@misc{arxiv2609.38415,
  title = {{Evaluating Whether GPT-6 Astra Performs Unsanctioned Supply-Chain Attacks}},
  author = {Alexandra Souly},
  year = {2026},
  eprint = {2609.38415},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.38415},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2609.27542,
  title = {{Control-Token Injection Suppresses Chain-of-Thought and Defeats Reasoning-Based Oversight in Tool-Using Agents}},
  author = {Muhammad Usama and Khair Un Nisa and Summer Yeoreum Jung},
  year = {2026},
  eprint = {2609.27542},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.27542},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2607.26115,
  title = {{GPT-Red: Automated Red Teaming via Self-Play at Scale}},
  author = {Eric Wallace and Christopher A. Choquette-Choo and Nikhil Kandpal and Sam Toyer and Dylan Hunn and Stephanie Lin and Yuxin Wen and Xiangyu Qi and Christopher Wolff and Zizhao Wang and Milad Nasr and Sicheng Zhu and Chuan Guo and Juan Felip},
  year = {2026},
  eprint = {2607.26115},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.26115},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2609.28274,
  title = {{Shutdown Sabotage Propensities in Multi-Agent Systems}},
  author = {Amelie Knecht; Ulysse Schaller; Christopher Summerfield; Thilo Hagendorff},
  year = {2026},
  eprint = {2609.28274},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.28274},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2607.11698,
  title = {{Agent Hacks Agents: Autoresearch Discovers Vulnerabilities in Production Agents}},
  author = {Xutao Mao and Rui Qian and Xiang Zheng and Cong Wang},
  year = {2026},
  eprint = {2607.11698},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.11698},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2609.19892,
  title = {{ClashBench: Conflicts Leading Agents to Seize and Harm}},
  author = {Yuejin Xie and Yu Li and Dadi Guo and Qingyu Liu and Yuqian Fu and Yanwei Fu and Yujiu Yang and Xia Hu and Dongrui Liu},
  year = {2026},
  eprint = {2609.19892},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.19892},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2607.05189,
  title = {{When Claws Remember but Do Not Tell: Stealthy Memory Injection in Persistent Personal Agents}},
  author = {Yechao Zhang and Shiqian Zhao and Jiawen Zhang and Jie Zhang and Gelei Deng and Xiaogeng Liu and Chaowei Xiao and Tianwei Zhang},
  year = {2026},
  eprint = {2607.05189},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.05189},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2608.00677,
  title = {{OpenART: Scaling Agent Red Teaming via Open-Ended Environment Evolution}},
  author = {Yunhao Chen and Xin Wang and Yixu Wang and Yi Liu and Jie Li and Yan Teng and Xingjun Ma and Xia Hu and Yu-Gang Jiang},
  year = {2026},
  eprint = {2608.00677},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.00677},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2609.15989,
  title = {{Corrupt Plans, Clean Traces: Evading Chain-of-Thought Monitoring with Plan Injection}},
  author = {Keertana Chidambaram and Andrew Ilyas and Vasilis Syrgkanis},
  year = {2026},
  eprint = {2609.15989},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.15989},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2609.01222,
  title = {{What's in Your Agent's Context? Context Privilege Escalation Attacks against AI Agent Harness}},
  author = {Zichuan Li and Jian Cui and Ashley Chen and Xiaojing Liao and Luyi Xing},
  year = {2026},
  eprint = {2609.01222},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.01222},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2608.23858,
  title = {{Beyond the Mandate: A Systematic Security Analysis of the Agent Payments Protocol (AP2)}},
  author = {Avital Aviv and Parth A. Gandh and Ron Bitton and Asaf Shabtai},
  year = {2026},
  eprint = {2608.23858},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.23858},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2609.23980,
  title = {{MobileCybench: Evaluating Agent Vulnerability Discovery via Executable Probes}},
  author = {Andy K. Zhang and Ava Huang and Joey Ji and Wai Han and Thomas Qin and Nardos Demilew and Michael Tian-Yue Liu and Brian Song and Riya Dulepet and Brian Wang and Kyleen Liao and Cuiyuanxiu Chen and Nishka Kacheria and Andrew Wu and Pratham Ra},
  year = {2026},
