auto: new LLM security papers (run #10)

[github-actions]

Automated Paper Fetch

New papers discovered from arXiv, Semantic Scholar, and CrossRef.

All entries are marked reviewed: false -- please review before merging.

New Entries

--- New Entries ---
- [llmsec-2026-00206] Beyond Attack Success Rate: Temporal Logit Observability for LLM Safety Failures
  https://arxiv.org/abs/2605.29629
  Categories: jailbreaking
- [llmsec-2026-00207] Evolving Skill-Structured Attack Memory Enhances LLM Jailbreaking
  https://arxiv.org/abs/2605.29237
  Categories: jailbreaking
- [llmsec-2026-00208] Relevance as a Vulnerability: How Web Retrieval Degrades Safety Alignment in LLM Agents
  https://arxiv.org/abs/2605.29224
  Categories: guardrails
- [llmsec-2026-00209] Measuring Real-World Prompt Injection Attacks in LLM-based Resume Screening
  https://arxiv.org/abs/2605.28999
  Categories: prompt-injection
- [llmsec-2026-00210] Blind PRNG Hijacking: An Undetectable Integrity-Preserving Attack Against LLM Watermarking
  https://arxiv.org/abs/2605.28632
  Categories: watermarking
- [llmsec-2026-00211] Plant, Persist, Trigger: Sleeper Attack on Large Language Model Agents
  https://arxiv.org/abs/2605.28201
  Categories: agentic-threats
- [llmsec-2026-00212] Towards Demystifying and Repairing LLM-in-the-Loop Vulnerabilities
  https://arxiv.org/abs/2605.28893
  Categories: benchmarks
- [llmsec-2026-00213] Defending LLM-based Multi-Agent Systems Against Cooperative Attacks with Sentence-Level Rectification
  https://arxiv.org/abs/2605.28104
  Categories: agent-architecture
- [llmsec-2026-00214] Disentangling Adversarial Prompts: A Semantic-Graph Defense for Robust LLM Security
  https://arxiv.org/abs/2605.27823
  Categories: prompt-injection, jailbreaking
- [llmsec-2026-00215] Cordyceps: Covert Control Attacks on LLMs via Data Poisoning
  https://arxiv.org/abs/2605.26595
  Categories: data-poisoning, monitoring-detection
- [llmsec-2026-00216] Open-Weight LLM Fine-Tuning Defenses are Susceptible to Simple Attacks
  https://arxiv.org/abs/2605.26526
  Categories: jailbreaking
- [llmsec-2026-00217] Evo-Attacker: Memory-Augmented Reinforcement Learning for Long-Horizon Tool Attacks on LLM-MAS
  https://arxiv.org/abs/2605.25389
  Categories: agent-architecture
- [llmsec-2026-00218] Security in the Fine-Tuning Lifecycle of Large Language Models: Threats, Defenses,Evaluation, and Future Directions
  https://arxiv.org/abs/2605.25073
  Categories: data-poisoning, fine-tuning-security, survey
- [llmsec-2026-00219] Reasoning as an Attack Surface: Adaptive Evolutionary CoT Jailbreaks for LLMs
  https://arxiv.org/abs/2605.24497
  Categories: jailbreaking
- [llmsec-2026-00220] Poisoning the Watchtower: Prompt Injection Attacks Against LLM-Augmented Security Operations Through Adversarial Log Content
  https://arxiv.org/abs/2605.24421
  Categories: prompt-injection
- [llmsec-2026-00221] Reframing LLM Agent Security as an Agent-Human Interaction Problem
  https://arxiv.org/abs/2605.24309
  Categories: agentic-threats
- [llmsec-2026-00222] An Empirical Evaluation of LLM-Generated Code Security Across Prompting Methods
  https://arxiv.org/abs/2605.24298
  Categories: input-filtering
- [llmsec-2026-00223] PromptAudit: Auditing Prompt Sensitivity in LLM-Based Vulnerability Detection
  https://arxiv.org/abs/2605.24171
