USENIX Security Symposium (USENIX Security 25), pp 3787\u20133806"},{"key":"11563_CR279","unstructured":"Shah S, Parast FK (2024) Ai-driven cyber threat intelligence automation. arXiv preprint arXiv:2410.20287"},{"key":"11563_CR280","doi-asserted-by":"crossref","unstructured":"Shao M, Jancheska S, Udeshi M, et al. (2024) Nyu ctf bench: a scalable open-source benchmark dataset for evaluating llms in offensive security. In: Globerson A, Mackey L, Belgrave D, et al. (eds) Advances in Neural Information Processing Systems, vol\u00a037. Curran Associates, Inc., pp 57472\u201357498, https:\/\/proceedings.neurips.cc\/paper_files\/paper\/2024\/file\/69d97a6493fbf016fff0a751f253ad18-Paper-Datasets_and_Benchmarks_Track.pdf","DOI":"10.52202\/079017-1832"},{"key":"11563_CR281","doi-asserted-by":"crossref","unstructured":"Shashwat K, Hahn F, Ou X, et al. (2024) A preliminary study on using large language models in software pentesting. arXiv preprint arXiv:2401.17459arXiv:2401.17459","DOI":"10.14722\/wosoc.2024.23002"},{"key":"11563_CR282","doi-asserted-by":"crossref","unstructured":"Shen X, Wang L, Li Z, et al. (2024) Pentestagent: incorporating llm agents to automated penetration testing. arXiv preprint arXiv:2411.05185","DOI":"10.1145\/3708821.3733882"},{"key":"11563_CR283","doi-asserted-by":"crossref","unstructured":"Shi J, Yuan Z, Tie G, et al. (2025b) Prompt injection attack to tool selection in llm agents. arXiv preprint arXiv:2504.19793","DOI":"10.14722\/ndss.2026.230675"},{"key":"11563_CR284","doi-asserted-by":"crossref","unstructured":"Shi J, Yuan Z, Tie G, et al. (2025c) Prompt injection attack to tool selection in llm agents. arXiv preprint arXiv:2504.19793","DOI":"10.14722\/ndss.2026.230675"},{"key":"11563_CR285","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2024.125723","volume":"263","author":"J Shi","year":"2025","unstructured":"Shi J, Zhao J, Wu X et al. (2025) Mitigating reasoning hallucination through multi-agent collaborative filtering. Expert Syst Appl 263:125723. https:\/\/doi.org\/10.1016\/j.eswa.2024.125723","journal-title":"Expert Syst Appl"},{"key":"11563_CR286","unstructured":"Shi G, Du H, Wang Z, et al. (2025a) Sok: trust-authorization mismatch in llm agent interactions. arXiv preprint arXiv:2512.06914"},{"key":"11563_CR287","unstructured":"Shi T, He J, Wang Z, et al. (2025e) Progent: programmable privilege control for llm agents. arXiv preprint arXiv:2504.11703arXiv:2504.11703"},{"key":"11563_CR288","doi-asserted-by":"publisher","first-page":"8634","DOI":"10.52202\/075280-0377","volume":"36","author":"N Shinn","year":"2023","unstructured":"Shinn N, Cassano F, Gopinath A et al. (2023) Reflexion: language agents with verbal reinforcement learning. Adv Neural Inf Process Syst 36:8634\u20138652","journal-title":"Adv Neural Inf Process Syst"},{"key":"11563_CR289","doi-asserted-by":"publisher","unstructured":"Shi W, Xu R, Zhuang Y, et al. (2024) EHRAgent: code empowers large language models for few-shot complex tabular reasoning on electronic health records. In: Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pp 22315\u201322339, https:\/\/doi.org\/10.18653\/v1\/2024.emnlp-main.1245","DOI":"10.18653\/v1\/2024.emnlp-main.1245"},{"key":"11563_CR290","doi-asserted-by":"crossref","unstructured":"Shokri R, Stronati M, Song C, et al. (2017) Membership inference attacks against machine learning models. In: 2017 IEEE symposium on security and privacy (SP), IEEE, pp 3\u201318","DOI":"10.1109\/SP.2017.41"},{"key":"11563_CR291","doi-asserted-by":"crossref","unstructured":"Siska C, Sankaran A (2025) Attentiondefense: Leveraging system prompt attention for explainable defense against novel jailbreaks. arXiv preprint arXiv:2504.12321","DOI":"10.1109\/IJCNN64981.2025.11228703"},{"key":"11563_CR292","unstructured":"Siththaranjan A, Laidlaw C, Hadfield-Menell D (2023) Understanding hidden context in preference learning: consequences for rlhf. In: Socially Responsible Language Modelling Research"},{"key":"11563_CR293","doi-asserted-by":"crossref","unstructured":"Skalse J, Howe N, Krasheninnikov D, et al. (2022) Defining and characterizing reward gaming. In: Koyejo S, Mohamed S, Agarwal A, et al. (eds) Advances in Neural Information Processing Systems, vol\u00a035. Curran Associates, Inc., pp 