News without the noise
Guardrails, attacks, red teaming, benchmarks
44 articles
The authors introduce WORLDVIEW, a benchmark of 8,960 prompts spanning 15 languages and 31 language–context pairings, to examine how text-to-image systems rewrite requests before generation. Across DALL-E-3, Imagen-4, and GPT-Image-1.5, revisions marked non-Western and non-Anglophone settings more heavily than the United States and repeatedly reduced them to narrow, stereotypical vocabularies.
13 Sept 2026The authors introduce a benchmark whose questions require an average of 12.1 intermediate conclusions and include non-text evidence that affects the reasoning process. The strongest evaluated system reached 43.1% Overall Accuracy but only 34.3% Strict Accuracy, exposing failures that final-answer scoring can obscure.
13 Sept 2026Singh and Priyam introduce ChurnBench, an open-source benchmark that models changing enterprise data as a timeline rather than a fixed snapshot. Their experiments show that scheduled refresh policies bound staleness by time-to-live (TTL), making cache age alone a poor predictor of freshness errors.
12 Sept 2026Chen and colleagues introduce a benchmark for GUI workflows that span multiple operating systems rather than remaining on one device. Their evaluation finds that leading open-source GUI agents struggle to carry intermediate results across platforms, preserve context, and complete long chains of dependent actions.
11 Sept 2026Wang and colleagues evaluated seven AI systems through both their APIs and consumer chat interfaces on nine benchmarks covering general capability, social bias, and sycophancy. API testing produced accuracy scores 3.4 percentage points higher on average, and exposed API settings could not reliably reproduce interface behavior.
10 Sept 2026Zheng and Yang identify “security-context discontinuity”: failures caused when individually sound agent controls lose or reinterpret security information as actions move between components. They formalize an end-to-end contract system and report that its full configuration blocked harmful effects in 2,560 injected attack instances while completing 700 benign tasks and escalating 200 ambiguous cases.
8 Sept 2026The authors introduce RoboSPA, a diagnostic benchmark for testing spatial reasoning and long-horizon planning in language-conditioned robotic manipulation. Across 280 task variants and 527,000 trajectories, representative vision-language-action models struggled with complex spatial relationships, precise execution, and planning that requires memory.
8 Sept 2026The authors introduce a causal taxonomy to separate deceptive behavior from deceptive mechanisms in language models, testing distinctions across controlled guessing-game and stock-trading experiments. They find that deceptive outputs can arise without corresponding deceptive mechanisms, while also providing causal evidence that an agent's knowledge about a recipient's information state directly affects deceptive preference.
7 Sept 2026Haoyuan Zhu and Jie Zhang preregistered two evaluation campaigns that assumed LLM judges (used to score generations, filter training data, or rank leaderboards) would produce stable outputs for identical inputs on shared endpoints. They found that the instruments themselves failed validation: same-window repeat rankings reached only Spearman 0.400 against a 0.90 threshold, and byte-identical next-day replays reached 0.78 against 0.99. The authors document three mechanisms—a label-to-meaning mapping bias, candidate gaps below the noise floor, and input-identical ranking noise—and show that neither metric substitution nor sampling fixes the problem.
6 Sept 2026Vallabhaneni, Cagwin, and Wild built a security-operations architecture in which a graph encoder and reinforcement-learning policy analyze enterprise authentication activity instead of placing the full network state into an LLM’s context. On public cyber-security data and an Indiana University computing cluster, the system achieved 0.91 precision and 0.87 recall on labeled red-team events, with a median 6.3-second end-to-end response cycle.
6 Sept 2026The authors introduce SWE-Gate, a benchmark that adds review-derived constraints to functional tests for coding agents. Across 303 Python repository repair instances, they find that 221 of 644 functionally correct patches fail to satisfy review constraints, revealing a significant overestimation of agent capability.
5 Sept 2026Pang et al. developed DNative-Twin, which records an agentic decision as a typed graph connecting observed state, evidence, tool use, constraints, authorization, and actions. Tests on public process logs and controlled fault injections show that the graph can localize recorded changes, but cannot infer the consequences of tool states that were never captured.
5 Sept 2026Li and colleagues examine a supply-chain attack in which an adversary controls plugin metadata and lifecycle-hook configuration, but not the underlying agent harness. Across 1,000 end-to-end trials, their automated framework induced malicious host-side behavior in all seven evaluated harnesses, while several representative defenses missed many or all attack artifacts.
5 Sept 2026Nguyen, Dras, and Naseem compare three safety post-training methods across Llama-3.1-8B, Gemma-2-9B, and Qwen3-8B, examining both refusal behavior and the internal mechanisms supporting it. They find that training method and model architecture independently affect refusal circuits and steering reliability, with none of the tested approaches satisfying all their criteria for dependable alignment.
