| Challenge: | Existing frameworks for LLM agents fail to exploit real-world zero-day vulnerabilities . prior work has shown that simple agents can hack mock "capture-the-flag" websites . |
| Approach: | They propose a system of agents with a planning agent that can launch subagents to exploit real-world vulnerabilities. |
| Outcome: | The proposed framework improves over previous frameworks by up to 4.3 on 14 real-world vulnerabilities. |
Similar Papers
Breaking Agents: Compromising Autonomous LLM Agents Through Malfunction Amplification (2025.emnlp-main)
Copied to clipboard
| Challenge: | Recent advances in large language models (LLMs) have increased the vulnerability of LLMs, but they can cause more severe damage than standalone systems if compromised. |
| Approach: | They propose a new type of attack that induces malfunctions by misleading the agent into executing repetitive or irrelevant actions. |
| Outcome: | The proposed attacks induce failure rates exceeding 80% in multiple scenarios, highlighting the substantial risks associated with this vulnerability. |
CVE-Bench: Benchmarking LLM-based Software Engineering Agent’s Ability to Repair Real-World CVE Vulnerabilities (2025.naacl-long)
Copied to clipboard
| Challenge: | Large Language Models (LLMs) and LLM agents have demonstrated significant potential in this domain by understanding descriptions in natural language and generating corresponding formal code. |
| Approach: | They propose an evaluation framework that provides LLM agents with a test environment that simulates the real-world vulnerability repair process. |
| Outcome: | The proposed framework can repair 21% of vulnerabilities at its best, but lacks expert knowledge . the evaluation framework can only repair 29% of vulnerabilities, but it can be used in real-world scenarios . |
PEAR: Planner-Executor Agent Robustness Benchmark (2026.findings-eacl)
Copied to clipboard
| Challenge: | Existing studies examine isolated attack surfaces or specific scenarios, leaving a lack of holistic understanding of MAS vulnerabilities. |
| Approach: | They propose a benchmark to evaluate the utility and vulnerability of planner–executor MAS. |
| Outcome: | The proposed benchmark evaluates planner–executor MAS on a widely adopted design. |
TAMAS: Benchmarking Adversarial Risks in Multi-Agent LLM Systems (2026.acl-long)
Copied to clipboard
| Challenge: | Existing benchmarks and datasets focus on single-agent settings, failing to capture the unique vulnerabilities of multi-agend LLM dynamics and co-ordination. |
| Approach: | They propose a benchmark to evaluate the robustness and safety of multi-agent LLM systems. |
| Outcome: | The proposed benchmark evaluates the robustness and safety of multi-agent LLM systems. |
Red-Teaming LLM Multi-Agent Systems via Communication Attacks (2025.findings-acl)
Copied to clipboard
| Challenge: | Large Language Model-based Multi-Agent Systems (LLM-MAS) have revolutionized complex problem-solving capability by enabling agent collaboration through message-based communications. |
| Approach: | They propose an attack that exploits communication mechanisms in Large Language Model-based Multi-Agent Systems (LLM-MAS) by intercepting and manipulating inter-agent messages. |
| Outcome: | The proposed attack exploits communication mechanisms in large language model-based multi-agent systems by intercepting and manipulating inter-agencies. |
BadAgent: Inserting and Activating Backdoor Attacks in LLM Agents (2024.acl-long)
Copied to clipboard
| Challenge: | Xi et al., 2023) show that LLM-based intelligent agents are vulnerable to backdoor attacks. |
| Approach: | They propose to build LLM-based intelligent agents using trained LLMs and fine-tune them on data for the agent task. |
| Outcome: | The proposed methods are robust even after fine-tuning on trusted data. |
Is LLM-as-a-Judge Robust? Investigating Universal Adversarial Attacks on Zero-shot LLM Assessment (2024.emnlp-main)
Copied to clipboard
| Challenge: | Large Language Models (LLMs) are powerful zero-shot assessors used in real-world situations . however, no study has examined the vulnerability of judge-LLM to adversarial manipulation . |
| Approach: | They propose a simple surrogate attack where a surrogated model is attacked and the learned attack phrase transferred to unknown judge-LLMs. |
| Outcome: | The proposed algorithm shows that judge-LLMs can be significantly more susceptible to adversarial attacks when used for absolute scoring, rather than comparative assessment. |
Benchmarking LLMs and LLM-based Agents in Practical Vulnerability Detection for Code Repositories (2025.acl-long)
Copied to clipboard
| Challenge: | Large Language Models (LLMs) have shown promise in software vulnerability detection, especially on function-level benchmarks like Devign and BigVul. |
| Approach: | They propose a JIT vulnerability detection benchmark linking each function to its vulnerability-introducing and fixing commits. |
| Outcome: | The proposed JIT vulnerability detection benchmark enables comprehensive evaluation of detection capabilities. |
AutoPenBench: A Vulnerability Testing Benchmark for Generative Agents (2025.emnlp-industry)
Copied to clipboard
Luca Gioacchini, Alexander Delsanto, Idilio Drago, Marco Mellia, Giuseppe Siracusano, Roberto Bifulco
| Challenge: | LLM agents are promising for vulnerability testing, but lack benchmarks to evaluate and compare them. |
| Approach: | They propose an open-source benchmark for the evaluation of vulnerability testing agents that includes 33 tasks ranging from introductory exercises to actual vulnerable systems. |
| Outcome: | The proposed benchmark includes 33 tasks ranging from introductory exercises to actual vulnerable systems. |
SafeAgent: Safeguarding LLM Agents via an Automated Risk Simulator (2026.acl-long)
Copied to clipboard
Xueyang Zhou, Weidong Wang, Lin Lu, Jiawen Shi, Guiyao Tie, Xu Yongtian, Lixing Chen, Pan Zhou, Neil Zhenqiang Gong, Lichao Sun
| Challenge: | SafeAgent improves agent safety through fully automated synthetic data generation. |
| Approach: | They propose a framework that improves agent safety through fully automated synthetic data generation. |
| Outcome: | The proposed framework outperforms closed-source models on two safety benchmarks and one real-world task. |