9460\u20139471, https:\/\/proceedings.neurips.cc\/paper_files\/paper\/2022\/file\/3d719fee332caa23d5038b8a90e81796-Paper-Conference.pdf","DOI":"10.52202\/068431-0687"},{"issue":"1","key":"11563_CR294","doi-asserted-by":"publisher","first-page":"8","DOI":"10.1186\/s42400-020-00048-4","volume":"3","author":"F Skopik","year":"2020","unstructured":"Skopik F, Pahi T (2020) Under false flag: using technical artifacts for cyber attack attribution. Cybersecurity 3(1):8. https:\/\/doi.org\/10.1186\/s42400-020-00048-4","journal-title":"Cybersecurity"},{"key":"11563_CR295","unstructured":"Song C, Ma L, Zheng J, et al. (2024a) Audit-llm: multi-agent collaboration for log-based insider threat detection. arXiv preprint arXiv:2408.08902"},{"key":"11563_CR296","unstructured":"Song C, Ma L, Zheng J, et al. (2024b) Audit-llm: multi-agent collaboration for log-based insider threat detection. arXiv preprint arXiv:2408.08902"},{"key":"11563_CR297","unstructured":"Srivastava SS, He H (2025) Memorygraft: persistent compromise of llm agents via poisoned experience retrieval. arXiv preprint arXiv:2512.16962"},{"key":"11563_CR298","doi-asserted-by":"crossref","unstructured":"Stevens R, Votipka D, Dykstra J, et al. (2022) How ready is your ready? Assessing the usability of incident response playbook frameworks. In: Proceedings of the 2022 CHI Conference on Human Factors in Computing Systems, pp 1\u201318","DOI":"10.1145\/3491102.3517559"},{"key":"11563_CR299","unstructured":"Strom BE, Applebaum A, Miller DP, et al. (2018) Mitre att&ck: Design and philosophy. In: Technical report. The MITRE Corporation"},{"issue":"3","key":"11563_CR300","doi-asserted-by":"publisher","first-page":"1748","DOI":"10.1109\/COMST.2023.3273282","volume":"25","author":"N Sun","year":"2023","unstructured":"Sun N, Ding M, Jiang J et al. (2023) Cyber threat intelligence mining for proactive cybersecurity defense: a survey and new perspectives. IEEE Commun Surv Tutorials 25(3):1748\u20131774. https:\/\/doi.org\/10.1109\/COMST.2023.3273282","journal-title":"IEEE Commun Surv Tutorials"},{"key":"11563_CR301","doi-asserted-by":"publisher","unstructured":"Sun X, Li J, Zhong Y, et al. (2025) Towards detecting llms hallucination via markov chain-based multi-agent debate framework. In: ICASSP 2025\u20132025 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp 1\u20135, https:\/\/doi.org\/10.1109\/ICASSP49660.2025.10889448","DOI":"10.1109\/ICASSP49660.2025.10889448"},{"key":"11563_CR302","doi-asserted-by":"crossref","unstructured":"Suo X (2024) Signed-prompt: A new approach to prevent prompt injection attacks against llm-integrated applications. In: AIP Conference Proceedings","DOI":"10.1063\/5.0222987"},{"key":"11563_CR303","unstructured":"Szegedy C, Zaremba W, Sutskever I, et al. (2013) Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199"},{"key":"11563_CR304","doi-asserted-by":"crossref","unstructured":"Tang X, Jin Q, Zhu K, et al. (2024) Prioritizing safeguarding over autonomy: risks of llm agents for science. arXiv preprint arXiv:2402.04247","DOI":"10.1038\/s41467-025-63913-1"},{"key":"11563_CR305","unstructured":"Team BS (2024) From naptime to big sleep: Using large language models to catch vulnerabilities in real-world code. https:\/\/googleprojectzero.blogspot.com\/2024\/10\/from-naptime-to-big-sleep.html"},{"key":"11563_CR306","unstructured":"Technology BI (2023a) Baichuan2-13b-chat. https:\/\/huggingface.co\/baichuan-inc\/Baichuan2-13B-Chat"},{"key":"11563_CR307","unstructured":"Technology BI (2023b) Baichuan2-13b-chat. https:\/\/huggingface.co\/baichuan-inc\/Baichuan2-7B-Chat"},{"key":"11563_CR308","unstructured":"Tennant E, Hailes S, Musolesi M (2024) Moral alignment for llm agents. arXiv preprint arXiv:2410.01639"},{"key":"11563_CR309","unstructured":"Teoh X, Lin Y, Li S, et al. (2025) Are $$\\{$$CAPTCHAs$$\\}$$ still bot-hard? Generalized visual $$\\{$$CAPTCHA$$\\}$$ solving with agentic vision language model. In: 34th USENIX Security Symposium (USENIX Security 25), pp 3747\u20133766"},{"key":"11563_CR310","doi-asserted-by":"publisher","first-page":"7227","DOI":"10.1109\/TIFS.2025.3587211","volume":"20","author":"Z Tian","year":"2025","unstructured":"Tian Z, He Y, Zhang N et al. (2025) Blmprobe: enhancing internet-connected device discovery by automated device labeling and label migration. IEEE Trans Inf Forensics Secur 20:7227\u20137242. https:\/\/doi.org\/10.1109\/TIFS.2025.3587211","journal-title":"IEEE Trans Inf Forensics Secur"},{"key":"11563_CR311","unstructured":"Tian Y, Yang X, Zhang J, et al. (2023) Evil geniuses: delving