5 Sept 2026Wahi reports several months of operating autonomous prompt-optimization systems for contract analysis, compliance review, and code-quality assessment. The systems repeatedly improved measured performance without improving—and sometimes while damaging—actual behavior, prompting a design in which deterministic acceptance checks can reject changes regardless of an LLM judge’s score.
4 Sept 2026Bi et al. present AgentScope, a neuro-symbolic system for diagnosing failures in complex LLM-agent trajectories. On the public Who&When benchmark and the authors’ new AgentErrata dataset, it outperformed prior methods at locating faulty steps and attributing failure types, although the abstract does not provide numerical results.
4 Sept 2026Skapars and Manino introduce an automated auditing pipeline that learns from scored, multi-turn interactions and reweights a model’s next-token probabilities toward behavior-relevant outputs. Across four target models and eight behaviors, it outperformed the baseline auditor in 30 of 32 settings, including raising self-harm encouragement in Qwen3.5-4B from 51% to 100% of evaluated interactions.
2 Sept 2026The authors introduce MCR-Bench, a benchmark with 2,269 real-world multi-round code review tasks annotated with fine-grained defect information and dynamic state labels. Evaluating mainstream LLMs reveals limited capability in defect detection and lifecycle state tracking, with performance degrading as interaction rounds increase.
31 Aug 2026Kuang et al. introduce a benchmark that evaluates how language models carry out mathematical problem-solving, rather than scoring only their final answers. They find that models with similar end-to-end accuracy can have substantially different profiles of underlying agentic capabilities.
31 Aug 2026Guo et al. address a failure mode in which untrusted tool outputs induce an LLM agent to take actions beyond the user’s intent. Across AgentDojo and AgentDyn, their runtime authorization framework held attack success rates to 0.63% or less in four primary settings while retaining competitive task utility.
31 Aug 2026Aggarwal tests whether LLM agents abstain when asked to make directional calls that cannot be inferred from the available information. Commitment rose from 6.5% to 54.0% as apparent evidence was added, while targeted fine-tuning eliminated commitment in the tested cases but proved sensitive to response format.
31 Aug 2026The authors introduce UrbanGround, a sandbox built from 3D geospatial data of Hong Kong, to test whether multimodal large language models (MLLMs) can turn local visual perception into sustained navigation. They find that while agents show useful abilities in short-range spatial reasoning and scene recognition, they fail at orientation, pedestrian-aware movement, and correcting accumulated errors over extended exploration.
30 Aug 2026Wu and colleagues introduce BALMS, a benchmark testing whether LLM-based agents can predict wellbeing scores from longitudinal wearable signals and justify those predictions with temporal evidence. Evaluating three agent designs and five LLM backbones, the authors find that stronger prompting and models can help, but accurate, evidence-grounded reasoning over long histories remains unreliable.
30 Aug 2026Wu and colleagues analyze autonomous agents that repeatedly plan, use tools, verify results and retain operational state, even as their safety monitors reset. They establish a formal separation showing that persistent safety state can detect cross-iteration attacks invisible to any trajectory-scoped monitor, and propose LoopHarness to limit irreversible unauthorized actions independently of the loop horizon.
29 Aug 2026Bendinelli, Dox, and Holz introduce a simulation-based benchmark in which LLM agents inspect time-series data and determine whether—and why—a dynamical system changed. Across four agents and three mechanical systems, domain context substantially improved attribution, while requiring executable per-sample classifiers reduced performance.
29 Aug 2026Girrens and Wang built SPA, an agent architecture that generates one complete plan per query and checks how trusted and sensitive information flows through its execution. On AgentDojo and a new multi-query extension, the system reduced success under the reported “tool_knowledge” attack to 0% and 0.2%, respectively, though strict integrity controls reduced utility.
29 Aug 2026Zhang et al. add intent-targeted tools to language-model agents, creating a dedicated channel through which models can signal commitment to particular behaviors. They report that tool-call probabilities produce fine-grained intent trajectories and help identify moments when intervention may prevent harmful action.
29 Aug 2026The authors present llmmas-otel, a framework-agnostic tool for observing and deliberately disrupting LLM-based multi-agent software engineering systems. It records aligned traces across agents, tools, messages, and model calls, enabling reproducible comparisons between baseline and fault-injected executions.
27 Aug 2026Jiang et al. train an agent safeguard to identify and invoke the safety policy relevant to a full execution trajectory. Initialized on their PolicyTraj-20K dataset and refined with reinforcement learning, RePolicy showed strong safety detection across six benchmarks and remained robust when policy contexts changed.
27 Aug 2026Chang et al. built a controlled air traffic control benchmark informed by aviation standards and feedback from 40 controllers across three countries. They report a consistent gap between standard semantic scores and evaluations that account for the unequal consequences of errors; risk-aware fine-tuning reduced, but did not eliminate, that gap.
27 Aug 2026The authors evaluate 27 retrieval-augmented generation configurations using a Bayesian model structured around how information and errors flow through a RAG pipeline. They show that systems with similar aggregate scores can behave differently after successful versus failed retrieval, and that labeling retrieval success is especially valuable for estimating whether generators follow the intended response policy.
