{"id":"https://openalex.org/W7124706925","doi":"https://doi.org/10.48550/arxiv.2601.10758","title":"Agents at Risk: How Users Unwittingly Undermine LLM Safety","display_name":"Agents at Risk: How Users Unwittingly Undermine LLM Safety","publication_year":2026,"publication_date":"2026-01-14","ids":{"openalex":"https://openalex.org/W7124706925","doi":"https://doi.org/10.48550/arxiv.2601.10758"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2601.10758","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2601.10758","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2601.10758","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5005748122","display_name":"Fengchao Chen","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Chen, Fengchao","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5090322097","display_name":"TingMin Wu","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Wu, Tingmin","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5123306272","display_name":"Van Tien Nguyen","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Nguyen, Van","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":null,"display_name":"Nepal, Surya.","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Nepal, Surya.","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":null,"display_name":"Rudolph, Carsten","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Rudolph, Carsten","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.3328000009059906,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.3328000009059906,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.11760000139474869,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12262","display_name":"Hate Speech and Cyberbullying Detection","score":0.05689999833703041,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/exploit","display_name":"Exploit","score":0.5745999813079834},{"id":"https://openalex.org/keywords/task","display_name":"Task (project management)","score":0.5613999962806702},{"id":"https://openalex.org/keywords/workflow","display_name":"Workflow","score":0.4185999929904938},{"id":"https://openalex.org/keywords/conversation","display_name":"Conversation","score":0.3560999929904938},{"id":"https://openalex.org/keywords/adversarial-system","display_name":"Adversarial system","score":0.34119999408721924},{"id":"https://openalex.org/keywords/asynchronous-communication","display_name":"Asynchronous communication","score":0.33559998869895935},{"id":"https://openalex.org/keywords/unexpected-events","display_name":"Unexpected events","score":0.32839998602867126}],"concepts":[{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.7128999829292297},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6614000201225281},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.5745999813079834},{"id":"https://openalex.org/C2780451532","wikidata":"https://www.wikidata.org/wiki/Q759676","display_name":"Task (project management)","level":2,"score":0.5613999962806702},{"id":"https://openalex.org/C108827166","wikidata":"https://www.wikidata.org/wiki/Q175975","display_name":"Internet privacy","level":1,"score":0.4505999982357025},{"id":"https://openalex.org/C177212765","wikidata":"https://www.wikidata.org/wiki/Q627335","display_name":"Workflow","level":2,"score":0.4185999929904938},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.4018999934196472},{"id":"https://openalex.org/C2777200299","wikidata":"https://www.wikidata.org/wiki/Q52943","display_name":"Conversation","level":2,"score":0.3560999929904938},{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.34119999408721924},{"id":"https://openalex.org/C151319957","wikidata":"https://www.wikidata.org/wiki/Q752739","display_name":"Asynchronous communication","level":2,"score":0.33559998869895935},{"id":"https://openalex.org/C2776544517","wikidata":"https://www.wikidata.org/wiki/Q189447","display_name":"Unexpected events","level":2,"score":0.32839998602867126},{"id":"https://openalex.org/C192209626","wikidata":"https://www.wikidata.org/wiki/Q190909","display_name":"Focus (optics)","level":2,"score":0.3199000060558319},{"id":"https://openalex.org/C2776036281","wikidata":"https://www.wikidata.org/wiki/Q48769818","display_name":"Constraint (computer-aided design)","level":2,"score":0.31299999356269836},{"id":"https://openalex.org/C113843644","wikidata":"https://www.wikidata.org/wiki/Q901882","display_name":"Interface (matter)","level":4,"score":0.31130000948905945},{"id":"https://openalex.org/C21593369","wikidata":"https://www.wikidata.org/wiki/Q1032176","display_name":"Countermeasure","level":2,"score":0.30979999899864197},{"id":"https://openalex.org/C165064840","wikidata":"https://www.wikidata.org/wiki/Q1321061","display_name":"Matching (statistics)","level":2,"score":0.2996000051498413},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.2745000123977661}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2601.10758","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2601.10758","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2601.10758","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2601.10758","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"score":0.8076096177101135,"display_name":"Peace, Justice and strong institutions","id":"https://metadata.un.org/sdg/16"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Large":[0],"language":[1],"model":[2],"(LLM)-based":[3],"agents":[4,13,30,194],"are":[5,31],"increasingly":[6],"deployed":[7,193],"in":[8,76,182,211],"applications,":[9],"such":[10,151],"as":[11,49,152],"trip-planning":[12],"and":[14,21,115,122,124,130,192,207],"web-use":[15],"agents,":[16,163],"to":[17,33],"perform":[18],"complex":[19],"planning":[20],"execution":[22],"tasks.":[23],"Prior":[24],"work":[25],"has":[26],"shown":[27],"that":[28,102,135,166,189],"LLM-based":[29,162,212],"vulnerable":[32],"context":[34,45,60,109,199],"confusion,":[35],"where":[36],"external":[37,53,91],"adversarial":[38,84,92,148,169],"content":[39,55,85,93],"incorporated":[40],"into":[41,82,94],"the":[42,58,70,202],"agent's":[43],"reasoning":[44],"may":[46],"be":[47],"treated":[48],"task-relevant":[50],"constraints.":[51],"However,":[52],"malicious":[54,140],"can":[56,137,146],"enter":[57],"agent":[59,184],"via":[61],"channels":[62],"beyond":[63],"retrieval.":[64],"In":[65],"this":[66],"work,":[67],"we":[68,164],"introduce":[69],"User-Relayed":[71],"Context":[72],"Manipulation":[73],"(UReCoM)":[74],"attack,":[75],"which":[77],"attackers":[78],"manipulate":[79],"benign":[80],"users":[81],"relaying":[83],"within":[86,156],"user":[87,157],"requests,":[88],"thereby":[89],"relocating":[90],"user-provided":[95],"task":[96,149,170],"context.":[97],"Our":[98],"experimental":[99],"evaluation":[100],"shows":[101,134],"UReCoM":[103,133],"outperforms":[104],"five":[105],"prompt-injection":[106],"baselines":[107],"(naive,":[108],"ignoring,":[110],"fake":[111],"completion,":[112],"escape-character":[113],"attacks,":[114],"combined":[116],"attacks)":[117],"under":[118],"prevention-based":[119],"(Sandwich,":[120],"StruQ,":[121],"SecAlign)":[123],"detection-based":[125],"defenses":[126,191],"(Perplexity":[127],"detection,":[128],"DataSentinel,":[129],"CausalArmor).":[131],"Additionally,":[132],"LLMs":[136],"reject":[138],"explicit":[139],"instructions":[141],"more":[142],"reliably":[143],"than":[144,176],"they":[145],"identify":[147],"entities,":[150],"promotion":[153],"codes,":[154],"embedded":[155],"requests.":[158],"On":[159],"12":[160],"commercial":[161],"find":[165],"validation":[167],"of":[168],"entities":[171],"is":[172],"largely":[173],"prompt-driven":[174],"rather":[175],"default,":[177],"highlighting":[178,201],"a":[179],"design":[180],"flaw":[181],"current":[183,190],"frameworks.":[185],"These":[186],"results":[187],"indicate":[188],"remain":[195],"insufficient":[196],"against":[197],"user-relayed":[198],"manipulations,":[200],"need":[203],"for":[204],"task-entity-level":[205],"prevention":[206],"default":[208],"safety":[209],"verification":[210],"agents.":[213]},"counts_by_year":[],"updated_date":"2026-07-28T07:46:37.118299","created_date":"2026-01-20T00:00:00"}