  eprint = {2609.23980},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.23980},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2609.37312,
  title = {{Hidden Reasoning Must Leak, but Need Not Be Readable: Fundamental Opportunities and Limits for Chain-of-Thought Monitoring}},
  author = {Mohammadali Mohammadkhani},
  year = {2026},
  eprint = {2609.37312},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.37312},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2609.15939,
  title = {{Vulnerability Localization Benchmark: Measuring Agentic Security Analysis at Repository Scale}},
  author = {Aman Priyanshu and Supriti Vijay and Kimia Majd and Xuhong He and Fraser Burch and Takahiro Matsumoto and Jianliang He and Baturay Saglam and Arthur Goldblatt and Zhuoran Yang and Amin Karbasi},
  year = {2026},
  eprint = {2609.15939},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.15939},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2608.12851,
  title = {{Practice Makes Unsafe: Skill Misevolution in Self-Improving LLM Agents}},
  author = {Xutao Mao and Liangjie Zhao and Xiang Zheng and Cong Wang},
  year = {2026},
  eprint = {2608.12851},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.12851},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2609.32763,
  title = {{Mandela-Bench: Multimodal Models Remember Canonical Images Instead of Seeing Them}},
  author = {Yicheng Bao and Zhenkun Gao and Xiahui Guo and Mingqian Yang and Xueheng Li and Bangwei Liu and Mingang Chen and Lijun Li and Xuhong Wang and Xin Tan},
  year = {2026},
  eprint = {2609.32763},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.32763},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2609.08258,
  title = {{Revoked but Still Authoritative: An Empirical Study of Revocation Enforcement in Agent-Memory Systems}},
  author = {Yi Ting Shen and Kentaroh Toyoda and Alex Leung},
  year = {2026},
  eprint = {2609.08258},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.08258},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2609.04075,
  title = {{PatchBench: Evaluating AI Agents for Vulnerability Patching}},
  author = {Chihao Shen and Jiacheng Li and Aastha Mahajan and Jeffery Siyuan Tian and Yonghwi Kwon and Yizheng Chen},
  year = {2026},
  eprint = {2609.04075},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.04075},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2608.18066,
  title = {{On the Fragility of Self-Improving Agents: Variance, Task Order, and Underspecification}},
  author = {Qinyuan Ye and Yu Li and Yada Pruksachatkun and Jiaxin Zhang and Chien-Sheng Wu},
  year = {2026},
  eprint = {2608.18066},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.18066},
  note = {AI Safety HOT 2026-10-03}
}

@misc{aisafetyhot-hrlczdf525ldft15qqdhwaw3n,
  title = {{The Backbone of Abuse: How Infrastructure Providers Enable the Proliferation of AI-Generated Non-Consensual Intimate Imagery}},
  author = {Sarah Morgan and Hany Farid and Sophie J. Nightingale},
  year = {2026},
  url = {https://tsjournal.org/index.php/jots/article/view/348},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2607.10526,
  title = {{Agents Don't Just Agree, They Remember: Benchmarking Persistent Sycophancy in Self-Improving Personal Agents}},
  author = {Xutao Mao and Liangjie Zhao and Leyao Wang and Rui Qian and Qiang Huang and Wentao Wang and Bo Han and Xiang Zheng and Cong Wang},
  year = {2026},
  eprint = {2607.10526},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.10526},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2609.14079,
  title = {{SkillSecurer: Detecting and Patching Prompt-Injection Vulnerabilities in AI Agent Skills}},
  author = {Donato Mecca and Alberto Verna and Youness Bouchari and Nikhil Jha and Marco Mellia},
  year = {2026},
  eprint = {2609.14079},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.14079},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2609.35596,
  title = {{SEABench: Benchmarking Endogenous Misalignment In Self-Evolving Agents}},
  author = {Saswat Das and Parvati Viswanathan and Daniel Donnelly and Chang Huang and Sahar Abdelnabi and Ferdinando Fioretto},
  year = {2026},
  eprint = {2609.35596},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.35596},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2608.21101,
