{"id":"https://openalex.org/W7165666295","doi":"https://doi.org/10.48550/arxiv.2606.23075","title":"Safety in Self-Evolving LLM Agent Systems: Threats, Amplification, and Case Studies","display_name":"Safety in Self-Evolving LLM Agent Systems: Threats, Amplification, and Case Studies","publication_year":2026,"publication_date":"2026-06-22","ids":{"openalex":"https://openalex.org/W7165666295","doi":"https://doi.org/10.48550/arxiv.2606.23075"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2606.23075","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.23075","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2606.23075","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5136208728","display_name":"Ruixiao Lin","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Lin, Ruixiao","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5139206197","display_name":"Xinhao Deng","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Deng, Xinhao","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5139190173","display_name":"Qingming Li","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Li, Qingming","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101852566","display_name":"Jianan Ma","orcid":"https://orcid.org/0009-0007-0448-1218"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Ma, Jianan","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5103258005","display_name":"Yunhao Feng","orcid":"https://orcid.org/0009-0005-3042-5266"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Feng, Yunhao","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5112999768","display_name":"Yuqi Qing","orcid":"https://orcid.org/0009-0005-4226-9387"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Qing, Yuqi","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5139133031","display_name":"Zhenyuan Li","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Li, Zhenyuan","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5139146935","display_name":"Yechao Zhang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhang, Yechao","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5139160557","display_name":"Shiwen Cui","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Cui, Shiwen","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5139196157","display_name":"Changhua Meng","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Meng, Changhua","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5139128350","display_name":"Tianwei Zhang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhang, Tianwei","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5139206310","display_name":"Xingjun Ma","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Ma, Xingjun","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5139133202","display_name":"Qi Li","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Li, Qi","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5139169343","display_name":"Ke Xu","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Xu, Ke","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5139157427","display_name":"Shouling Ji","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Ji, Shouling","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.1356000006198883,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.1356000006198883,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.13189999759197235,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.08839999884366989,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/adversarial-system","display_name":"Adversarial system","score":0.6162999868392944},{"id":"https://openalex.org/keywords/attack-surface","display_name":"Attack surface","score":0.436599999666214},{"id":"https://openalex.org/keywords/block","display_name":"Block (permutation group theory)","score":0.3871000111103058},{"id":"https://openalex.org/keywords/face","display_name":"Face (sociological concept)","score":0.362199991941452},{"id":"https://openalex.org/keywords/security-analysis","display_name":"Security analysis","score":0.3330000042915344}],"concepts":[{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.6365000009536743},{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.6162999868392944},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.5982999801635742},{"id":"https://openalex.org/C2776576444","wikidata":"https://www.wikidata.org/wiki/Q303569","display_name":"Attack surface","level":2,"score":0.436599999666214},{"id":"https://openalex.org/C2777210771","wikidata":"https://www.wikidata.org/wiki/Q4927124","display_name":"Block (permutation group theory)","level":2,"score":0.3871000111103058},{"id":"https://openalex.org/C2779304628","wikidata":"https://www.wikidata.org/wiki/Q3503480","display_name":"Face (sociological concept)","level":2,"score":0.362199991941452},{"id":"https://openalex.org/C38369872","wikidata":"https://www.wikidata.org/wiki/Q7445009","display_name":"Security analysis","level":2,"score":0.3330000042915344},{"id":"https://openalex.org/C140547941","wikidata":"https://www.wikidata.org/wiki/Q7797194","display_name":"Threat model","level":2,"score":0.3163999915122986},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.24860000610351562},{"id":"https://openalex.org/C121822524","wikidata":"https://www.wikidata.org/wiki/Q5157582","display_name":"Computer security model","level":2,"score":0.24770000576972961}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2606.23075","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.23075","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2606.23075","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.23075","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Self-evolving":[0],"LLM":[1],"agent":[2],"systems,":[3],"which":[4,21,54,91],"autonomously":[5],"update":[6],"their":[7],"model":[8],"parameters,":[9],"memory,":[10],"tools,":[11],"and":[12,30,43,105,132,175,185],"architectures,":[13],"introduce":[14],"a":[15,40,134],"qualitatively":[16],"new":[17,172],"threat":[18],"landscape":[19],"in":[20,113],"adversarial":[22],"influences":[23],"become":[24],"permanently":[25],"encoded,":[26],"self-amplify":[27],"across":[28,141],"generations,":[29],"propagate":[31],"through":[32],"populations":[33],"without":[34],"sustained":[35],"attacker":[36],"access.":[37],"We":[38,96],"present":[39],"systematic":[41],"security":[42,147,183],"privacy":[44],"analysis":[45],"organized":[46],"around":[47],"the":[48,56,80],"Module-Lifecycle":[49],"Attack":[50],"Surface":[51],"(MLAS)":[52],"matrix,":[53],"decomposes":[55],"attack":[57,129,136,162,173],"surface":[58,130],"into":[59],"five":[60,70],"functional":[61],"modules":[62,112],"(Brain,":[63],"Cognitive":[64],"Resource,":[65],"Execution,":[66],"Self-Design,":[67],"Collective)":[68],"$\\times$":[69],"lifecycle":[71],"stages":[72],"(Bootstrap,":[73],"Propose,":[74],"Evaluate,":[75],"Commit,":[76],"Serve).":[77],"Analysis":[78],"of":[79,118,152],"resulting":[81],"25":[82],"cells":[83,131],"reveals":[84],"that":[85,102,123,157],"17":[86],"face":[87],"critical":[88],"threats":[89],"for":[90,188],"no":[92],"effective":[93],"partial":[94],"mitigation.":[95],"identify":[97],"seven":[98],"cross-cutting":[99],"amplification":[100],"effects":[101],"interact":[103],"synergistically":[104],"cannot":[106],"be":[107],"addressed":[108],"by":[109],"securing":[110],"individual":[111],"isolation.":[114],"Comparative":[115],"case":[116],"studies":[117],"two":[119],"open-source":[120],"frameworks":[121,184],"demonstrate":[122],"evolution-native":[124],"design":[125],"activates":[126],"$3.5\\times$":[127],"more":[128],"achieves":[133],"100%":[135],"persistence":[137],"rate":[138],"(40/40":[139],"payloads":[140],"all":[142],"CIA+Privacy":[143],"categories),":[144],"while":[145],"co-located":[146],"scanners":[148],"block":[149],"only":[150],"2.5%":[151],"attacks.":[153],"Our":[154],"findings":[155],"establish":[156],"self-evolution":[158],"converts":[159],"every":[160],"known":[161],"category":[163],"from":[164],"session-bounded":[165],"to":[166,170],"lineage-persistent,":[167],"gives":[168],"rise":[169],"entirely":[171],"classes,":[174],"renders":[176],"static":[177],"defenses":[178],"structurally":[179],"inadequate,":[180],"motivating":[181],"evolution-aware":[182],"formal":[186],"verification":[187],"self-modifying":[189],"systems.":[190]},"counts_by_year":[],"updated_date":"2026-07-28T07:46:37.118299","created_date":"2026-06-24T00:00:00"}