@misc{arxiv2608.09867,
  title = {{Stealing Reasoning Traces from Proprietary LLM APIs}},
  author = {Alexander Panfilov and David Schmotz and Ilia Shumailov and Luca Beurer-Kellner and Joachim Schaeffer and Ameya Prabhu and Jonas Geiping and Maksym Andriushchenko},
  year = {2026},
  eprint = {2608.09867},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.09867},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2608.17445,
  title = {{Decomposition Attacks Across Unlinkable Identities: Limits of Stateful Defenses for LLM Services}},
  author = {Bowen Sun and Zhengyue Zhao and Xiaogeng Liu and Yinzhi Cao and Chaowei Xiao},
  year = {2026},
  eprint = {2608.17445},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.17445},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2609.24927,
  title = {{Et Tu, Brute? Economic Misalignment in Personal AI Agents}},
  author = {Priyanshu and Aman and Vijay and Supriti and Jabarian and Brian and Mireshghallah and Niloofar},
  year = {2026},
  eprint = {2609.24927},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.24927},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2608.09476,
  title = {{ActBench: Self-Evolving Benchmark of Behavioral Safety in Cowork Agents}},
  author = {Hongwei Yao and Yiming Liu and Meihui Chen and Jieling Chen and Zikun Chen and Yiling He and Wangze Ni and Cong Wang and Kui Ren},
  year = {2026},
  eprint = {2608.09476},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.09476},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2609.35799,
  title = {{OpenAI-HuggingFace: A Reproduction \& Lessons for Alignment Testing}},
  author = {Stewart Slocum and Malayandi Palan and Christopher Chute and Michael Kim and Benjamin Van Roy},
  year = {2026},
  eprint = {2609.35799},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.35799},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2609.05797,
  title = {{Safety Monitors Mostly Catch What the Model Already Refuses}},
  author = {Sripad Karne},
  year = {2026},
  eprint = {2609.05797},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.05797},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2609.24967,
  title = {{Emergent Collusion in Long-Horizon LLM Agent Interaction}},
  author = {Xinrui Shi; Yanzhe Zhang; Diyi Yang},
  year = {2026},
  eprint = {2609.24967},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.24967},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2607.12340,
  title = {{Skills That Don't Exist: A Large-Scale Study of Hallucinated Skill Recommendation in LLM Agents}},
  author = {Weifeng Yuan and Wenbo Guo and Feng Dong and Haoyu Wang and Yang Liu},
  year = {2026},
  eprint = {2607.12340},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.12340},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2608.29381,
  title = {{Safe to Resume? Breaking Execution Continuity of Agent Execution via Rollback}},
  author = {Guanlong Wu and Dahui Li and Ke Jiang and Jianyu Niu and Cong Wang and Yinqian Zhang},
  year = {2026},
  eprint = {2608.29381},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.29381},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2607.18538,
  title = {{CryptanalysisBench: Can LLMs do Cryptanalysis?}},
  author = {Lukas Fluri and Avital Shafran and Nicholas Carlini and Matthew Jagielski and Milad Nasr and Orr Dunkelman and Eyal Ronen and Florian Tramèr},
  year = {2026},
  eprint = {2607.18538},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.18538},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2607.20891,
  title = {{Is Deep Research Reliable? Misleading Knowledge Induces False Conclusions}},
  author = {Pengyu Zhu and Lijun Li and Longju Yang and Sen Su and Jing Shao},
  year = {2026},
  eprint = {2607.20891},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.20891},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2609.27900,
  title = {{Delegated Misalignment: How Multi-Agent Structures Amplify LLM Safety Risks}},
  author = {Zonghao Ying and Jiaqi Yan and Huize Luo and Quanchen Zou and Aishan Liu and Xianglong Liu},
  year = {2026},
  eprint = {2609.27900},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.27900},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2608.21500,
  title = {{SecOPD: Mitigating Adaptive Prompt Injections by On-Policy Distillation}},
  author = {Yibo Peng and Long Lian and David Wagner and Sizhe Chen},
  year = {2026},
  eprint = {2608.21500},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.21500},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2609.16754,
  title = {{TAME: Token Attribution and Masking for Emergent misalignment}},
  author = {Md Rayhanul Masud and Md Rizwan Parvez},
  year = {2026},
  eprint = {2609.16754},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.16754},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2609.04382,
  title = {{Privacy Failure in Split-LLM Training, The Returned Gradient Nullifies the Decoys}},