  title = {{ClawSentry: A Progressive Multi-Tier Security Monitor for Safeguarding Autonomous LLM Agents}},
  author = {Kai Wang and Zeming Wei and BiaoJie Zeng and Chang Jin and An Wang and Xiaokun Luan and Zhixiao Lin and Jingjing Qu and Xia Hu and Xingcheng Xu},
  year = {2026},
  eprint = {2608.21101},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.21101},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2610.00450,
  title = {{ZoneClaw: Mitigating Persistent Memory Attacks by Establishing Memory-Zoning in OpenClaw-Style Computer-Use Agents}},
  author = {Haokai Ma and Chieh Lin and Yupeng Qiu and Ee-Chien Chang},
  year = {2026},
  eprint = {2610.00450},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.00450},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2607.14611,
  title = {{Bad Memory: Evaluating Prompt Injection Risks from Memory in Agentic Systems}},
  author = {Soham Gadgil and David Alexander and Sai Sunku and Franziska Roesner},
  year = {2026},
  eprint = {2607.14611},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.14611},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2608.24017,
  title = {{WebMCP-Phalanx: Enforcing and Characterizing Trust Boundaries for Browser-Integrated LLM Agents}},
  author = {Lin-Fa Lee and YI-YU Chang and Kuo-Hui Yeh},
  year = {2026},
  eprint = {2608.24017},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.24017},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2609.05843,
  title = {{SinoGlyphBench: A Diagnostic Benchmark for Chinese Glyph-Level Obfuscation in Language-Model Moderation}},
  author = {Yifan Wang and Zimu Wang and Suliu Qin and Changyu Zeng and Tong Chen and Siqi Chen and Yijie Lin and Lingyu Jiang and Jionglong Su and Yushan Pan and Haiyang Zhang and Wei Wang and Qiaoyu Tan},
  year = {2026},
  eprint = {2609.05843},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.05843},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2608.27531,
  title = {{Fully Unleashing the Multimodal Attacker: Meta-Adaptive Jailbreaking of Vision-Language Models}},
  author = {Benlei Cui and Shen Pang and Yuke Wang and Xuemei Dong and Yuwen Zhai and Jingqun Tang and Haiyang Yu and Hui Xue and Longtao Huang and Haiwen Hong},
  year = {2026},
  eprint = {2608.27531},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.27531},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2609.04194,
  title = {{Legibility is Not Interpretability: Comparing Judged and Actual Importance in Chain-Of-Thought Reasoning}},
  author = {Kevin Du and Alexander Hoyle and Laura Ruis and Acyr Locatelli},
  year = {2026},
  eprint = {2609.04194},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.04194},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2608.10218,
  title = {{Mind Viruses: Self-Propagating Ideas in Multi-Agent LLM Systems}},
  author = {Vassilis Papadopoulos and McNair Shah and Sam Zimmerman and Jack Lindsey},
  year = {2026},
  eprint = {2608.10218},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.10218},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2609.34790,
  title = {{CoSec: Benchmarking Agent Security in Communities}},
  author = {Hao Chen and Wenhui Dong and Ye Chen and Jiezhi Yao and Chenbo Xia and Yuwen Qu and Renxiang Wang and Fudong Yuan and Camil Hamami and Chenglong Pan and Xinquan Yue and Ziyu Wang and Fengyu Ye and Chenyang Si and Caifeng Shan},
  year = {2026},
  eprint = {2609.34790},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.34790},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2608.30041,
  title = {{Reachability-Based Capability Confinement for LLM Agents under Indirect Prompt Injection}},
  author = {Wujie Xiong and Rabimba Karanjai and Yang Lu and Weidong Shi and Lei Xu},
  year = {2026},
  eprint = {2608.30041},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.30041},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2609.33898,
  title = {{No Free Efficiency: Revisiting the Trade-off Between Training Efficiency and Model Vulnerability}},
  author = {Yiyong Liu and Jun Sakuma and Michael Backes and Rui Wen},
  year = {2026},
  eprint = {2609.33898},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.33898},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2609.36477,
  title = {{Guard Models Are Overconfident Where Base Models Are Uncertain}},
  author = {Jonghyun Hong},
  year = {2026},
