Skip to yearly menu bar Skip to main content


Workshop Fri, Dec 11, 2026 • 8:00 AM – 5:00 PM AEDT Hall 5

The Third Workshop on Agents in the Wild: Safety, Security, and Beyond

Chenguang Wang ⋅ Wei Wang ⋅ Yuan Xue ⋅ Nicholas Crispino ⋅ Tianneng Shi ⋅ Vincent Siu ⋅ Zhe Ye
[ OpenReview] 

Abstract

Chat is not available.

Schedule

Time zone: Conference local time zone
Adversarial Stress-Testing of Long-Horizon Multi-Agent Systems
Deepak Akkil ⋅ Tamer Abuelsaad ⋅ Karthik V Kabirdoss ⋅ Matthew Pace ⋅ Aditya Vempaty ⋅ Saahir Beotra ⋅ Ravi Kokku ⋅ Satya V Nitta
When Speech Errors Break Tasks: Cross-Layer Evaluation of Conversational Voice Agents
Ancheng Deng ⋅ Yanyu Yan ⋅ Manling Li ⋅ Yimin Liu ⋅ Jin Lai
COPEX: Benchmarking LLM Robustness to Adversarial Context Across Model Context Protocol Layers
Nahom BIRHAN ⋅ Mehrdad Rostamzadeh ⋅ Sidhant Narula ⋅ Mahmoud Nazzal ⋅ Mohammad Ghasemigol ⋅ Daniel Takabi
Crafting Cognitive Resilience in Deceptive Multi-Agent Environments
Kirtana Phatnani ⋅ Vrushali Nipun Mehta ⋅ Paval KS ⋅ Aravind S ⋅ Nikhil Arora ⋅ Tanya Upadhyay ⋅ Amol Bandagale ⋅ Aabha Hattangadi ⋅ Biju J Dominic
Shutdownable Agents through Length-Neutral Policy Optimization
Alec Harris ⋅ Leo Richter ⋅ Elliott Thornley
Multi-Vector Red-teaming and Whitebox Attribution in Agentic Pipelines
Thomas Paniagua ⋅ Sriram Venkatapathy ⋅ Pradeep Yadlapalli ⋅ Myeongseob Ko ⋅ Doguhan Yeke ⋅ Rikhiya Ghosh ⋅ Alexandre Day ⋅ Sudeep Reddy Panyam ⋅ Himanshu Kumar ⋅ Pranab Mohanty
Agent Memory Is a Surface for Endogenous Authorization Laundering
Tommaso Cerruti ⋅ Mika Okamoto ⋅ Ansel K Erol
Chat-safe is not CUA-safe: Chat methods may not transfer to computer use
Bhuvan Koduru ⋅ Jiachen Yang ⋅ Ang Li ⋅ Xin Wang
Obligation-Aware Long-Term Agent Memory: Scoped Operations and Failure Localization
Ananya Sane ⋅ Jayesh Ramanujadas Rathi ⋅ Rajitha Ramanayake ⋅ Pradeep Nallathambi
CryptHarness: A Harness for Agent-Assisted Cryptanalytic Research
Nico Pelleriti ⋅ Nicolai Kraus ⋅ Alexander May ⋅ Sebastian Pokutta
When Safety Critics Fail Silently: Benchmarking Guardrail Degradation in Production Tool Ecosystems
Fatima Taheri Dezaki ⋅ Lakshmana babu Kolasani ⋅ Ankita Bhaumik ⋅ Siddartha S Rao ⋅ Ayush Jain
AIM: Adversarial Interface Manipulation
Mareks Woodside ⋅ Lawrence Jang ⋅ Ruslan Salakhutdinov