  author = {Georgios Politis and Evangelos Pappas},
  year = {2026},
  eprint = {2609.04382},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.04382},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2607.27191,
  title = {{Can AI agents conduct open-ended AI research? Early evidence from two case studies}},
  author = {Peter Kirgis and Sayash Kapoor and Andrew Schwartz and Stephan Rabanser and David Africa and Konstantinos Voudouris and Viet Nguyen and Toby Pilditch and Magda Dubois and Harry Coppock and Cozmin Ududec and Nitya Nadgir and Matilda Oron},
  year = {2026},
  eprint = {2607.27191},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.27191},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2609.35576,
  title = {{Share-Borne AI Virus: Memory-Hopping Attacks Across LLM Agents}},
  author = {Sidharth Pulipaka and Ansh Sharma and Stanislau Hlebik and Leonidas Raghav and Vyas Raina and Ivaxi Sheth and Mario Fritz},
  year = {2026},
  eprint = {2609.35576},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.35576},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2609.33220,
  title = {{When Do Models Admit They Are Wrong? Failure Disclosure Is Unstable Under Reinforcement Learning}},
  author = {Steven Y. Feng and Noah D. Goodman and Michael C. Frank and Evan Hubinger and Paul C. Bogdan and Andrew Lampinen},
  year = {2026},
  eprint = {2609.33220},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.33220},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2607.12166,
  title = {{From Geometric Recovery to Causal Validation: A Reproducible Audit of Sparse Autoencoder Features, from Superposition Geometry to Causal Inertness}},
  author = {Mohamed Abdessalem Bal},
  year = {2026},
  eprint = {2607.12166},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.12166},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2609.02316,
  title = {{Counter-GEO-Bench: Evaluating Defenses Against Information-Distorting Generative Engine Optimization}},
  author = {Bing Zheng and Zongyao Zhao and Wenming Yang},
  year = {2026},
  eprint = {2609.02316},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.02316},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2609.31342,
  title = {{Stale-Document Poisoning: When Outdated Retrieval Overrides Correct Model Answers}},
  author = {Md Shamim Ahmed and Lukas Galke Poech and Richard Röttger},
  year = {2026},
  eprint = {2609.31342},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.31342},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2608.25460,
  title = {{Training Alignment Auditors via Reinforcement Learning}},
  author = {Paul Rosu and Rowan Wang},
  year = {2026},
  eprint = {2608.25460},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.25460},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2607.23496,
  title = {{Do LLMs Know Their Vulnerable Scenarios?}},
  author = {Ziheng Peng and Huiqi Deng and Haoran Jing and Xuankun Rong and Jiahui Han and Xiting Wang and Na Zou and Xia Hu},
  year = {2026},
  eprint = {2607.23496},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.23496},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2609.14754,
  title = {{Calibrating Interpretability Instruments Before Trusting Their Verdicts}},
  author = {Orion Reblitz-Richardson},
  year = {2026},
  eprint = {2609.14754},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.14754},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2609.08812,
  title = {{What AI Benchmarks Actually Measure: Adapting Convergent and Discriminant Validity to Interrogate Fifty-Six AI Benchmarks}},
  author = {Meera Desai and Sang T. Truong and Hanna Wallach and Alex Chouldechova and A. Feder Cooper and Jean Garcia-Gathright and Daniel E. Ho and Abigail Z. Jacobs and Sanmi Koyejo and Nicholas Pangakis and Angelina Wang},
  year = {2026},
  eprint = {2609.08812},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.08812},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2609.08789,
  title = {{Silent Revision: Measuring Undisclosed Change in the Safety Frameworks of Frontier AI Developers}},
  author = {Louis Yiven Zhu},
  year = {2026},
  eprint = {2609.08789},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.08789},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2609.14759,
  title = {{Refusal Reads Only a Slice of What the Model Knows: Harm-Keyed Routing and Its Exceptions Across Model Families}},
  author = {Orion Reblitz-Richardson},
  year = {2026},
  eprint = {2609.14759},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.14759},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2608.06422,
  title = {{Sharding Prevents LLM Oversight Failures and Adversarial Exploitation}},
  author = {Victor Akinwande and J. Zico Kolter and Aran Nayebi},
  year = {2026},