  eprint = {2609.36477},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.36477},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2609.03221,
  title = {{Instability Floors: Separating Bias from Noise in Fairness Audits of Clinical LLM Agents with FairMedAgent}},
  author = {Bellibatlu and Rohith Reddy; Singh and Manpreet; Parashar and Deepak; Joshi and Rahul},
  year = {2026},
  eprint = {2609.03221},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.03221},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2608.16824,
  title = {{GEO-Flag: Detecting and Measuring GEO-Optimized Web Content}},
  author = {Junjie Chu and Ye Leng and Mingjie Li and Yun Shen and Xinyue Shen and Yang Zhang},
  year = {2026},
  eprint = {2608.16824},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.16824},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2609.09320,
  title = {{Playing Whack-a-Mole with misconceptions about memorization, extraction, and copyright}},
  author = {A. Feder Cooper},
  year = {2026},
  eprint = {2609.09320},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.09320},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2609.12448,
  title = {{GraphProfiler: Source-Linked Sensitive Attribute Inference via Personal Knowledge Graphs}},
  author = {Ahmed Sohair Khan; Estrid He; Chenglong Ma; Monica Wachowicz; Elham Naghizade},
  year = {2026},
  eprint = {2609.12448},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.12448},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2608.03700,
  title = {{When Agents Learn to Be You: Benchmarking Privacy Leakage, Impersonation Risk, and Defenses in Persona Skills}},
  author = {Yongli Xiang and Zhifang Zhang and Bojun Yang and Ziming Hong and Lei Feng and Miao Xu and Tongliang Liu},
  year = {2026},
  eprint = {2608.03700},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.03700},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2609.35902,
  title = {{Raising the Bar for Chinese Adolescent LLM Safety: A Culturally-Grounded, Fine-Grained Benchmark}},
  author = {Jinxiang Wang and Yifan Liu and Jing Tan and Xiangyu Zhao and Xin Yao and Xuetao Wei},
  year = {2026},
  eprint = {2609.35902},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.35902},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2609.37914,
  title = {{The Unequal Influence of Bad Advice: Using Training Data Attribution to Modulate Emergent Misalignment}},
  author = {Gonçalo Paulo},
  year = {2026},
  eprint = {2609.37914},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.37914},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2609.37624,
  title = {{Correct, Don't Delete: Mitigating Emergent Misalignment with Corrective Supervision}},
  author = {Jacob Epifano},
  year = {2026},
  eprint = {2609.37624},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.37624},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2609.30802,
  title = {{Understanding the Role of Prompt Template in Knowledge Distillation for Safety Alignment}},
  author = {Anjila Budathoki and Manish Dhakal and Benjamin M. Ampel and Yi Ding},
  year = {2026},
  eprint = {2609.30802},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.30802},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2608.19278,
  title = {{Mapping General-Purpose AI Governance in Twenty AI Middle-Power Jurisdictions}},
  author = {Josephine Schwab and Nathan Naidoo and Ferruccio Barazzutti and Sheryn Lee and Caio Vieira Machado},
  year = {2026},
  eprint = {2608.19278},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.19278},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2608.10393,
  title = {{Hidden in Plain Sight: Diffusion-Based Unrestricted Robotic Attacks on Vision-Language-Action Models}},
  author = {Jiahui Han and Yuhui Yao and Xin Wang and Jiafei Cao and Mingxuan Zhang and Danfeng Shan and Huiqi Deng and Guanchu Wang and Xia Hu},
  year = {2026},
  eprint = {2608.10393},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.10393},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2608.30703,
  title = {{SingProbe Technical Report}},
  author = {Sing Team},
  year = {2026},
  eprint = {2608.30703},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.30703},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2610.02142,