Testing Interchangeability in LLM Agent Teams
Jianxin Gao ⋅ Runze Li ⋅ Tianyi Yu ⋅ Linna Deng ⋅ Zining Wang
Behavior Beyond Text: Evaluating Refusal Transfer Failure in LLM Agents
Ekagra Gupta ⋅ Raj Saha ⋅ Aniekan-abasi Inyang ⋅ Adam Al Gharib
Misquote: Speaker-Triggered Backdoors in Speech LLMs
Natasa Krco ⋅ Euodia Dodd ⋅ Peter Romov ⋅ Yves-Alexandre de Montjoye
Linking Trajectory Drift to Representational Degradation in Sequential LLM Forecasting
Eric Shi ⋅ Nikhil Gourisetty ⋅ Advaith Neithalath ⋅ Hayden Fu ⋅ Zarreen Reza ⋅ Ruizhe Li ⋅ Kevin Zhu
Sound Plans, Forged Values: Cross-Channel Constraint Integrity for Computer-Use Agents
Giulio Zingrillo ⋅ Hanna Foerster ⋅ I Shumailov ⋅ Yiren Zhao ⋅ Robert Mullins
Evaluating the Robustness of LLM Cybersecurity Agents to Adversarial Telemetry in Security Logs
Miguel Piñero-Jacome ⋅ William Coffey ⋅ Le Nguyen ⋅ Nidhi Rastogi
Known By Their Actions: Fingerprinting LLM Browser Agents via UI Traces
William Gitta Lugoloobi ⋅ Samuele Marro ⋅ Jabez Magomere ⋅ Joss Wright ⋅ Chris Russell
Before Blaming a Call: Three Validity Gates for Agent Failure Attribution
MARCEL OSMOND ⋅ Kenzhebaev Bektur ⋅ Jinming Zhang
$AgentInSight: Declared Is Not Deployed---Reconciling Agent Tool Governance\\ with Signed Provenance and Tamper-Evident Audit$
Sonia Semwal ⋅ Lodum Senaratne ⋅ Nibin PJ ⋅ PRALHAD CHASKAR ⋅ Venkatesh Siddi
Benchmarking Exploration Hacking Propensity in Frontier LLMs
Eduard Hübner ⋅ Nina Żukowska ⋅ Alexander Panfilov ⋅ Joschka Braun
SIR: Self-improving Red-teaming for Compute Use Agents
Chen Xiong ⋅ Zhiyuan HE ⋅ Pin-Yu Chen ⋅ Stjepan Picek ⋅ Tsung-Yi Ho
What Should a Guardrail Return? Factorizing Post-Block Feedback for Browser Agents
Usukhbayar Purevdorj ⋅ Zekun Wu ⋅ Adriano Koshiyama ⋅ Philip Treleaven
Claim-Level Confidence Calibration for Reliable Decision Making with Large Language Models
Toghrul Abbasli ⋅ Kentaroh Toyoda ⋅ Yuan Wang ⋅ Li Chen
Characterizing Latent-Space Adversarial Training for LLM Safety
Maria Smirnova ⋅ Yarin Gal ⋅ Lin Li
Language Is a Security Surface for Agent Guards
Hasan Demirkiran ⋅ Jens Ernstberger
Beyond Tool Accuracy: End-to-End Reliability of On-Device SMS Agents Under Homoglyph Attacks
Cheng-Che Lee ⋅ Chia-Pin Cheng ⋅ Hsu-Sheng Chang ⋅ CHIALIN CHOU
Where Empathy Goes Wrong: Emotional Appeals Compromise AI-to-AI Oversight