  Categories: benchmarks
- [llmsec-2026-00224] When the Manual Lies: A Realistic Benchmark to Evaluate MCP Poisoning Attacks for LLM Agents
  https://arxiv.org/abs/2605.24069
  Categories: benchmarks
- [llmsec-2026-00225] Are Frontier LLMs Ready for Cybersecurity? Evidence for Vertical Foundation Models from Dual-Mode Vulnerability Benchmarks
  https://arxiv.org/abs/2605.23243
  Categories: benchmarks
- [llmsec-2026-00226] Pretraining Data Exposure in Large Language Models: A Survey of Membership Inference, Data Contamination, and Security Implications
  https://arxiv.org/abs/2605.26133
  Categories: membership-inference, survey
- [llmsec-2026-00227] Blind Spots in the Guard: How Domain-Camouflaged Injection Attacks Evade Detection in Multi-Agent LLM Systems
  https://arxiv.org/abs/2605.22001
  Categories: agent-architecture
- [llmsec-2026-00228] FuzzingBrain V2: A Multi-Agent LLM System for Automated Vulnerability Discovery and Reproduction
  https://arxiv.org/abs/2605.21779
  Categories: agent-architecture
- [llmsec-2026-00229] Trusted Weights, Treacherous Optimizations? Optimization-Triggered Backdoor Attacks on LLMs
  https://arxiv.org/abs/2605.20641
  Categories: data-poisoning
- [llmsec-2026-00230] Security Document Classification with a Fine-Tuned Local Large Language Model: Benchmark Data and an Open-Source System
  https://arxiv.org/abs/2605.20368
  Categories: benchmarks
- [llmsec-2026-00231] CASPIAN: Online Detection and Attribution of Cascade Attacks in LLM Multi-Agent Systems via Cross-Channel Causal Monitoring
  https://arxiv.org/abs/2605.19240
  Categories: monitoring-detection, agent-architecture
- [llmsec-2026-00232] Be Kind, Rewrite: Benign Projections via Rewriting Defend Against LLM Data Poisoning Attacks
  https://arxiv.org/abs/2605.19147
  Categories: data-poisoning
- [llmsec-2026-00233] ASPI: Seeking Ambiguity Clarification Amplifies Prompt Injection Vulnerability in LLM Agents
  https://arxiv.org/abs/2605.17324
  Categories: prompt-injection, benchmarks
- [llmsec-2026-00234] When Efficiency Backfires: Cascading LLMs Trigger Cascade Failure under Adversarial Attack
  https://arxiv.org/abs/2605.17288
  Categories: adversarial-examples
- [llmsec-2026-00235] DarkLLM: Learning Language-Driven Adversarial Attacks with Large Language Models
  https://arxiv.org/abs/2605.18868
  Categories: adversarial-examples
- [llmsec-2026-00236] Token-Level Generalization in LoRA Adapter Backdoors: Attack Characterization and Behavioral Detection
  https://arxiv.org/abs/2605.30189
  Categories: data-poisoning
- [llmsec-2026-00237] Token Inflation: How Dishonest Providers Can Overcharge for Large Language Model Usage
  https://arxiv.org/abs/2605.30040
  Categories: jailbreaking
- [llmsec-2026-00238] AIRGuard: Guarding Agent Actions with Runtime Authority Control
  https://arxiv.org/abs/2605.28914
  Categories: jailbreaking, agentic-threats
- [llmsec-2026-00239] SNARE: Adaptive Scenario Synthesis for Eliciting Overeager Behavior in Coding Agents
  https://arxiv.org/abs/2605.28122
  Categories: jailbreaking, benchmarks
- [llmsec-2026-00240] MIRAGE: Context-Aware Prompt Injection against Mobile GUI Agents via User-Generated Content
  https://arxiv.org/abs/2605.28116
  Categories: prompt-injection
- [llmsec-2026-00241] When Think-with-Image Meets Safety: What Determines Multimodal Jailbreak Robustness?