into the safety of llm-based agents. arXiv preprint arXiv:2311.11855"},{"key":"11563_CR312","unstructured":"Timms A, Langbridge A, O\u2019Donncha F (2024) Agentic anomaly detection for shipping. In: NeurIPS 2024 Workshop on Open-World Agents"},{"key":"11563_CR313","unstructured":"Touvron H, Martin L, Stone K, et al. (2023) Llama 2: open foundation and fine-tuned chat models. arXiv preprint arXiv:2307.09288"},{"key":"11563_CR314","unstructured":"Toyer S, Watkins O, Mendes EA, et al. (2024) Tensor trust: interpretable prompt injection attacks from an online game. In: The Twelfth International Conference on Learning Representations"},{"key":"11563_CR315","doi-asserted-by":"crossref","unstructured":"Trad F, Chehab A (2024) Large multimodal agents for accurate phishing detection with enhanced token optimization and cost reduction. In: 2024 2nd International Conference on Foundation and Large Language Models (FLLM), pp 229\u2013237","DOI":"10.1109\/FLLM63129.2024.10852444"},{"key":"11563_CR316","doi-asserted-by":"publisher","unstructured":"Trung L, Zhang X, Jie Z, et al. (2024) ReFT: reasoning with reinforced fine-tuning. In: Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pp 7601\u20137614, https:\/\/doi.org\/10.18653\/v1\/2024.acl-long.410","DOI":"10.18653\/v1\/2024.acl-long.410"},{"key":"11563_CR317","unstructured":"Tsipras D, Santurkar S, Engstrom L, et al. (2019) Robustness may be at odds with accuracy. In: International Conference on Learning Representations"},{"key":"11563_CR318","unstructured":"Upadhayay B, Behzadan V, Karbasi A (2024) Cognitive overload attack: prompt injection for long context. arXiv preprint arXiv:2410.11272"},{"key":"11563_CR319","unstructured":"Valencia LJ (2024) Artificial intelligence as the new hacker: developing agents for offensive security. arXiv preprint arXiv:2406.07561"},{"key":"11563_CR320","doi-asserted-by":"publisher","unstructured":"Vu T, Iyyer M, Wang X, et al. (2024) FreshLLMs: refreshing large language models with search engine augmentation. In: Findings of the Association for Computational Linguistics: ACL 2024, pp 13697\u201313720https:\/\/doi.org\/10.18653\/v1\/2024.findings-acl.813","DOI":"10.18653\/v1\/2024.findings-acl.813"},{"key":"11563_CR321","unstructured":"Wallace E, Xiao K, Leike R, et al. (2024a) The instruction hierarchy: training llms to prioritize privileged instructions. arXiv preprint arXiv:2404.13208"},{"key":"11563_CR322","unstructured":"Wallace E, Xiao K, Leike R, et al. (2024b) The instruction hierarchy: training llms to prioritize privileged instructions. arXiv preprint arXiv:2404.13208"},{"key":"11563_CR323","unstructured":"Wan A, Wallace E, Shen S, et al. (2023) Poisoning language models during instruction tuning. In: Proceedings of the 40th International Conference on Machine Learning, pp 35413\u201335425, https:\/\/proceedings.mlr.press\/v202\/wan23b.html"},{"issue":"1","key":"11563_CR324","doi-asserted-by":"publisher","first-page":"31","DOI":"10.1186\/s42400-021-00094-6","volume":"4","author":"Z Wang","year":"2021","unstructured":"Wang Z, Zhu H, Liu P et al. (2021) Social engineering in cybersecurity: a domain ontology and knowledge graph application examples. Cybersecurity 4(1):31","journal-title":"Cybersecurity"},{"key":"11563_CR325","unstructured":"Wang C, Chen S, Wu Y, et al. (2023a) Neural codec language models are zero-shot text to speech synthesizers. arXiv preprint arXiv:2301.02111"},{"key":"11563_CR326","unstructured":"Wang ZZ, Mao J, Fried D, et al. (2024d) Agent workflow memory. arXiv preprint arXiv:2409.07429"},{"key":"11563_CR327","doi-asserted-by":"publisher","unstructured":"Wang X, Bloch J, Shao Z, et al. (2025a) WebInject: prompt injection attack to web agents. In: Christodoulopoulos C, Chakraborty T, Rose C, et al. (eds) Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing. Association for Computational Linguistics, Suzhou, China, pp 2010\u20132030, https:\/\/doi.org\/10.18653\/v1\/2025.emnlp-main.104","DOI":"10.18653\/v1\/2025.emnlp-main.104"},{"key":"11563_CR328","unstructured":"Wang F, Duan R, Xiao P, et al. (2024a) Mrj-agent: an effective jailbreak agent for multi-round dialogue. arXiv preprint arXiv:2411.03814"},{"key":"11563_CR329","unstructured":"Wang L, Li Z, Jiang Y, et al. (2024b) From sands to mansions: towards automated cyberattack emulation with classical planning and large language models. arXiv preprint arXiv:2407.16928"},{"key":"11563_CR330","unstructured":"Wang