  eprint = {2608.06422},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.06422},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2607.14345,
  title = {{Value Leakage: An LLM's Answers Are Silently Shaped by Its Own Values}},
  author = {Jan Betley and Johannes Treutlein and Jan Dubiński and Harry Mayne and Karol Gałązka and Niels Warncke and Anna Sztyber-Betley and Owain Evans},
  year = {2026},
  eprint = {2607.14345},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.14345},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2609.01091,
  title = {{Subliminal Learning as Trait-Direction Drift: A Mechanism and Targeted Control under SFT Distillation}},
  author = {Zhixuan Liu and Zhichen Dong and Yuyu Fan and Xiangtian Li and Chao Yang},
  year = {2026},
  eprint = {2609.01091},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.01091},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2608.21766,
  title = {{Evaluation Awareness in Language Models: Representation, Verbalization, and Control}},
  author = {Farzaneh Heidari and Amin Memarian and Guillaume Rabusseau},
  year = {2026},
  eprint = {2608.21766},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.21766},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2610.01535,
  title = {{False Floors: LLM Safety Routing Evaluations Break Under Distribution Shift}},
  author = {Amit Singh Bhatti and Vishal Vaddina},
  year = {2026},
  eprint = {2610.01535},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.01535},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2608.11469,
  title = {{The Next Challenge for Agentic Cybersecurity: A Realistic, Contamination-Free Reverse Engineering Benchmark}},
  author = {Jeremy Spence and Nicholas Assaderaghi and Feng Xiao and Jinhao Zhu and Nikil Ravi and Xiangyu Qi and Matthew Jagielski and Raluca Ada Popa and Eric Wallace and Guannan Wei and Yangruibo Ding and Zhuo Zhang},
  year = {2026},
  eprint = {2608.11469},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.11469},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2608.11816,
  title = {{How China-Origin Vision-Language Models Move from Refusal to Reframing in State Alignment}},
  author = {Guang Yang and Fengchen Liu and Alex Wang and Homa Hosseinmardi and Amir Ghasemian},
  year = {2026},
  eprint = {2608.11816},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.11816},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2608.08542,
  title = {{When Skills Meet Safety: Benchmarking and Characterizing the Adaptive Jailbreak Robustness of Skill-Merged LLMs}},
  author = {Yu Ma and Hongli Shi and Jing Li and Xinran Xu and Weiwei Hou},
  year = {2026},
  eprint = {2608.08542},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.08542},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2608.19741,
  title = {{One Success Isn't Reliability: Thinkingbox, a Sandbox and Benchmark for Agents in Stateful Business Workflows}},
  author = {Zhuochun Li and Youngmin Ko and Ali Keramati and Tuhin Kundu and Liang-Chun Tsai and Nicola Ferri and Mirco Milletari and Jiaxiang Liu and Susana Palmaz Lopez Pelaez and Yuepeng Wang and Vadim Smolyakov and Xiang Jiang and Kjartan Olafs},
  year = {2026},
  eprint = {2608.19741},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.19741},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2607.25560,
  title = {{Agent Skills Matter: Inferring Proprietary Skills from Execution Trajectories}},
  author = {Jianing Geng and Ruiqi He and Zekun Fei and Biao Yi and Xuansheng Wu and Ruijie Wang and Zheli Liu and Xia Hu and Qingkai Zeng},
  year = {2026},
  eprint = {2607.25560},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.25560},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2607.05462,
  title = {{BioSecBench-Refusal: A paired metric for performance and alignment in agentic biosecurity risk assessment}},
  author = {Edwin H. Wintermute and Harmon Bhasin and Christina M. Agapakis and Dianzhuo Wang and Evan Seeyave and Arjun Banerjee and Daniel Fulop and Matthew C. Watson and Adam J. Meyer and Sandrine Boissel and Jens H. Kuhn and Rishi Jain and Noah},
  year = {2026},
  eprint = {2607.05462},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.05462},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2609.35699,
  title = {{Distillation Defenses Easily Break After Reinforcement Learning}},
  author = {Shidan Javaheri and Alexander Panfilov and Oliver Britton and Yarin Gal and Yonatan Gideoni},
  year = {2026},
  eprint = {2609.35699},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.35699},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2608.09577,
  title = {{ElasticBack: Stealthy Conditional Backdoor in LLM-Agent Skills via Coupled Trigger-Rule Optimization}},
  author = {Hao Sui and Simeng Qin and Jie Liao and Xiaojun Jia and Bing Chen and Yang Liu},
  year = {2026},
  eprint = {2608.09577},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.09577},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2608.22868,