  https://arxiv.org/abs/2605.27932
  Categories: jailbreaking
- [llmsec-2026-00242] BAIT: Boundary-Guided Disclosure Escalation via Self-Conditioned Reasoning
  https://arxiv.org/abs/2605.27110
  Categories: jailbreaking
- [llmsec-2026-00243] Prompt Injection Detection is Regime-Dependent: A Deployment-Aware Evaluation with Interpretable Structural Signals
  https://arxiv.org/abs/2605.26999
  Categories: prompt-injection
- [llmsec-2026-00244] Aligning Provenance with Authorization: A Dual-Graph Defense for LLM Agents
  https://arxiv.org/abs/2605.26497
  Categories: prompt-injection, access-control
- [llmsec-2026-00245] Jailbreak susceptibility prediction and mitigation via the behavioral geometry of models
  https://arxiv.org/abs/2605.26409
  Categories: jailbreaking
- [llmsec-2026-00246] How Agentic AI Coding Assistants Become the Attacker's Shell
  https://arxiv.org/abs/2605.25871
  Categories: prompt-injection, agentic-threats
- [llmsec-2026-00247] Furina: Fragmented Uncertainty-Driven Refusal Instability Attack
  https://arxiv.org/abs/2605.26158
  Categories: guardrails
- [llmsec-2026-00248] Reflect-Guard: Enhancing LLM Safeguards against Adversarial Prompts via Logical Self-Reflection
  https://arxiv.org/abs/2605.24834
  Categories: jailbreaking
- [llmsec-2026-00249] Ellipsoid Control: A White-list Jailbreak Defense via Benign Latent Modeling
  https://arxiv.org/abs/2605.24552
  Categories: jailbreaking
- [llmsec-2026-00250] Steering Beyond the Support: Adversarial Training on Unsupervised Jailbroken Activation Simulation
  https://arxiv.org/abs/2605.24535
  Categories: jailbreaking
- [llmsec-2026-00251] Prompt Overflow: What the Guardrail Inspects Is Not What the Model Infers
  https://arxiv.org/abs/2605.23196
  Categories: prompt-injection, guardrails
- [llmsec-2026-00252] Adversarial Reframing: A Framework for Targeted Generation in Language Models
  https://arxiv.org/abs/2605.21674
  Categories: jailbreaking
- [llmsec-2026-00253] Refusal Evaluation in Coding LLMs and Code Agents: A Systematic Review of Thirteen Malicious-Code Prompt Corpora (2023-2025)
  https://arxiv.org/abs/2605.20351
  Categories: jailbreaking, survey
- [llmsec-2026-00254] Adaptive Probe-based Steering for Robust LLM Jailbreaking
  https://arxiv.org/abs/2605.20286
  Categories: jailbreaking, model-extraction
- [llmsec-2026-00255] RoboJailBench: Benchmarking Adversarial Attacks and Defenses in Embodied Robotic Agents
  https://arxiv.org/abs/2605.19328
  Categories: jailbreaking, adversarial-examples, benchmarks
- [llmsec-2026-00256] Exploring and Developing a Pre-Model Safeguard with Draft Models
  https://arxiv.org/abs/2605.19321
  Categories: jailbreaking, guardrails
- [llmsec-2026-00257] On the Geometric Limits of Transformer Defenses against Obfuscation Attacks: Latent Embedding Collapse & Performance Robustness Gap
  https://arxiv.org/abs/2605.19159
  Categories: prompt-injection
- [llmsec-2026-00258] Overeager Coding Agents: Measuring Out-of-Scope Actions on Benign Tasks
  https://arxiv.org/abs/2605.18583
  Categories: prompt-injection, access-control, sandboxing-isolation, benchmarks
- [llmsec-2026-00259] Acoustic Interference: A New Paradigm Weaponizing Acoustic Latent Semantic for Universal Jailbreak against Large Audio Language Models
  https://arxiv.org/abs/2605.18168
  Categories: jailbreaking, guardrails