Sohan Venkatesh ⋅ Thomas Jiralerspong ⋅ Flemming Kondrup
Shortcut Sensitivity in Agent-Safety Evaluations
Hasan Demirkiran ⋅ Jens Ernstberger
Fine, I'll Do Something Else: Unsafe Shortcuts and Brittle Compliance in AI Agents
David Guzman Piedrahita ⋅ Bernhard Schölkopf ⋅ Zhijing Jin
Decomposing and Measuring Evaluation Awareness
Changling Li ⋅ Terry J Zhang ⋅ Jie Zhang ⋅ Zhijing Jin ⋅ Florian Tramer ⋅ Sahar Abdelnabi ⋅ Maksym Andriushchenko
The Surface You Test Is Not the Surface That Breaks
Syed Nazmus Sakib ⋅ Nafiul Haque ⋅ Shahrear Bin Amin ⋅ Shifat E. Arman
When can we trust untrusted monitoring? An AI control safety case sketch across collusion strategies
Morgan Sinclaire ⋅ Nelson Gardner-Challis ⋅ Georgiy Kozhevnikov ⋅ Jonathan Bostock ⋅ Charlie J Griffin ⋅ Joan Velja ⋅ Alessandro Abate
OpenMLE: Training Evolutionary MLE Agents toward Recursive Self-Improvement
Junlin Yang ⋅ Che Jiang ⋅ Yu Fu ⋅ Tianwei Luo ⋅ Can Ren ⋅ Weizhi Wang ⋅ Kaikai Zhao ⋅ Hongyi Liu ⋅ Yuxin Zuo ⋅ Yuru wang ⋅ Yuchen Fan ⋅ Kai Tian ⋅ Zhenzhao Yuan ⋅ Xiaojian Lin ⋅ Li Sheng ⋅ Rushi Qiang ⋅ Guoli Jia ⋅ Xingtai Lv ⋅ Ermo Hua ⋅ Dianqiao Lei ⋅ Youbang Sun ⋅ Ning Ding ⋅ Bowen Zhou ⋅ Kaiyan Zhang
Collusion Does Not Localize to Jacobian-Lens Transport Subspaces
David Li ⋅ Aadarsh Varigonda ⋅ Andrew Feng ⋅ Mehek Chauhan ⋅ Diksha Shrivastava
Memorized or Memo-rized: Prior Leakage of Procedural Knowledge in Large Language Models
Kexin Wang ⋅ Lin Li ⋅ Yi Ren ⋅ Zihuiwen Ye ⋅ Gusheng Pan ⋅ Yug D Oswal ⋅ Yarin Gal ⋅ Yihong Chen
ToolRosetta: Surface-Form Invariance of Tool-Call Guards
Hasan Demirkiran ⋅ Jens Ernstberger
Foresight-SWE: Can Agents Catch Software Defects that Humans Miss?
Shaswat P Patel ⋅ Michel Liao ⋅ He He ⋅ Valerie Chen
Trust, but Verify: Reliable Long-Horizon Mobile Agents Fully Solve AndroidWorld
Pierre-Louis Favreau ⋅ Jean-Pierre Lo ⋅ Clement Guiguet ⋅ Charles Simon-Meunier ⋅ Nicolas Dehandschoewercker ⋅ Allen Roush ⋅ Judah Goldfeder ⋅ Ravid Shwartz-Ziv
Sauron: An Evidence-First Agentic Verifier
Reza Sanayei ⋅ Razvan Dumitru ⋅ Sunjie Hou ⋅ MohammadHossein Rezaei ⋅ Haris Riaz ⋅ Robert Vacareanu ⋅ Minglai Yang ⋅ Mihai Surdeanu ⋅ Ying Liu ⋅ Daniel Y Zhang
LLM Aggregators Count Copies Where They Should Count Sources
Jianxin Gao ⋅ Tianyi Yu ⋅ Linna Deng ⋅ Runze Li ⋅ Zining Wang