  title = {{Keyword Harnesses Fail Open: A Cheap Diagnostic Ladder for Tool-Use Claims in Small Language Models}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.02142},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.02142},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2607.14782,
  title = {{Global Index on Responsible AI: 2026 Report}},
  author = {Rachel Adams and Fola Adeleke and Ayantola Alayande and Selamawit Engida Abdella and Ana Florido and Nicolás Grossman and Leah Junck},
  year = {2026},
  eprint = {2607.14782},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.14782},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2607.24645,
  title = {{Sparse Autoencoders Encode Both Concepts and Functions: The Downstream Geometry of Feature Effects}},
  author = {Phu Gia Hoang and Anwoy Chatterjee and Tanmoy Chakraborty and Iryna Gurevych and Subhabrata Dutta},
  year = {2026},
  eprint = {2607.24645},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.24645},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2609.36316,
  title = {{Training LLMs to Verbalize Evaluation Awareness}},
  author = {Usman Anwar and Sahar Abdelnabi and David Krueger},
  year = {2026},
  eprint = {2609.36316},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.36316},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2607.05277,
  title = {{Untrusted Content Masking for Web Agents with Security Guarantees}},
  author = {Kristina Nikolić and Egor Zverev and Javier Rando and Matthew Jagielski and Edoardo Debenedetti and Florian Tramèr},
  year = {2026},
  eprint = {2607.05277},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.05277},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2609.10060,
  title = {{Reference-Based Bias Detection in LLMs via Relative Representations of Hidden States}},
  author = {Jeliński and Marek; Dubiński and Jan; Chrabaszcz and Maciej; Cygert and Sebastian},
  year = {2026},
  eprint = {2609.10060},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.10060},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2608.04034,
  title = {{A Multimodal Automatic Redteaming Evaluation based on Atomic Jailbreak Strategy Decoupling and Combination}},
  author = {Shiji Zhao and Yuxuan Zhou and Chen Xiong and Dongxian Wu and Yang Bai and Xun Chen},
  year = {2026},
  eprint = {2608.04034},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.04034},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2609.12582,
  title = {{NovaFabric: Tamper-Evident, Replayable Evidence for Autonomous AI Agent Runs}},
  author = {Mohsen Seyedkazemi Ardebili},
  year = {2026},
  eprint = {2609.12582},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.12582},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2609.20684,
  title = {{HerHealthEval: Evaluating Multilingual and Register-Sensitive Understanding of Women's Health Communication}},
  author = {Albattra and Hassan Saeed Hassan; Bahgat and Mazen Mohammed; Ferdousi and Rahatara; Amrya and Hana Essam Sayed Ahmed; Mousa and Mariam},
  year = {2026},
  eprint = {2609.20684},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.20684},
  note = {AI Safety HOT 2026-10-03}
}

@misc{aisafetyhot-qbhagu0yrlp4lkdyqkzhzeibg,
  title = {{Trust and Safety of Human- and AI-Powered Visual Description: A Case Study of Be My Eyes}},
  author = {Natalie Grace Brigham and Tadayoshi Kohno},
  year = {2026},
  url = {https://tsjournal.org/index.php/jots/article/view/340},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2608.03485,
  title = {{SkillSentry: Adaptive Honey Worlds for Dynamic Safety Testing of Agent Skills}},
  author = {Nizhang Li and Zonghao Ying and Xiangfan Wu and Zonglei Jing and Xixun Lin and Hao Zhang and Wenxin Zhang and Jiaye Lin and Quanchen Zou and Xiangzheng Zhang},
  year = {2026},
  eprint = {2608.03485},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.03485},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2609.32547,
  title = {{Prioritizing Repeated LLM Evaluation for Hidden Failure Discovery}},
  author = {Keita Broadwater; Akin Broadwater},
  year = {2026},
  eprint = {2609.32547},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.32547},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2609.24515,
  title = {{Beyond Predictable Paths: Redefining AI Security Incident Reporting for Agents}},