- [llmsec-2026-00260] An Empirical Study of Privacy Leakage Chains via Prompt Injection in Black-Box Chatbot Environments
  https://arxiv.org/abs/2605.18133
  Categories: prompt-injection
- [llmsec-2026-00261] LivePI: More Realistic Benchmarking of Agents Against Indirect Prompt Injection
  https://arxiv.org/abs/2605.17986
  Categories: prompt-injection, benchmarks
- [llmsec-2026-00262] Babel: Jailbreaking Safety Attention via Obfuscation Distribution Optimized Sampling
  https://arxiv.org/abs/2605.17971
  Categories: jailbreaking, guardrails
- [llmsec-2026-00263] ESLD (External Surrogate Latent Defense): A Latent-Space Architecture for Faster, Stronger Prompt-Injection Defense
  https://arxiv.org/abs/2605.18918
  Categories: prompt-injection, agentic-threats
- [llmsec-2026-00264] DMN: A Compositional Framework for Jailbreaking Multimodal LLMs with Multi-Image Inputs
  https://arxiv.org/abs/2605.18915
  Categories: jailbreaking, guardrails
- [llmsec-2026-00265] AI Agents May Always Fall for Prompt Injections
  https://arxiv.org/abs/2605.17634
  Categories: prompt-injection
- [llmsec-2026-00266] ADR: An Agentic Detection System for Enterprise Agentic AI Security
  https://arxiv.org/abs/2605.17380
  Categories: agentic-threats
- [llmsec-2026-00267] STRIDE-AI: A Threat Modeling Framework for Generative AI Security Assessment
  https://arxiv.org/abs/2605.17163
  Categories: prompt-injection, data-poisoning, adversarial-examples, threat-modeling
- [llmsec-2026-00268] New Wide-Net-Casting Jailbreak Attacks Risk Large Models
  https://arxiv.org/abs/2605.17128
  Categories: jailbreaking
- [llmsec-2026-00269] A Cross-Modal Prompt Injection Attack against Large Vision-Language Models with Image-Only Perturbation
  https://arxiv.org/abs/2605.16090
  Categories: prompt-injection
- [llmsec-2026-00270] Compositional Jailbreaking: An Empirical Analysis of Mutator Chain Interactions in Aligned LLMs
  https://arxiv.org/abs/2605.15598
  Categories: jailbreaking
- [llmsec-2026-00271] Hidden in Memory: Sleeper Memory Poisoning in LLM Agents
  https://arxiv.org/abs/2605.15338
  Categories: memory-security
- [llmsec-2026-00272] AI Security Research Should Better Incentivize Defense Research
  https://arxiv.org/abs/2605.23448
  Categories: membership-inference, federated-learning
- [llmsec-2026-00273] Hijacking Agent Memory: Stealthy Trojan Attacks Through Conversational Interaction
  https://arxiv.org/abs/2605.29960
  Categories: memory-security
- [llmsec-2026-00274] GradSentry: Gradient Spectral Entropy for Backdoor Sample Filtering in Large Language Model Fine-Tuning
  https://arxiv.org/abs/2605.26574
  Categories: data-poisoning
- [llmsec-2026-00275] Security of OpenClaw Agents: Fundamentals, Attacks, and Countermeasures
  https://arxiv.org/abs/2605.25435
  Categories: autonomous-operations
- [llmsec-2026-00276] Backdooring Masked Diffusion Language Models
  https://arxiv.org/abs/2605.19262
  Categories: data-poisoning
- [llmsec-2026-00277] Surviving the Unseen: Predictive Defense for Novel Multi-Turn Multimodal Attacks
  https://arxiv.org/abs/2605.18988
  Categories: agentic-threats, guardrails, autonomous-operations
- [llmsec-2026-00278] Not What You Asked For: Typographic Attacks in Household Robot Manipulation
  https://arxiv.org/abs/2605.18593
  Categories: benchmarks