CommunityFact: A Dynamic, Multilingual, Multi-domain Benchmark for Misinformation Detection in the Wild
Sahajpreet Singh ⋅ Insyirah Mujtahid ⋅ Min-Yen Kan ⋅ Kokil Jaidka
RedInject: A Self-Evolving Harness for Indirect Prompt-Injection Evaluation in Agentic Gyms
Tharindu Kumarage ⋅ Qian Hu ⋅ Rahul Gupta ⋅ Charith Peris
Necessary or Sufficient? Evaluating LLM Explanations With Behavioural Evidence
Urja Pawar ⋅ Rajitha Ramanayake ⋅ Nabeel Kemal ⋅ Ashwin Kandath ⋅ Owen O'Neill ⋅ Houssem Chatbri
The Calls are Coming from Inside the Model: Investigating Probe-based Detection of Tool-Calling Errors in LLMs
Eric Yeats ⋅ Brendan Kennedy ⋅ Loc Truong ⋅ John Buckheit ⋅ Caitlin Hutten ⋅ Jesse Friedbaum ⋅ John Emanuello ⋅ Henry Kvinge
Computation Is Not Authorization: Trust Boundaries and Their Limits in LLM Negotiation
Baishali Chaudhury ⋅ Divya Bhargavi ⋅ Isaac Privitera ⋅ Mengdie (Flora) Wang ⋅ Guanghui Wang ⋅ H Zhao ⋅ Yolin ⋅ David.Z ⋅ Jae Oh Woo
The Safety Decisions Behind LLM Agents: Options, Conventions, and Open Questions
Bryan Lincoln Marques de Oliveira ⋅ Daniel Machado Pedrozo ⋅ Luana Guedes Barros Martins ⋅ Vinicius Aguiar ⋅ Rodrigo Z Fanucchi ⋅ Telma Lima
AgentGate: Capability-Based Runtime Access Control for LLM Agents
Aravinda Kashyap Kabbinamakki Suresh ⋅ Peng Gao
Dual-Null LoRA: Decoupling Fine-Tuning Updates from Safety Alignment
Markus Hisch ⋅ Yi Ren ⋅ Yarin Gal ⋅ Lin Li
AdMem: Expectation-Grounded Procedural Memory for Long-Horizon Task-Solving Agents
Runzhe Wang ⋅ Huilin Lu ⋅ Shengjie LIU ⋅ Li Dong ⋅ Zhihuai Zhu
No Reset, Emergent Behaviors: Evaluating and Training Agents on Sequences of Tasks
Romain Froger ⋅ Matteo Bettini ⋅ Theophile Laurent ⋅ Kavya Kopparapu ⋅ Grégoire Mialon ⋅ Amine Benhalloum ⋅ Djame Seddah ⋅ Thomas Scialom
Learning steganography is easy, learning steganographic reasoning is hard
Julian Schulz ⋅ Lukas Fülle ⋅ Rieke Fruengel
Visual Fairness Misalignment: AI Models Prefer People Based on How They Look
Mostufa Jbareen ⋅ Amit LeVi ⋅ Rom Himelstein ⋅ Avi Mendelson ⋅ Brit Youngmann
A Lightweight Safety Prefilter for LLM Agents: Mitigating Context-Dependent Shortfalls in SAEs
Yoonsol Jung ⋅ REN MEIYING ⋅ Hyochang Yang ⋅ Jungpyo Hong ⋅ Hyonsu Choe
The Hardening Tax: Policy-Graded Evaluation of Coding Agents under Enterprise Security Constraints
