StateWise: Diagnosing and repairing persistent operation state before agent actions(original, opens in a new tab)

Proposes StateWise, which diagnoses and repairs stale persistent state before coding agents act.

Tool failure recovery comparison of quantized Llama and Qwen agents reverses with prompts and scoring criteria(original, opens in a new tab)

Compare tool failure recovery in quantized agents, testing whether prompts and evaluation criteria reverse the direction of comparison.

arXiv limits submissions to two papers per person per month, responding to the flood of AI papers hitting the preprint server(original, opens in a new tab)

arXiv will tighten its submission limit to two papers per person per calendar month starting October 1, 2026, because AI tools have pushed monthly submissions past 40,000 papers. In September 2026 the platform received 40,363 submissions, compared with 20,569 in September 2024 and 9,869 in September 2016; the cs.AI category grew more than sixfold over two years and generated nearly 9,000 support tickets. The new rule applies to all categories and only to submitters; co-authors are not affected. Rejected papers still count toward the limit, while deletion before publication returns the quota. Thomas G. Dietterich, chair of the editorial advisory committee, said a small number of authors submit large volumes of low-quality papers, taking up too much of reviewers' time. arXiv calls this a temporary measure and plans to use newly obtained funding for technical upgrades to handle AI-generated content.

SemField: a training-free semantic watermark with an average true positive rate of 88.2% to 90.4% under paraphrase attacks(original, opens in a new tab)

Proposes the semantic watermark SemField, which still identifies the origin of generated text after paraphrase and structural modifications.

SSCBench: a measurement protocol and benchmark for evaluating the validity of evidence in LLM agent fault-injection tests of tool use(original, opens in a new tab)

Proposes SSCBench, evaluating the evidence validity of fault injection testing for tool-calling agents.

RAGStress: A Controlled Benchmark for Evaluating RAG Robustness under Knowledge Base Degradation(original, opens in a new tab)

Proposes the RAGStress controlled benchmark to evaluate RAG under knowledge base degradation.

MH-INDIC：面向印度城市与半城市语境孕产妇健康 LLM 交互的文化对齐评估框架(original, opens in a new tab)

Proposes MH-INDIC, evaluating cultural alignment of maternal and child health LLM interactions in the Indian context.

The paper proposes an alignment generalization prediction task, using activation representations to predict the cross-context effects of fine-tuned values.(original, opens in a new tab)

Compare the predictive power of value representations for alignment generalization after single-value fine-tuning.

RL-ARC: Reasoning-Guided Uncertainty Calibration for Large Reasoning Models(original, opens in a new tab)

Propose RL-ARC, which uses reasoning confidence to calibrate reasoning models in reinforcement learning.

Research: An agent stopping on time does not equal productive use of its time budget(original, opens in a new tab)

Use a clock harness and budget-shaping GRPO to improve agents' on-time return.

Study: online RL behavior attribution signals may be confounded by gradient magnitude and fluency(original, opens in a new tab)

Test whether online RL behavior attribution signals are confounded by gradient magnitude and fluency.

Owain Evans interprets a new paper: LLMs can subconsciously transfer complex traits such as backdoors and reward hacking(original, opens in a new tab)

Owain Evans introduced his team's new paper on X, stating that models can transfer more complex traits through subliminal learning, including new capabilities not present in pretraining, improvements to existing capabilities, backdoors, and reward hacking in agent scenarios. Previously, the original paper by Cloud et al. only showed models transferring a preference for owls through number sequences, as well as partial transfer of a malicious personality and MNIST skills. The authors listed three limitations: the traits studied were artificially constructed rather than real-world misalignment; some experiments used training setups slightly different from typical distillation; and traits only transferred partially. The authors considered these limitations important but said the conclusions still matter, because worse hyperparameters usually only reduce transfer rather than eliminating it entirely—if a teacher model has a 90% probability of severe harmful behavior in a specific context, the student model might still have a 0.5% probability.

Why it was selectedThe author, in the first person, lays out the conclusions of the new paper and three important limitations, and explains why partial transfer may still pose real-world risks.

The paper proposes a retrieval admissibility verification framework for long-term memory agents.(original, opens in a new tab)

Proposes a retrieval admissibility verification framework to evaluate memory agents' record eligibility and disclosure.

GROB studies the attribution boundaries of autonomous agent activity using public web traces(original, opens in a new tab)

Proposes GROB, using read-only public traces to preserve candidate agent leads and test attribution boundaries.

Study reconstructs the replication supply chain network of Agent skills on GitHub(original, opens in a new tab)

Reconstruct the agent skill replication network and model source selection to guide security audits.

Why it was selectedThe paper reconstructs the copy network of agent skills using git history and provides a reusable repository audit ranking method, allowing security teams to decide which repositories to review first.

Redwood Research proposes the distillation double bind: using distillation to make models confess hidden behavior or inherit only capabilities(original, opens in a new tab)

Proposes DFI and DFC distillation to convict teachers that conceal mismatches or safely extract capabilities.

Why it was selectedThe paper splits distillation into two uses, validates with the AuditBench secret-keeping model that students are more likely than teachers to confess hidden behaviors, and provides a comparison of interventions that preserve capability while suppressing trait transfer.

SafeArena: the first benchmark for evaluating misuse risk of autonomous web agents(original, opens in a new tab)

Proposes the SafeArena benchmark to evaluate whether web agents execute deliberately harmful tasks.