  author = {Anastasia Pustozerova and Eugene Bagdasarian and Luca Beurer-Kellner and Battista Biggio and Nico Ebert and David Filip and Marc Fischer and Heather Frase and David Hofer and Juliane Hoffmann and Daphne Ippolito and Somesh Jha and Sean},
  year = {2026},
  eprint = {2609.24515},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.24515},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2607.17117,
  title = {{Persistent Sparse Autoencoders: Learning Feature-Specific Timescales in Language Model Representations}},
  author = {Haoyan Luo and Mateo Espinosa Zarlenga and Mateja Jamnik},
  year = {2026},
  eprint = {2607.17117},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.17117},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2609.08943,
  title = {{Evaluating and Improving Evidence-Grounded Fact-Checking in LLMs via Multi-Round Evidence Ablation}},
  author = {Xingyu Deng and Mingzi Cao and Nikolaos Aletras and Xi Wang and Mark Stevenson},
  year = {2026},
  eprint = {2609.08943},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.08943},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2607.14737,
  title = {{GeoDetect: Geometric Adversarial Detection for VLPs}},
  author = {Afsaneh Hasanebrahimi and Hanxun Huang and Christopher Leckie and James Bailey and Sarah Erfani},
  year = {2026},
  eprint = {2607.14737},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.14737},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2607.13336,
  title = {{Delving into the Temporal Challenges of Unified Video Protection Against Image-to-Video and Fine-Tuning-based Customization}},
  author = {Yuxin Huang and Ziming Hong and Mingming Gong and Wanyu Wang and Jing Zhang and Tongliang Liu},
  year = {2026},
  eprint = {2607.13336},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.13336},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2610.01184,
  title = {{ReCast: Contract-Preserving Protection for Fixed-Interface Multimodal Reasoning}},
  author = {Bingchen Pei; Lichong Chen; Bingxi Zhao; Ziang Wu; Sirui Wang; Min Zhang; Yanhao Chen; Qingxu Liu; Qiang Gao; Chang-Tien Lu; Bo Gao},
  year = {2026},
  eprint = {2610.01184},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.01184},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2609.36434,
  title = {{The Safety Operator: Modulating the Expression of Safety Instructions via Spectral Optimization}},
  author = {Benoit Dherin},
  year = {2026},
  eprint = {2609.36434},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.36434},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2608.17220,
  title = {{PACE: Policy-Attested Contract Execution for Safe AI Agents in Decentralized Finance}},
  author = {Rabimba Karanjai and Yang Lu and Richard Williamson and Hemanth Hm and Prakhar Mehrotra and Lei Xu and Weidong and Shi},
  year = {2026},
  eprint = {2608.17220},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.17220},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2609.08832,
  title = {{Closing the Consistency Gap: Self-Evolving Agents That Learn to Stay on Course}},
  author = {Evelyn Duesterwald and Benjamin Elder and Lilian Ngweta and Shashanka Ubaru and Malgorzata Zimon},
  year = {2026},
  eprint = {2609.08832},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.08832},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2609.22178,
  title = {{Beyond Task Completion: Training Capable and Safe Computer-Use Agents}},
  author = {Zeyu Kang and Zhenyun Yin and Yang Zhang and Shan He and Shanzhe Lei and Yanjiu Zhong and Xinquan Chen and Xuhong Wang},
  year = {2026},
  eprint = {2609.22178},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.22178},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2608.12876,
  title = {{SPARED: Reasoning-Based AI-Generated Image Detection via Adversarially Edited Data}},
  author = {Yicheng Bao and Xiahui Guo and Xuhong Wang and Xin Tan},
  year = {2026},
  eprint = {2608.12876},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.12876},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2609.24934,
  title = {{Whose Facts Count? A Culturally Responsive Audit of LLM Evaluation Benchmarks}},
  author = {Fatima Tuz Zahra and Md. Sajeebul Islam Sk. and Rachel Chung},
  year = {2026},
  eprint = {2609.24934},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.24934},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2609.37858,
  title = {{Storage Is Not Strategy: State-Conditioned Support Control for LLM Unlearning}},