Yair Amar ⋅ Dotan Davidovich ⋅ Hai Rozencwajg ⋅ Or Hiltch ⋅ Ravid Shwartz-Ziv
Dissent Absorbed: Consensus-Oriented Reconstruction Bias in LLM Multi-Agent Committees
Yundong Kim ⋅ Seungeon Choi ⋅ Jitaek Lim ⋅ Heyoung Yang
Hardening AgentCrypt in Multi-Agent Systems
Harish Karthikeyan ⋅ Yue Guo ⋅ Leo de Castro ⋅ Antigoni Polychroniadou ⋅ Udari Madhushani Sehwag ⋅ Leo Ardon ⋅ Sumitra Ganesh ⋅ Manuela Veloso
When Verifiers Disagree: Measuring Specification Sensitivity in Jailbreak Evaluation
Santiago Arellano ⋅ Saleena Angeline Sartawita ⋅ Amy Xie ⋅ Arjun Addaypally ⋅ Shobhnik Kriplani
Web Agents Don't Need a Browser
Mandeep Cheema ⋅ Lorian Richmond ⋅ Lucas Leschynski
VerifierContractBench: Safety Regressions in Adaptively Improved Verifiers for Web Agents
Lakshya Narula ⋅ Saurabh Tripathi ⋅ Lily Sharma ⋅ Nikhil Rao
Deny Without Disabling: Safety Evaluation and Control for Multi-Agent Systems
Yunbei Zhang ⋅ Saiyue Lyu ⋅ Janet Wang ⋅ Yingqiang Ge ⋅ Jiang Guo ⋅ Jihun Hamm ⋅ Chandan Reddy
Stress-Testing Context Alignment Stressors in Agents
Mark Lovett ⋅ Syed A Haider ⋅ Christopher Denq ⋅ Promita R Sikder ⋅ Elizaveta Tennant
Why Do LLM Agents Fail to Explore New Environments? A World-Modeling Perspective
Shiqi Chen ⋅ Tongyao Zhu ⋅ Zian Wang ⋅ Jinghan Zhang ⋅ Kangrui Wang ⋅ Siyang Gao ⋅ Teng Xiao ⋅ Yee Whye Teh ⋅ Junxian He ⋅ Manling Li
When Search Succeeds but Agents Fail: Diagnosing and Mitigating Retrieval Myopia
Hyeondong Woo ⋅ Jongwon Ryu ⋅ Jinkwon Hwang ⋅ Junyeong Kim
The AI Sedition Acts: Sabotage-by-Omission in LLM Briefing Pipelines
Advik Talasila ⋅ Vishwesh Chinthukumar ⋅ Dennis Andelman ⋅ Calvin Supasanya ⋅ Glenn Matlin
Shared-Memory Honeytokens in Multi-Agent LLM Systems: A Controlled Simulation
Muhammad Aaliyan ⋅ Ayesha Imran ⋅ Muhammad Roshaan
ReFract: Benchmarking Perspective Awareness in Language Model Agents with Text World Models
Hainiu Xu ⋅ Vítor Lourenço ⋅ Mohnish Dubey ⋅ Yunfei Bai ⋅ Yulan He ⋅ Caroline Catmur ⋅ Aline Paes ⋅ Marco Caserta ⋅ Akash Chandrayan ⋅ Luca D'Angelo
Sensitive Information Leakage from Tool-Call Traces
Jihyung Kook ⋅ Soomin Kim ⋅ Purna Chandra Sekhar Vakudavathu
Diagnosing Rule Recovery in Browser Agents: A Controlled Suite for Evaluating Partial Progress
Ivan Hornung ⋅ Aaron Kwok ⋅ Karthikeya Lakoji ⋅ Sneheel Sarangi
AgentAbstain: Do LLM Agents Know When Not to Act?