S, Liu C, Zheng Z, et al. (2023b) Avalon\u2019s game of thoughts: battle against deception through recursive contemplation. arXiv preprint arXiv:2310.01320"},{"key":"11563_CR331","doi-asserted-by":"crossref","unstructured":"Wang X, Sun K, Batcheller A, et al. (2019b) Detecting\" 0-day\" vulnerability: an empirical study of secret security patch in oss. In: 2019 49th Annual IEEE\/IFIP International Conference on Dependable Systems and Networks (DSN), IEEE, pp 485\u2013492","DOI":"10.1109\/DSN.2019.00056"},{"key":"11563_CR332","doi-asserted-by":"publisher","unstructured":"Wang S, Wang Z, Yin X, et al. (2020) Poster abstract: an unsupervised two-layer multi-step network attack detector. In: IEEE INFOCOM 2020 - IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS), pp 1308\u20131309, https:\/\/doi.org\/10.1109\/INFOCOMWKSHPS50562.2020.9163041","DOI":"10.1109\/INFOCOMWKSHPS50562.2020.9163041"},{"key":"11563_CR333","doi-asserted-by":"publisher","unstructured":"Wang Y, Xue D, Zhang S, et al. (2024c) BadAgent: inserting and activating backdoor attacks in LLM agents. In: Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pp 9811\u20139827, https:\/\/doi.org\/10.18653\/v1\/2024.acl-long.530","DOI":"10.18653\/v1\/2024.acl-long.530"},{"key":"11563_CR334","doi-asserted-by":"crossref","unstructured":"Wang B, Yao Y, Shan S, et al. (2019a) Neural cleanse: identifying and mitigating backdoor attacks in neural networks. In: 2019 IEEE symposium on security and privacy (SP), IEEE, pp 707\u2013723","DOI":"10.1109\/SP.2019.00031"},{"key":"11563_CR335","unstructured":"Wang Y, Zhai H, Wang C, et al. (2025b) Can you walk me through it? Explainable $$\\{$$SMS$$\\}$$ phishing detection using $$\\{$$LLM-based$$\\}$$ agents. In: Twenty-First Symposium on Usable Privacy and Security (SOUPS 2025), pp 37\u201356"},{"key":"11563_CR336","doi-asserted-by":"crossref","unstructured":"Wei J, Wang X, Schuurmans D, et al. (2022) Chain-of-thought prompting elicits reasoning in large language models. In: Koyejo S, Mohamed S, Agarwal A, et al. (eds) Advances in Neural Information Processing Systems, vol\u00a035. Curran Associates, Inc., pp 24824\u201324837, https:\/\/proceedings.neurips.cc\/paper_files\/paper\/2022\/file\/9d5609613524ecf4f15af0f7b31abca4-Paper-Conference.pdf","DOI":"10.52202\/068431-1800"},{"key":"11563_CR337","unstructured":"Wei Z, Chen WL, Meng Y (2024a) Instructrag: instructing retrieval augmented generation via self-synthesized rationales. In: Adaptive Foundation Models: Evolving AI for Personalized and Efficient Learning"},{"key":"11563_CR338","unstructured":"Wei Z, Sun J, Zhang Z, et al. (2024b) Llm-smartaudit: advanced smart contract vulnerability detection. arXiv preprint arXiv:2410.09381"},{"key":"11563_CR339","doi-asserted-by":"publisher","unstructured":"Weng Z, Jin X, Jia J, et al. (2025) Foot-in-the-door: a multi-turn jailbreak for LLMs. In: Christodoulopoulos C, Chakraborty T, Rose C, et al. (eds) Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing. Association for Computational Linguistics, Suzhou, China, pp 1939\u20131950, https:\/\/doi.org\/10.18653\/v1\/2025.emnlp-main.100","DOI":"10.18653\/v1\/2025.emnlp-main.100"},{"key":"11563_CR340","unstructured":"Willison S (2023) You can\u2019t solve ai security problems with more ai. https:\/\/simonwillison.net\/2022\/Sep\/17\/prompt-injection-more-ai\/"},{"key":"11563_CR341","doi-asserted-by":"crossref","unstructured":"Wu Z, Hu Y, Shi W, et al. (2023) Fine-grained human feedback gives better rewards for language model training. In: Advances in Neural Information Processing Systems, pp 59008\u201359033, https:\/\/proceedings.neurips.cc\/paper_files\/paper\/2023\/file\/b8c90b65739ae8417e61eadb521f63d5-Paper-Conference.pdf","DOI":"10.52202\/075280-2574"},{"key":"11563_CR342","unstructured":"Wu CH, Shah RR, Koh JY, et al. (2025a) Dissecting adversarial robustness of multimodal lm agents. In: The Thirteenth International Conference on Learning Representations"},{"key":"11563_CR343","unstructured":"Wu Z, Gao H, He J, et al. (2025c) The dark side of function calling: Pathways to jailbreaking large language models. In: Proceedings of the 31st International Conference on Computational Linguistics, pp 584\u2013592, https:\/\/aclanthology.org\/2025.coling-main.39\/"},{"key":"11563_CR344","unstructured":"Wu B, Chen G, Chen K, et al. (2024) Autopt: how far are we from the end2end automated