- [llmsec-2026-00279] OEP: Poisoning Self-Evolving LLM Agents via Locally Correct but Non-Transferable Experiences
  https://arxiv.org/abs/2605.18930
  Categories: agentic-threats
- [llmsec-2026-00280] Automating Low-Risk Code Review at Meta: RADAR, Risk Calibration, and Review Efficiency
  https://arxiv.org/abs/2605.30208
  Categories: agentic-threats
- [llmsec-2026-00281] The Importance of Out-of-Band Metadata for Safe Autonomous Agents: The Redpanda Agentic Data Plane
  https://arxiv.org/abs/2605.29082
  Categories: agentic-threats, autonomous-operations
- [llmsec-2026-00282] Got a Secret? LLM Agents Can't Keep It: Evaluating Privacy in Multi-Agent Systems
  https://arxiv.org/abs/2605.27766
  Categories: agent-architecture
- [llmsec-2026-00283] Intelligence as Managed Autonomy: Failure, Escalation, and Governance for Agentic AI Systems
  https://arxiv.org/abs/2605.27628
  Categories: agentic-threats, guardrails
- [llmsec-2026-00284] ESBMC: A Survey of Its Evolution, Integration, and Future Directions in Formal Software Verification
  https://arxiv.org/abs/2605.26169
  Categories: survey
- [llmsec-2026-00285] Measuring Security Without Fooling Ourselves: Why Benchmarking Agents Is Hard
  https://arxiv.org/abs/2605.22568
  Categories: benchmarks
- [llmsec-2026-00286] Code as Agent Harness
  https://arxiv.org/abs/2605.18747
  Categories: agentic-threats
- [llmsec-2026-00287] Remembering More, Risking More: Longitudinal Safety Risks in Memory-Equipped LLM Agents
  https://arxiv.org/abs/2605.17830
  Categories: prompt-injection, memory-security
- [llmsec-2026-00288] Towards trustworthy agentic AI: a comprehensive survey of safety, robustness, privacy, and system security
  https://arxiv.org/abs/2605.23989
  Categories: agentic-threats, tool-use-security, survey
- [llmsec-2026-00289] The End of Trust: How Agentic AI Breaks Security Assumptions
  https://arxiv.org/abs/2605.16436
  Categories: agentic-threats
- [llmsec-2026-00290] The Misattribution Gap: When Memory Poisoning Looks Like Model Failure in Agentic AI Systems
  https://arxiv.org/abs/2605.22842
  Categories: agentic-threats, guardrails, agent-architecture, memory-security
- [llmsec-2026-00291] What Software Engineering Looks Like to AI Agents? -- An Empirical Study of AI-Only Technical Discourse on MoltBook
  https://arxiv.org/abs/2605.08380
  Categories: autonomous-operations
- [llmsec-2026-00292] Red-Teaming Medical AI: Systematic Adversarial Evaluation of LLM Safety Guardrails in Clinical Contexts
  https://www.semanticscholar.org/paper/e5f756d97f03c3fdbc96a955a205ca2e274307de
  Categories: guardrails, red-teaming
- [llmsec-2026-00293] Assessing Risks of Large Language Models in Mental Health Support: A Framework for Automated Clinical AI Red Teaming
  https://www.semanticscholar.org/paper/98a12d04ba9a6d07bab2a443b7994dd805eeea35
  Categories: red-teaming, benchmarks
- [llmsec-2026-00294] A Safe Harbor for AI Evaluation and Red Teaming
  https://www.semanticscholar.org/paper/21f8977648e25ce8b95020e6f01988af99209c82
  Categories: red-teaming
- [llmsec-2026-00295] OpenAI's Approach to External Red Teaming for AI Models and Systems
  https://www.semanticscholar.org/paper/4329ac5ac885b9bfe6510d98cfbde77806f6e82e
  Categories: red-teaming
- [llmsec-2026-00296] Red-Teaming for Generative AI: Silver Bullet or Security Theater?