  author = {Tianhao Qian},
  year = {2026},
  eprint = {2609.37858},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.37858},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2609.19325,
  title = {{AUDITPLAN: Commit, Then Answer for Auditable Safety Alignment}},
  author = {Sai Sri Pushpa Jampani and Kshitij Mishra and Asif Ekbal},
  year = {2026},
  eprint = {2609.19325},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.19325},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2609.02786,
  title = {{SafeEvolve: Harness-Policy Co-Evolution from Agent Experience for Safety Alignment}},
  author = {Qinghua Mao and Wanying Qu and Dadi Guo and Leitao Yuan and Qingyu Liu and Yu Li and Guanxu Chen and Yanwei Fu and Xi Lin and Xia Hu and Dongrui Liu},
  year = {2026},
  eprint = {2609.02786},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.02786},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2609.37837,
  title = {{Can Vision-Language Models Stay Helpful When Facing Implicit Risks? Intent-Privilege OPSD for Efficient Safety-Helpfulness Alignment}},
  author = {Haotian Deng and Wenbin Xing and Gang Xu and Tao He and Jinkai Zheng and Chun Li and Zheng Zhu and Ming Li},
  year = {2026},
  eprint = {2609.37837},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.37837},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2610.01083,
  title = {{WBAG: A Whole-Body and Attached-Geometry Safety Framework for Vision-Language-Action Manipulation}},
  author = {Samuel Zhen},
  year = {2026},
  eprint = {2610.01083},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.01083},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2609.36562,
  title = {{ThinkingGuard: Decoding Implicit Hazards via Step-by-Step Risk Attribution in Multimodal Large Language Models}},
  author = {Ruochen Zhang},
  year = {2026},
  eprint = {2609.36562},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.36562},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2609.22720,
  title = {{When Disability Disclosure Travels: Memory, Privacy, and Contextual Integrity in Conversational AI}},
  author = {Taheri and Atieh; Tazike and Mahya; Carrington and Patrick; Bigham and Jeffrey P.},
  year = {2026},
  eprint = {2609.22720},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.22720},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2609.04859,
  title = {{MM-IFEval-Pro: A Multilingual and Attack-Resistant Benchmark for Instruction-Following in Vision-Language Models}},
  author = {Changming Xiao and Zhenliang Ni and Jinhui He and Han Shu and Jie Hu},
  year = {2026},
  eprint = {2609.04859},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.04859},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2608.00716,
  title = {{Generated Images Are Easier to Forget: A Machine Unlearning Perspective for Synthetic Image Detection}},
  author = {Jun Nie and Yonggang Zhang and Tongliang Liu and Yiu-ming Cheung and Bo Han and Xinmei Tian},
  year = {2026},
  eprint = {2608.00716},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.00716},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2609.36862,
  title = {{Safer Content or Firmer Refusals? A Hybrid Perturbation Defense for Alignment under Harmful Fine-tuning}},
  author = {Muhammad Zeeshan Akram},
  year = {2026},
  eprint = {2609.36862},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.36862},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2610.00812,
  title = {{Video Generation Models: A Survey of Post-Training and Alignment}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.00812},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.00812},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2610.01716,
  title = {{Architecture Without an Architect? Global Governance of Artificial Intelligence in a Divided World}},
  author = {Simon Chesterman},
  year = {2026},
  eprint = {2610.01716},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.01716},
  note = {AI Safety HOT 2026-10-03}
}

@misc{arxiv2610.00209,
  title = {{Energy Time-Series Imputation with Differentially Private Diffusion Models via Clipping-Aware Objective Conditioning}},
  author = {Huizhen Huang and Yu Li and Tao Huang and Chen Hou},
  year = {2026},
  eprint = {2610.00209},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.00209},
  note = {AI Safety HOT 2026-10-03}
}