web penetration testing? arXiv preprint arXiv:2411.01236"},{"key":"11563_CR345","unstructured":"Wu Y, Velazco M, Zhao A, et al. (2025b) Excytin-bench: evaluating llm agents on cyber threat investigation. arXiv preprint arXiv:2507.14201"},{"key":"11563_CR346","unstructured":"Wynn A, Satija H, Hadfield G (2025) Talk isn\u2019t always cheap: understanding failure modes in multi-agent debate. arXiv preprint arXiv:2509.05396"},{"issue":"2","key":"11563_CR347","doi-asserted-by":"publisher","DOI":"10.1007\/s11432-024-4222-0","volume":"68","author":"Z Xi","year":"2025","unstructured":"Xi Z, Chen W, Guo X et al. (2025) The rise and potential of large language model based agents: a survey. Sci China Inf Sci 68(2):121101. https:\/\/doi.org\/10.1007\/s11432-024-4222-0","journal-title":"Sci China Inf Sci"},{"key":"11563_CR348","unstructured":"Xiang C, Wu T, Zhong Z, et al. (2024) Certifiably robust rag against retrieval corruption. arXiv preprint arXiv:2405.15556"},{"key":"11563_CR349","unstructured":"Xiang Z, Zheng L, Li Y, et al. (2025) Guardagent: safeguard llm agents by a guard agent via knowledge-enabled reasoning. arXiv:2406.09187"},{"key":"11563_CR350","unstructured":"Xian X, Wang T, You L, et al. (2024) Understanding data poisoning attacks for rag: insights and algorithms"},{"issue":"12","key":"11563_CR351","doi-asserted-by":"publisher","first-page":"1486","DOI":"10.1038\/s42256-023-00765-8","volume":"5","author":"Y Xie","year":"2023","unstructured":"Xie Y, Yi J, Shao J et al. (2023) Defending chatgpt against jailbreak attack via self-reminders. Nat Mach Intell 5(12):1486\u20131496. https:\/\/doi.org\/10.1038\/s42256-023-00765-8","journal-title":"Nat Mach Intell"},{"key":"11563_CR352","doi-asserted-by":"publisher","first-page":"52040","DOI":"10.52202\/079017-1650","volume":"37","author":"T Xie","year":"2024","unstructured":"Xie T, Zhang D, Chen J et al. (2024) Osworld: benchmarking multimodal agents for open-ended tasks in real computer environments. Adv Neural Inf Process Syst 37:52040\u201352094","journal-title":"Adv Neural Inf Process Syst"},{"key":"11563_CR353","doi-asserted-by":"publisher","unstructured":"Xie Y, Yuan Y, Wang W, et al. (2025) ToolSafety: a comprehensive dataset for enhancing safety in LLM-based agent tool invocations. In: Christodoulopoulos C, Chakraborty T, Rose C, et al. (eds) Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing. Association for Computational Linguistics, Suzhou, China, pp 14135\u201314156, https:\/\/doi.org\/10.18653\/v1\/2025.emnlp-main.714","DOI":"10.18653\/v1\/2025.emnlp-main.714"},{"key":"11563_CR354","doi-asserted-by":"publisher","unstructured":"Xu L, Hu Z, Zhou D, et al. (2024c) MAgIC: Investigation of large language model powered multi-agent in cognition, adaptability, rationality and collaboration. In: Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pp 7315\u20137332, https:\/\/doi.org\/10.18653\/v1\/2024.emnlp-main.416","DOI":"10.18653\/v1\/2024.emnlp-main.416"},{"key":"11563_CR355","unstructured":"Xu Z, Yu C, Fang F, et al. (2024d) Language agents with reinforcement learning for strategic play in the werewolf game. In: Proceedings of the 41st International Conference on Machine Learning, pp 55434\u201355464, https:\/\/proceedings.mlr.press\/v235\/xu24ad.html"},{"key":"11563_CR356","doi-asserted-by":"crossref","unstructured":"Xu W, Shi Y, Liang Z, et al. (2025c) iagent: Llm agent as a shield between user and recommender systems. arXiv preprint arXiv:2502.14662","DOI":"10.18653\/v1\/2025.findings-acl.928"},{"key":"11563_CR357","unstructured":"Xue Y, Spero E, Koh YS, et al. (2025) Multiphishguard: an llm-based multi-agent system for phishing email detection. arXiv preprint arXiv:2505.23803"},{"key":"11563_CR358","unstructured":"Xu M, Fan J, Huang X, et al. (2025b) Forewarned is forearmed: a survey on large language model-based agents in autonomous cyberattacks. arXiv preprint arXiv:2505.12786"},{"key":"11563_CR359","unstructured":"Xu C, Kang M, Zhang J, et al. (2024a) Advweb: controllable black-box attacks on vlm-powered web agents. arXiv preprint arXiv:2410.17401"},{"key":"11563_CR360","unstructured":"Xu C, Kang M, Zhang J, et al. (2025a) Advagent: controllable blackbox red-teaming on web agents. In: Forty-second International Conference on Machine Learning, https:\/\/openreview.net\/forum?id=bwidSkOyWF"},{"key":"11563_CR361","unstructured":"Xu J, Stokes JW, McDonald G, et al. (2024b) Autoattacker: a large language model guided system to implement automatic cyber-attacks. arXiv preprint arXiv:2403.01038"},{"key":"11563_CR362","unstructured":"Xu Y, Wang S, Li P, et al. (2023) Exploring large language models for communication games: an empirical study on werewolf. arXiv preprint arXiv:2309.04658"},{"key":"11563_CR363","unstructured":"Yaman F (2023) Agent SCA: advanced physical side channel analysis agent with LLMs. North Carolina State University"},{"key":"11563_CR364","unstructured":"Yang W, Bi X, Lin Y, et al. (2024b) Watch out for your agents! investigating backdoor threats to llm-based agents. In: Advances in Neural Information Processing Systems, pp 100938\u2013100964, https:\/\/proceedings.neurips.cc\/paper_files\/paper\/2024\/file\/b6e9d6f4f3428cd5f3f9e9bbae2cab10-Paper-Conference.pdf"},{"key":"11563_CR365","doi-asserted-by":"publisher","unstructured":"Yang T, Jiang Z, Wang Y (2024a) Llmsqli: a black-box web sqli detection tool based on large language model. In: 2024 5th International Conference on Big Data & Artificial Intelligence & Software Engineering (ICBASE), pp 629\u2013633, https:\/\/doi.org\/10.1109\/ICBASE63199.2024.10762654","DOI":"10.1109\/ICBASE63199.2024.10762654"},{"key":"11563_CR366","unstructured":"Yang S, Zheng X, Zhang X, et al. (2025) Large language models for network intrusion detection systems: foundations, implementations, and future directions. arXiv preprint arXiv:2507.04752"},{"key":"11563_CR367","unstructured":"Yan H, Vaidya SS, Zhang X, et al. (2025) Guiding ai to fix its own flaws: an empirical study on llm-driven secure code generation. arXiv preprint arXiv:2506.23034"},{"key":"11563_CR368","doi-asserted-by":"crossref","unstructured":"Yan L, Zhang Z, Tao G, et al. (2023) Parafuzz: an interpretability-driven technique for detecting poisoned samples in nlp. In: Advances in Neural Information Processing Systems, pp 66755\u201366767, https:\/\/proceedings.neurips.cc\/paper_files\/paper\/2023\/file\/d2b752ed4726286a4b488ae16e091d64-Paper-Conference.pdf","DOI":"10.52202\/075280-2914"},{"issue":"2","key":"11563_CR369","doi-asserted-by":"publisher","DOI":"10.1016\/j.hcc.2024.100211","volume":"4","author":"Y Yao","year":"2024","unstructured":"Yao Y, Duan J, Xu K et al. (2024) A survey on large language model (llm) security and privacy: The good, the bad, and the ugly. High-Confidence Comput 4(2):100211","journal-title":"High-Confidence Comput"},{"key":"11563_CR370","unstructured":"Yao F, Cheng Y, Wei E, et al. (2025b) Single-agent poisoning attacks suffice to ruin multi-agent learning. In: The Thirteenth International Conference on Learning Representations"},{"key":"11563_CR371","unstructured":"Yao B, Shang C, Du W, et al. (2025a) Peacemaker or troublemaker: how sycophancy shapes multi-agent debate. arXiv preprint arXiv:2509.23055"},{"key":"11563_CR372","unstructured":"Yao S, Zhao J, Yu D, et al. (2023) React: synergizing reasoning and acting in language models. In: International Conference on Learning Representations (ICLR)"},{"key":"11563_CR373","unstructured":"Yi J, Xie Y, Zhu B, et al. (2023) Benchmarking and defending against indirect prompt injection attacks on large language models. arXiv preprint arXiv:2312.14197"},{"key":"11563_CR374","doi-asserted-by":"publisher","unstructured":"Yuan T, He Z, Dong L, et al. (2024) R-judge: benchmarking safety risk awareness for LLM agents. In: Findings of the Association for Computational Linguistics: EMNLP 2024, pp 1467\u20131490, https:\/\/doi.org\/10.18653\/v1\/2024.findings-emnlp.79","DOI":"10.18653\/v1\/2024.findings-emnlp.79"},{"key":"11563_CR375","doi-asserted-by":"crossref","unstructured":"Yu M, Meng F, Zhou X, et al. (2025) A survey on trustworthy llm agents: threats and countermeasures. arXiv preprint arXiv:2503.09648","DOI":"10.1145\/3711896.3736561"},{"key":"11563_CR376","unstructured":"Yu M, Wang S, Zhang G, et al. (2024) Netsafe: exploring the topological safety of multi-agent networks. arXiv preprint arXiv:2410.15686arXiv:2410.15686"},{"key":"11563_CR377","unstructured":"Zeng Y, Wu Y, Zhang X, et al. (2024) Autodefense: multi-agent llm defense against jailbreak attacks. arXiv preprint arXiv:2403.04783"},{"key":"11563_CR378","unstructured":"Zhai B, Yang S, Xu C, et al. (2024) Halle-control: controlling object hallucination in large multimodal models. arXiv:2310.01779"},{"key":"11563_CR379","unstructured":"Zhang AK, Perry N, Dulepet R, et