  https://www.semanticscholar.org/paper/4fda99880cdbf8f178f01eb4c8dbdae7f959ea94
  Categories: red-teaming
- [llmsec-2026-00297] SafeProtein: Red-Teaming Framework and Benchmark for Protein Foundation Models
  https://www.semanticscholar.org/paper/b316f37ef9d48c9aa073245df9e65678b8eca33f
  Categories: red-teaming, benchmarks
- [llmsec-2026-00298] The PIEE Cycle: A Structured Framework for Red Teaming Large Language Models in Clinical Decision-Making
  https://www.semanticscholar.org/paper/1417c22f2e479509f8b3a179b784b945498b71a2
  Categories: guardrails, red-teaming
- [llmsec-2026-00299] DREAM: Dynamic Red-teaming across Environments for AI Models
  https://www.semanticscholar.org/paper/8e63fb4190d0bb96927a6d4354d291254f90e042
  Categories: agentic-threats, red-teaming, benchmarks
- [llmsec-2026-00300] Jailbreak-Zero: A Path to Pareto Optimal Red Teaming for Large Language Models
  https://www.semanticscholar.org/paper/0e54275afd64916c2a2137b9a81a8402c9e6faff
  Categories: jailbreaking, red-teaming
- [llmsec-2026-00301] SIRAJ: Diverse and Efficient Red-Teaming for LLM Agents via Distilled Structured Reasoning
  https://www.semanticscholar.org/paper/910c759401877c93f37b5114d069108ea7c140e7
  Categories: red-teaming
- [llmsec-2026-00302] Toward Trustworthy Chatbots: A Protocol for Red Teaming for Health Related Conversations
  https://www.semanticscholar.org/paper/930205acf84599560a761027e57b15506d11fe7b
  Categories: red-teaming
- [llmsec-2026-00303] AART: AI-Assisted Red-Teaming with Diverse Data Generation for New LLM-powered Applications
  https://www.semanticscholar.org/paper/57d0e672040800e8d882ff0022647c087095e35f
  Categories: red-teaming
- [llmsec-2026-00304] Quality-Diversity Red-Teaming: Automated Generation of High-Quality and Diverse Attackers for Large Language Models
  https://www.semanticscholar.org/paper/da14e71f31e98612ebf871be742dddc55da509d1
  Categories: red-teaming
- [llmsec-2026-00305] RedDebate: Safer Responses through Multi-Agent Red Teaming Debates
  https://www.semanticscholar.org/paper/89b908678883095f8a2eda436bb5aac623b4e18e
  Categories: red-teaming, agent-architecture
- [llmsec-2026-00306] ASSERT: Automated Safety Scenario Red Teaming for Evaluating the Robustness of Large Language Models
  https://www.semanticscholar.org/paper/aa9aa1c315cb2a0c1759d82fb3d4b4506c2dbb7c
  Categories: red-teaming
- [llmsec-2026-00307] Red Teaming GPT-4V: Are GPT-4V Safe Against Uni/Multi-Modal Jailbreak Attacks?
  https://www.semanticscholar.org/paper/526c88e301af88080ae4ecc3b65c9fc1f8f383f8
  Categories: jailbreaking, red-teaming, benchmarks
- [llmsec-2026-00308] Safety by Measurement: A Systematic Literature Review of AI Safety Evaluation Methods
  https://www.semanticscholar.org/paper/42c6c25b277ef3ca5045ba0507bf5252f2df75a6
  Categories: benchmarks, survey
- [llmsec-2026-00309] Real-World Evaluation of Large Language Models in Healthcare (RWE-LLM): A New Realm of AI Safety & Validation
  https://www.semanticscholar.org/paper/1fe644e3b971a52cc57b1b5ddc4cba5408cf1a8d
  Categories: benchmarks
- [llmsec-2026-00310] Know Thy Judge: On the Robustness Meta-Evaluation of LLM Safety Judges
  https://www.semanticscholar.org/paper/0ffb356aab98ae69c717f8b2969c3fed0592a048
  Categories: guardrails, red-teaming, benchmarks
- [llmsec-2026-00311] Evaluating Human-AI Safety: A Framework for Measuring Harmful Capability Uplift