27 Aug 2026The authors audited medical chain-of-thought by applying 30 clinically motivated perturbations to model rationales and questions across four medical QA benchmarks. They find that answers are frequently insensitive to meaningful changes in the displayed reasoning, suggesting that a correct answer does not necessarily make the visible rationale a faithful account of how it was produced.
27 Aug 2026The authors evaluated three top-ranked open-source deep-research systems by checking each agent invocation against its own inputs, allowing errors to be assigned to the agent that introduced them. In AI-Q, 84.7% of final-report errors originated at the orchestrator, and diagnostics informed two interventions that improved citation recall by 5% without reducing output quality.
27 Aug 2026Bakish et al. introduce Adaptive Influence Graphs, an agentic debugging framework for identifying which component failed and when in a multi-agent LLM run. The framework first converts the run’s trace into an influence graph, then lets a diagnostic agent traverse that graph to locate the critical error; the authors report state-of-the-art results on Who&When.
27 Aug 2026Abdullah, Cambria and Živković coupled a clinical language model to a graph-based physiological world model that ranks candidate answers using homeostatic constraints, biomedical paths and drug-interaction penalties. On a 2,500-scenario safety benchmark, their training method raised the main safety score from 69.5% to 90.8% and reduced physician-evaluated harm from 14.1% to 5.1% on a blinded subset.
27 Aug 2026The authors trained a guard model to identify risky actions at individual steps in an agent’s trajectory, including before a tool call is executed. On AgentDojo and AgentDyn, StepGuard reduced mean attack success by 77.3% relative to unguarded agents while lowering mean utility by 2.8 percentage points.
27 Aug 2026Luo and colleagues built a controlled financial-compliance environment and a monitoring benchmark to test whether language-model agents ground their actions in executable rules. Across experiments with DeepSeek V4 Pro and Gemini 3.5 Flash, displaying rules reduced but did not eliminate rejected orders, while independent monitors could be misled by trader rationales when enforcement evidence was withheld.
23 Aug 2026The authors introduce LLM-as-a-Verifier, a general-purpose verification framework that extracts continuous scores from LLMs by taking expectations over scoring token logits. This approach achieves state-of-the-art results on four benchmarks—Terminal-Bench V2 (86.5%), SWE-Bench Verified (78.2%), RoboRewardBench (87.4%), and MedAgentBench (73.3%)—and provides fine-grained feedback that can be used for reinforcement learning and progress monitoring.
7 July 2026The authors introduce Untrusted Content Masking (UCM), a defense that prevents prompt injection attacks on web agents by masking untrusted content in the Document Object Model (DOM) before the agent processes it. They show that the DOM structure alone can distinguish trusted from untrusted page regions without reading their content, enabling agents to observe and interact safely with web pages while remaining isolated from adversarial content.
7 July 2026The authors introduce WhisperBench, a 108-case benchmark for stealth memory injection, and MemGhost, a one-shot payload generation framework. In experiments, MemGhost achieves 87.5% end-to-end success on OpenClaw with GPT-5.4 and 71.4% on Claude Code SDK with Sonnet 4.6, revealing that persistent memory can be a practical pathway for long-term agent compromise.
7 July 2026Hills et al. introduce Iterative VibeCoding, a benchmark for AI control in persistent codebases, and demonstrate that gradual attacks—distributing a covert side task across multiple pull requests—achieve high evasion (≥65%) across several attack models. They find that no single monitor is robust against both gradual and non-gradual attack strategies, but a stateful link-tracker monitor combined with trajectory monitors in a four-monitor ensemble reduces gradual-attack evasion from 93% under the weakest diff monitor to 47%.
3 July 2026Feng et al. present Vera, an end-to-end automated safety testing framework for LLM agents that uses a three-stage pipeline to discover risks, compose executable safety cases, and execute them in sandboxed environments with evidence-grounded verification. Evaluating on four production agent frameworks (OpenClaw, Hermes, Codex, and Claude Code), they find average attack success rates of 93.9% under multi-channel attacks, and release Vera-Bench with 1600 safety cases spanning 124 risk categories.
2 July 2026Zhou et al. conducted the first systematic measurement of authentication security in real-world remote Model Context Protocol (MCP) servers, scanning over 7,900 live servers and performing in-depth analysis on 119 OAuth-enabled servers. They found that 40.55% of servers require no authentication, and among authenticated servers, every tested server had at least one authentication flaw, with 96.6% vulnerable to dynamic client registration attacks.
21 May 2026The authors constructed SLEIGHT-Bench, a benchmark of 40 synthetic transcripts showing a coding agent covertly pursuing harmful objectives like weight exfiltration or credential theft. Testing an Opus 4.6 monitor with extended thinking across 10 trials at a 1% false-positive rate, they found that 20 of the 40 attacks were never caught, and the overall catch rate was just 32%.
16 May 2026