al. (2024a) Cybench: a framework for evaluating cybersecurity capabilities and risks of language models. arXiv preprint arXiv:2408.08926"},{"issue":"3","key":"11563_CR380","doi-asserted-by":"publisher","first-page":"107","DOI":"10.1145\/3446776","volume":"64","author":"C Zhang","year":"2021","unstructured":"Zhang C, Bengio S, Hardt M et al. (2021) Understanding deep learning (still) requires rethinking generalization. Commun ACM 64(3):107\u2013115. https:\/\/doi.org\/10.1145\/3446776","journal-title":"Commun ACM"},{"key":"11563_CR381","unstructured":"Zhang X, Wang W, Xu P, et al. (2023) High recovery with fewer injections: Practical binary volumetric injection attacks against dynamic searchable encryption. In: 32nd USENIX Security Symposium (USENIX Security 23). USENIX Association, Anaheim, CA, pp 5953\u20135970, https:\/\/www.usenix.org\/conference\/usenixsecurity23\/presentation\/zhang-xianglong"},{"issue":"7","key":"11563_CR382","first-page":"1","volume":"56","author":"J Zhang","year":"2024","unstructured":"Zhang J, Chen C, Cui J et al. (2024) Timing side-channel attacks and countermeasures in cpu microarchitectures. ACM Comput Surv 56(7):1\u201340","journal-title":"ACM Comput Surv"},{"key":"11563_CR383","unstructured":"Zhang M, Gong H, Liu Q, et al. (2024e) Breaking event rumor detection via stance-separated multi-agent debate. arXiv preprint arXiv:2412.04859"},{"key":"11563_CR384","doi-asserted-by":"crossref","unstructured":"Zhang Y, Yu T, Yang D (2024h) Attacking vision-language computer agents via pop-ups. arXiv preprint arXiv:2411.02391","DOI":"10.18653\/v1\/2025.acl-long.411"},{"key":"11563_CR385","doi-asserted-by":"crossref","unstructured":"Zhang S, So O, Black M, et al. (2025b) Solving multi-agent safe optimal control with distributed epigraph form marl. arXiv preprint arXiv:2504.15425","DOI":"10.15607\/RSS.2025.XXI.027"},{"key":"11563_CR386","unstructured":"Zhang Y, Wu Y, Hua W, et al. (2025c) Attention mechanism for llm-based agents dynamic diffusion under information asymmetry. arXiv preprint arXiv:2502.13160"},{"key":"11563_CR387","unstructured":"Zhang Y, Yang Y, Shu J, et al. (2025d) Agent models: Internalizing chain-of-action generation into reasoning models. arXiv preprint arXiv:2503.06580"},{"key":"11563_CR388","unstructured":"Zhang Y, Chen K, Jiang X, et al. (2024g) Towards action hijacking of large language model-based agent. arXiv preprint arXiv:2412.10807"},{"key":"11563_CR389","doi-asserted-by":"publisher","unstructured":"Zhang X, Hong H, Hong Y, et al. (2024f) Text-crs: a generalized certified robustness framework against textual adversarial attacks. In: 2024 IEEE Symposium on Security and Privacy (SP), pp 2920\u20132938, https:\/\/doi.org\/10.1109\/SP54263.2024.00053","DOI":"10.1109\/SP54263.2024.00053"},{"key":"11563_CR390","unstructured":"Zhang H, Huang J, Mei K, et al. (2024c) Agent security bench (asb): formalizing and benchmarking attacks and defenses in llm-based agents. arXiv preprint arXiv:2410.02644"},{"key":"11563_CR391","doi-asserted-by":"crossref","unstructured":"Zhang B, Tan Y, Shen Y, et al. (2024b) Breaking agents: compromising autonomous llm agents through malfunction amplification. arXiv preprint arXiv:2407.20859","DOI":"10.18653\/v1\/2025.emnlp-main.1771"},{"key":"11563_CR392","unstructured":"Zhang J, Yang S, Li B (2025a) UDora: a unified red teaming framework against LLM agents by dynamically hijacking their own reasoning. In: Forty-second International Conference on Machine Learning, https:\/\/openreview.net\/forum?id=pRmxQHgjb1"},{"key":"11563_CR393","doi-asserted-by":"crossref","unstructured":"Zhang Z, Zhang Y, Li L, et al. (2024i) Psysafe: a comprehensive framework for psychological-based attack, defense, and evaluation of multi-agent system safety. In: Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pp 15202\u201315231","DOI":"10.18653\/v1\/2024.acl-long.812"},{"key":"11563_CR394","doi-asserted-by":"crossref","unstructured":"Zhang Y, Zhao X, Ma Y, et al. (2025e) Mm-attackg: a multimodal approach to attack graph construction with large language models. arXiv preprint arXiv:2506.16968","DOI":"10.1016\/j.knosys.2026.115483"},{"key":"11563_CR395","doi-asserted-by":"crossref","unstructured":"Zhan Q, Liang Z, Ying Z, et al. (2024) Injecagent: benchmarking indirect prompt injections in tool-integrated large language model agents. arXiv preprint arXiv:2403.02691","DOI":"10.18653\/v1\/2024.findings-acl.624"},{"key":"11563_CR396","unstructured":"Zheng