  title = {{AgentFlow: A Flow-Centric Policy Language and Framework for Securing LLM Agent Systems}},
  author = {Basavesh Ammanaghatta Shivakumar and Swarn Priya and Peng Gao},
  year = {2026},
  eprint = {2608.22868},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.22868},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2607.19262,
  title = {{BioSecBench-Surveillance: A Verifiable Benchmark for AI Agents in Pathogen Genomic Surveillance}},
  author = {Harmon Bhasin and Kevin Flyangolts and Dianzhuo Wang and Evan Seeyave and Arjun Banerjee and Amanda Darling and Joshua Stallings and David Stern and Shawn Higdon and Claire Duvallet and Bryan Tegomoh and Kenny Workman},
  year = {2026},
  eprint = {2607.19262},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.19262},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2609.16305,
  title = {{BLINDSPOT: A Benchmark for Safety and Refusal Calibration in Long-Horizon Tool-Using Agents}},
  author = {Sadia Asif and Mohammad Mohammadi Amiri and Momin Abbas and Tejaswini Pedapati and Prasanna Sattigeri},
  year = {2026},
  eprint = {2609.16305},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.16305},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2609.19722,
  title = {{ALIBI: Adversarial Legitimacy Injection in Binary Input against LLM Malware Analyzers}},
  author = {Hyeongjun Choi and Wonyoung Jung and Haehoon Seo and Sungyup Nam},
  year = {2026},
  eprint = {2609.19722},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.19722},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2609.23215,
  title = {{Triggers and Diagnostics for LLM-Based Interpretability Failures in Active Inference Agents}},
  author = {Param Raval and Rohit Shenoy and Archana Vaidheeswaran},
  year = {2026},
  eprint = {2609.23215},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.23215},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2608.20554,
  title = {{aiXamine: Unified Black-Box Evaluation of Cross-Dimensional Trade-offs in LLM Safety, Security, and Privacy}},
  author = {Fatih Deniz and Yazan Boshmaf and Dorde Popovic and Issa Khalil},
  year = {2026},
  eprint = {2608.20554},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.20554},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2609.05535,
  title = {{Beyond the Verdict: Evidence-Aligned Evaluation of Visual Prompt-Injection Guardrails}},
  author = {Suyoung Lee and Myungsub Choi},
  year = {2026},
  eprint = {2609.05535},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.05535},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2608.06270,
  title = {{The Illusion of Visual Tool-Use: A Causal Audit of Thinking with Images}},
  author = {Zhiheng Wang and Bo Peng and Lai Wei and Chaochao Lu},
  year = {2026},
  eprint = {2608.06270},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.06270},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2607.12649,
  title = {{Extractable Memorization From First Principles}},
  author = {A. Feder Cooper and Marika Swanberg and Jamie Hayes and Lea Duesterwald and Christopher De Sa and Georgios Kaissis and Daniel E. Ho and Mark A. Lemley and Percy Liang},
  year = {2026},
  eprint = {2607.12649},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.12649},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2608.13522,
  title = {{Vero: Can AI Agents Build Formally Verified Software Repositories?}},
  author = {Zhe Ye and Hantao Lou and Yuechun Sun and Peiyang Song and Zhengxu Yan and Timothe Kasriel and Qingyang Zhang and Kaiyu Yang and Soonho Kong and Jingxuan He and Dawn Song},
  year = {2026},
  eprint = {2608.13522},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.13522},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2607.21839,
  title = {{Certified in Theory, Broken in Practice: Assumption Gaps in Cryptographic Model Certification}},
  author = {Carter Luck and Olive Franzese-McLaughlin and Elisaweta Masserova and Akira Takahashi and Antigoni Polychroniadou and Nicolas Papernot},
  year = {2026},
  eprint = {2607.21839},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.21839},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2609.30986,
  title = {{Evaluating Sycophancy in Chinese Large Language Models on Factual Questions Derived from Online Search Queries}},
  author = {Geng Liu and Feng Li and Mengxiao Zhu and Francesco Pierri},
  year = {2026},
  eprint = {2609.30986},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.30986},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2609.22818,
  title = {{The Price of Safety: Benign-Case Utility and Token Overhead of Memory-Poisoning Defenses in LLM Agents}},
  author = {Pritom Bhowmik},
  year = {2026},
  eprint = {2609.22818},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.22818},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2609.04022,