Xun Liu ⋅ Yi Evie Zhang ⋅ Vira Kasprova ⋅ Parisa Rabbani ⋅ Pardissadat Zahraei ⋅ Tianyu Zhang ⋅ Ali Ebrahimpour-Boroojeny ⋅ Varun Chandrasekaran
Separating instructions from data as an attention problem
Igor Shilov ⋅ Xiaoxue Yang ⋅ Alexander Panfilov ⋅ Matthieu Meeus ⋅ Peter Romov ⋅ Jonas Geiping ⋅ Yves-Alexandre de Montjoye
Orbit: A Framework for Multi-Agent Security Evaluations
Ben Hagag ⋅ William L Anderson ⋅ Srija Chakraborty ⋅ Christian Schroeder de Witt
Privileged, but Biased: How PI-Conditioned Teachers Break Self-Distillation
Sarthak Harne ⋅ Chinmay Karkar ⋅ Yash Pandya ⋅ Akshay Nambi
Are Your Agents Ready to Evolve? Assessing Evolution-Readiness in Agents Through Paired Safety and Utility Scoring
Nimet Beyza Bozdag ⋅ Tharindu Kumarage ⋅ Lisa Bauer ⋅ Tong Wang ⋅ Pradeep Natarajan ⋅ Dilek Hakkani-Tur ⋅ Venkatesh Saligrama ⋅ Rahul Gupta ⋅ Charith Peris
Exploitability of LLM Agents in Auctions
Aditya Vema Reddy Kesari ⋅ Krishna Reddy Kesari
Do Agents Know When They Succeed? Calibrating Agent Confidence from Internal Representations
PRIYANKA MARY MAMMEN ⋅ Emil Joswin ⋅ Durga Srujananjali Medicherla
Fine-Tuning a Tool-Using Agent’s Source Preference Removes Prompt-Level Control
Olga Kudashova ⋅ Aliaksandr Karatai ⋅ Konstantin Mortikov
APPA: Recoverable Information-Flow Control for Real-World LLM Agents
Arseny Kravchenko ⋅ Vadim Liventsev ⋅ Innokentii Konstantinov ⋅ Ildar Iskhakov ⋅ Matvey Kukuy
Fast but Forgetful: Cross-Agent KV Reuse Breaks Decision Fidelity in LLM Security Review
Gurjot Singh ⋅ Shreyas Mahajan ⋅ Ishpuneet Singh ⋅ Maninder Singh
MemCtrl: Do users have control over their agent's memory?
Yao Tong ⋅ Jie Zhang ⋅ Avital Shafran ⋅ Florian Tramer ⋅ Reza Shokri
When Verification Becomes a Training Signal: Reward-Hacking Propagation in Multi-Agent Systems
Rishikesh K Muralimohan ⋅ Yash A Patil ⋅ Vatsal Desai ⋅ Cuong H Nguyen ⋅ Diksha Shrivastava
Minimal Intervention, Structured Generalization: Reasoning–Behavior Coherence Beyond the Rewarded Context
Jonathan Robinson ⋅ Luca Franceschetti ⋅ Mark Lovett ⋅ Dan Le ⋅ Krish Sen ⋅ Nikhil Narayanan ⋅ Zihe Liu ⋅ Elizaveta Tennant
Runtime Verification of Large Language Model Agents Under Temporal Input/Output Logic
Abhishek N Kulkarni ⋅ Bastien Bernath ⋅ Anuj Tambwekar ⋅ Vele Tosevski ⋅ Aditya Karan ⋅ Leif Hancox-Li ⋅ Tim G. J. Rudner
Do AI-for-Science Agents Preserve Model Safety?
MICHAEL LEE ⋅ Manya Sriram ⋅ N. Benjamin Erichson
LLMs Learn to Evade Latent Monitors from Feedback Alone
Hugo Lyons Keenan ⋅ Christopher Leckie ⋅ Sarah Erfani
Self-Prompt-Injecting Backdoors in Coding Agents
Saranya Vijayakumar ⋅ Dmitrii Krasheninnikov ⋅ Matthew Jagielski ⋅ Nicholas Carlini
GateArena: Environment-Enforced Confirmation for Irreversible Agent Actions
Lan Jiang ⋅ Francesco Quinzan ⋅ Umang Bhatt
Loyalty Over Honesty: Relationship-Gated Truth Omission as an AI Safety Failure Mode
Bariscan Kurtkaya ⋅ Beyzanur Arican Dinc ⋅ Fatih Dinc ⋅ Nina Miolane
Back to Basics: Formal Analysis Hints Improve Weak-to-Strong Monitoring
Daniel Ben-Levi ⋅ Judah Goldfeder ⋅ Mateusz Dziemian ⋅ Raja Moreno