Q, Xu Z, Choudhry A, et al. (2023) Synergizing human-ai agency: a guide of 23 heuristics for service co-creation with llm-based agents. arXiv preprint arXiv:2310.15065"},{"key":"11563_CR397","doi-asserted-by":"crossref","unstructured":"Zheng J, Wang H, Zhang A, et al. (2024) Ali-agent: Assessing llms\u2019alignment with human values via agent-based evaluation. In: Globerson A, Mackey L, Belgrave D, et al. (eds) Advances in Neural Information Processing Systems, vol\u00a037. Curran Associates, Inc., pp 99040\u201399088, https:\/\/proceedings.neurips.cc\/paper_files\/paper\/2024\/file\/b35c38f70065ac6c694089ca93a015bb-Paper-Conference.pdf","DOI":"10.52202\/079017-3142"},{"key":"11563_CR398","unstructured":"Zhong PY, Chen S, Wang R, et al. (2025) Rtbas: Defending llm agents against prompt injection and privacy leakage. arXiv preprint arXiv:2502.08966"},{"key":"11563_CR399","unstructured":"Zhou K, Liu C, Zhao X, et al. (2024a) Multimodal situational safety. arXiv preprint arXiv:2410.06172"},{"key":"11563_CR400","unstructured":"Zhou Q, Li T, Guo Q, et al. (2024b) Defend against jailbreak attacks via debate with partially perceptive agents. https:\/\/openreview.net\/forum?id=STpxO1Siaq"},{"key":"11563_CR401","doi-asserted-by":"publisher","unstructured":"Zhou Y, Han Y, Zhuang H, et al. (2024c) Defending jailbreak prompts via in-context adversarial game. In: Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pp 20084\u201320105, https:\/\/doi.org\/10.18653\/v1\/2024.emnlp-main.1121","DOI":"10.18653\/v1\/2024.emnlp-main.1121"},{"key":"11563_CR402","doi-asserted-by":"publisher","first-page":"79597","DOI":"10.52202\/079017-2527","volume":"37","author":"Z Zhou","year":"2024","unstructured":"Zhou Z, Haibo H, Chen X et al. (2024) Behaviorgpt: smart agent simulation for autonomous driving with next-patch prediction. Adv Neural Inf Process Syst 37:79597\u201379617","journal-title":"Adv Neural Inf Process Syst"},{"key":"11563_CR403","unstructured":"Zhu Y, Kellermann A, Gupta A, et al. (2024) Teams of llm agents can exploit zero-day vulnerabilities. arXiv preprint arXiv:2406.01637"},{"key":"11563_CR404","unstructured":"Zhuge M, Zhao C, Ashley D, et al. (2024) Agent-as-a-judge: evaluate agents with agents. arXiv preprint arXiv:2410.10934"},{"key":"11563_CR405","unstructured":"Zhu Y, Kellermann A, Bowman D, et al. (2025b) CVE-bench: a benchmark for AI agents\u2019 ability to exploit real-world web application vulnerabilities. In: Forty-second International Conference on Machine Learning, https:\/\/openreview.net\/forum?id=3pk0p4NGmQ"},{"key":"11563_CR406","unstructured":"Zhu K, Yang X, Wang J, et al. (2025a) Melon: provable defense against indirect prompt injection attacks in ai agents. arXiv preprint arXiv:2502.05174"},{"key":"11563_CR407","unstructured":"Zou W, Geng R, Wang B, et al. (2024) Poisonedrag: knowledge corruption attacks to retrieval-augmented generation of large language models. arXiv preprint arXiv:2402.07867"},{"key":"11563_CR408","unstructured":"Zuo J, Zhang Z, Wang X, et al. (2023) Adversarial attacks on cooperative multi-agent bandits. arXiv preprint arXiv:2311.01698"}],"container-title":["Artificial Intelligence Review"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s10462-026-11563-0","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10462-026-11563-0.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10462-026-11563-0.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,7,20]],"date-time":"2026-07-20T04:47:35Z","timestamp":1784522855000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s10462-026-11563-0"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,5,9]]},"references-count":408,"journal-issue":{"issue":"8","published-online":{"date-parts":[[2026,8]]}},"alternative-id":["11563"],"URL":"https:\/\/doi.org\/10.1007\/s10462-026-11563-0","relation":{},"ISSN":["1573-7462"],"issn-type":[{"value":"1573-7462","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,5,9]]},"assertion":[{"value":"19 October 2025","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"7 April 2026","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"9 May 2026","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"The authors declare no conflict of interest.","order":1,"name":"Ethics","label":"Conflict of interest","group":{"name":"EthicsHeading","label":"Declarations"}}],"article-number":"174"}}