Researchers propose a Web threat model for agent browsers, catalog 20 attack types, and reproduce them on 4 models(original, opens in a new tab)

Researchers at North Carolina State University propose a web threat model for agent browsers and reproduce confusion attacks.

Oxford et al. release the TRAP benchmark: six frontier models' web agents are hijacked by prompt injection on average 25% of the time(original, opens in a new tab)

Researchers at the University of Oxford and other institutions built the TRAP benchmark to evaluate how web agents are hijacked by interface prompt injection.

Why it was selectedTRAP decomposes prompt injection into modules such as persuasion principles, manipulation techniques, and interface forms, quantifying the impact of interface details on the probability of web agents being hijacked.

BrowseSafe: Researchers Build a Browser Agent Prompt Injection Benchmark and Evaluate Existing Defenses(original, opens in a new tab)

Propose BrowseSafe, which detects and blocks prompt injection in browser agent tool outputs at the boundary.

WAInjectBench systematically evaluates prompt injection detection methods for web agents(original, opens in a new tab)

Propose WAInjectBench to evaluate prompt injection detection in web agents.

WebInject: Prompt injection against multimodal web agents via webpage pixel perturbations(original, opens in a new tab)

Proposes WebInject, which uses webpage pixel perturbations to induce a web agent to execute specified actions.

Meta et al. release the WASP benchmark for end-to-end evaluation of prompt injection attacks on web agents.(original, opens in a new tab)

Researchers at Meta FAIR and other institutions proposed the web agent prompt injection benchmark WASP and evaluated security end-to-end.

Why it was selectedWASP end-to-end measures prompt injection risk for web agents in self-hosted GitLab and Reddit environments, and provides the gap between hijack rate and attack completion rate.

Scale AI and CMU release BrowserART: refusal-trained LLMs acting as browser agents are highly vulnerable to jailbreaking(original, opens in a new tab)

Researchers from Scale AI and Carnegie Mellon University and other institutions propose BrowserART to evaluate the generalization of refusal training to browser agents.

Why it was selectedThe paper gives concrete gaps in refusal between browser agents and the underlying models, and releases a reusable red-teaming test set, suitable for evaluating agent deployment risks.

ST-WebAgentBench: A benchmark for evaluating web agent safety and trustworthiness(original, opens in a new tab)

Build ST-WebAgentBench, a benchmark for evaluating the safety and policy compliance of Web Agents.

The paper proposes the ARE framework to evaluate the adversarial robustness of multimodal agents on VisualWebArena(original, opens in a new tab)

Proposes the ARE framework and image-text attacks to evaluate the adversarial robustness of multimodal web agents.

APEXA adds execution integrity guardrails to LLM multi-agent systems for synchrotron data processing(original, opens in a new tab)

Propose APEXA, which rejects results without execution support at the tool layer and intercepts motor commands.

SciTrace: Trajectory-Aware Safety Reasoning Framework for Scientific Discovery Agents(original, opens in a new tab)

Proposes SciTrace, adding cross-stage safety reasoning and tool trajectory verification to scientific discovery agents.

SciIntegrity-Bench: A Benchmark for Evaluating the Academic Integrity of AI Scientist Systems(original, opens in a new tab)

Proposes SciIntegrity-Bench to evaluate whether research agents fabricate results.

LABSHIELD：面向科学实验室安全推理与规划的多模态基准(original, opens in a new tab)

提出 LABSHIELD，评测科学实验室智能体的安全推理与规划。

SafeScientist: Making LLM agents' scientific discoveries risk-aware(original, opens in a new tab)

Proposes SafeScientist with four-layer monitoring to prevent research agents from executing high-risk or unethical tasks.

The paper discusses the risks of AI scientists: safety should be prioritized over autonomy(original, opens in a new tab)

Review the risks of AI scientists and advocate a triadic protection framework.

Controlling AI risks in chemical science with agents: the SciGuard guardrail and the SciMT benchmark(original, opens in a new tab)

Proposes the SciGuard external guardrail and the SciMT benchmark to control AI misuse in chemical science.

MAFIA: Query-based Memory Poisoning Attacks on Audited LLM Agents(original, opens in a new tab)

Propose MAFIA to probe placement and fact disguise for query-based memory poisoning of audited agents.

PLA: Black-box Prompt Learning Attack against Text-to-Image Models(original, opens in a new tab)

The researchers propose a prompt learning attack framework, PLA, to bypass the safety mechanisms of text-to-image models under black-box conditions where the model architecture and parameters are inaccessible.

The study measures reward hacking and reasoning-answer decoupling under position-confounded optimization(original, opens in a new tab)

Measuring reward hacking and reasoning-answer decoupling under position-confounded optimization.

Researchers propose a jailbreak attack method that extracts the safety classifier of an aligned LLM(original, opens in a new tab)

They propose a jailbreak method that extracts the embedded safety classifier of aligned LLMs and attacks its proxy.

通过内部状态分析与聚类可视化并评测 LLM 事实幻觉倾向(original, opens in a new tab)

提出 FalseCite 基准，评测虚构引用如何改变事实幻觉。

StyleBreak: Jailbreaking with Stylized Audio to Reveal Alignment Vulnerabilities in Large Audio Language Models(original, opens in a new tab)

Propose StyleBreak stylized audio jailbreak, using speech attributes to bypass audio language model alignment.

The paper proposes jailbreaking LVLMs in intelligent transportation systems using image typographic manipulation and multi-turn prompting(original, opens in a new tab)

Proposes image typography manipulation and multi-turn prompt jailbreak to bypass safety alignment in traffic-scenario vision-language models.