  https://www.semanticscholar.org/paper/3a3f4b4c7cd76bff6b5eacacc734dd97d05adc95
  Categories: red-teaming, benchmarks
- [llmsec-2026-00312] AlignInsight: A Three-Layer Framework for Detecting Deceptive Alignment and Evaluation Awareness in Healthcare AI Systems
  https://www.semanticscholar.org/paper/d9f0f2dafd5e976137c0037720665dbd936157f6
  Categories: guardrails
- [llmsec-2026-00313] MUSE: A Run-Centric Platform for Multimodal Unified Safety Evaluation of Large Language Models
  https://www.semanticscholar.org/paper/8d3675bff32bbde8709b044d721dc88a7ca55c8b
  Categories: guardrails, red-teaming
- [llmsec-2026-00314] RAG LLMs are Not Safer: A Safety Analysis of Retrieval-Augmented Generation for Large Language Models
  https://www.semanticscholar.org/paper/f716a18b462826004899010dfc30947f9c01ef90
  Categories: red-teaming
- [llmsec-2026-00315] A Frontier AI Risk Management Framework: Bridging the Gap Between Current AI Practices and Established Risk Management
  https://www.semanticscholar.org/paper/9ef444e985f198664ea90ba9a4c99d464aa0c18e
  Categories: risk-frameworks
- [llmsec-2026-00316] MMDT: Decoding the Trustworthiness and Safety of Multimodal Foundation Models
  https://www.semanticscholar.org/paper/26c02dbc2f6db3e3b7acdb493a880a3456ff2cfd
  Categories: benchmarks
- [llmsec-2026-00317] GuidedBench: Measuring and Mitigating the Evaluation Discrepancies of In-the-wild LLM Jailbreak Methods
  https://www.semanticscholar.org/paper/2098e70e436cb6ea7c2836384128b1cdf6775641
  Categories: jailbreaking, red-teaming
- [llmsec-2026-00318] AgentSeer: Visualizing and Evaluating Temporal Actions in Agentic AI Systems
  https://www.semanticscholar.org/paper/bc0181ebb81538aaef6a34901f34bdf84c7f6779
  Categories: agentic-threats
- [llmsec-2026-00319] Inverting the Shield: Systematically Generating Safety Tests from Policy Specifications
  https://www.semanticscholar.org/paper/6a1f7108e15400c9dd3c2054125afaffebd03299
  Categories: red-teaming, benchmarks
- [llmsec-2026-00320] Jailbreak Mimicry: Automated Discovery of Narrative-Based Jailbreaks for Large Language Models
  https://www.semanticscholar.org/paper/be948a3061bfb640a0683e63e6afc6c2ceb63775
  Categories: jailbreaking
- [llmsec-2026-00321] IH-Challenge: A Training Dataset to Improve Instruction Hierarchy on Frontier LLMs
  https://www.semanticscholar.org/paper/0d1a1ced045bbc21126efb2be0a4064e1ce18f63
  Categories: prompt-injection, jailbreaking, agentic-threats
- [llmsec-2026-00322] SecureCAI: Injection-Resilient LLM Assistants for Cybersecurity Operations
  https://www.semanticscholar.org/paper/3d16be498e90f357318f27bf8c476567a51d4e47
  Categories: prompt-injection, guardrails
- [llmsec-2026-00323] REBAR: Reference Ethical Benchmark for Autonomy Readiness
  https://www.semanticscholar.org/paper/424cb4210348215b8a001ab292d7769a906257cc
  Categories: guardrails, red-teaming, benchmarks
- [llmsec-2026-00324] Large language models provide unsafe answers to patient-posed medical questions
  https://www.semanticscholar.org/paper/ebdb2c9347e5ab1b7c27c483aafab9584d28e8a1
  Categories: red-teaming, benchmarks
- [llmsec-2026-00325] PersonaTeaming: Exploring How Introducing Personas Can Improve Automated AI Red-Teaming
  https://www.semanticscholar.org/paper/d9490d1ce9f58c5d545941246854e41831e2a74f
  Categories: red-teaming

---

Generated by the weekly paper fetch workflow (run #10, trigger: schedule).