  title = {{Representational alignment yields generalizable safety in language models}},
  author = {Lingyu Li and Yan Teng and Yingchun Wang and Xia Hu},
  year = {2026},
  eprint = {2609.04022},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.04022},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2609.03035,
  title = {{You Can't Escape Your Own Activations : Evaluation Awareness and Multi-Agent Monitoring}},
  author = {Aritra Das and Jaee Ponde and Mihir More and Debayan Gupta},
  year = {2026},
  eprint = {2609.03035},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.03035},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2610.01073,
  title = {{Safety Must Survive Self-Improvement: Why Failures Persist and How Agents Recover}},
  author = {Yunbei Zhang and Janet Wang and Saiyue Lyu and Yingqiang Ge and Kaiqu Liang and Zijian Jin and Chandan K Reddy and Jihun Hamm},
  year = {2026},
  eprint = {2610.01073},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.01073},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2607.05174,
  title = {{AgentGym2: Benchmarking Large Language Model Agents in De-Idealized Real-World Environments}},
  author = {Zhiheng Xi and Dingwen Yang and Jiaqi Liu and Jixuan Huang and Honglin Guo and Baodai Huang and Tinggang Chen and Qi Zhang and Zhonghang Lu and Chenyu Liu and Jiajun Sun and Jiazheng Zhang and Dingwei Zhu and Xin Guo and Junzhe Wang and Zhihao Z},
  year = {2026},
  eprint = {2607.05174},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.05174},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2609.04582,
  title = {{When Do Internal Probes Beat Reading the Answer? Miscalibrated Readouts and Behavior-Concealed Knowledge in Language Models}},
  author = {Gnaneswar Villuri and Hashmath Shaik and Alex Doboli},
  year = {2026},
  eprint = {2609.04582},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.04582},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2608.11727,
  title = {{Harness-IF: Evaluating Instruction Following Across Instruction Surfaces in Coding Agents}},
  author = {Zining Huang and Haoran Que and Hong Zeng and Ge Zhang and Zuo Wang and Jin Chen and Haodong Wang and Zhongfei Hou and Changxin Pu and Shen Yan and Wenhao Huang},
  year = {2026},
  eprint = {2608.11727},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.11727},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2609.30768,
  title = {{Does Thinking Help Fairness? Reasoning Tokens Resolve Some Biases but Create More}},
  author = {Deng Pan and Joe Germino and Yihong Ma and Elizabeth Daly and Nuno Moniz and Ting Hua and Nitesh Chawla},
  year = {2026},
  eprint = {2609.30768},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.30768},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2608.16578,
  title = {{Physics of Agents: Statistical Mechanics Predicts Collective Behavior of AI Agents}},
  author = {Batu El; Jinhee Paeng; Fatih Dinc; Shiye Su; Mete Erdogan; Aneesh Pappu; Haotian Ye; Wanjia Zhao; Surya Ganguli; James Zou},
  year = {2026},
  eprint = {2608.16578},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.16578},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2608.26958,
  title = {{Scaling Model-Generated Distillation Data Can Make Latent Teacher Traits More Recoverable}},
  author = {Zhichen Dong and Zhixuan Liu and Yuyu Fan and Xiangtian Li and Shuyang Zhang and Chao Yang},
  year = {2026},
  eprint = {2608.26958},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.26958},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2609.03588,
  title = {{KC-Bench: A Dynamic Interactive Benchmark for Evaluating Knowledge Conflicts in LLM Agents}},
  author = {Yaxing Lyu and Shengjie Zhou and Binbin Toh and Pengyu Zhu and Lijun Li},
  year = {2026},
  eprint = {2609.03588},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.03588},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2607.12507,
  title = {{When Binaries Talk Back: Representation-Confusion Attacks on LLM-Assisted Reverse Engineering}},
  author = {Igor Santos-Grueiro},
  year = {2026},
  eprint = {2607.12507},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.12507},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2608.05578,
  title = {{Detecting Safety Training Modification in Language Models via Activation Analysis}},
  author = {Glen Messenger},
  year = {2026},
  eprint = {2608.05578},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.05578},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2607.22671,
  title = {{AIR-BENCH Live: An Evolving Safety Benchmark for Foundation Models}},
  author = {Rohan Naphade and Minzhou Pan and Bo Li},
  year = {2026},
  eprint = {2607.22671},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.22671},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2609.28335,
  title = {{An Open Pipeline and Dashboard for Systemic-Risk Evidence under the EU AI Act's Code of Practice}},
  author = {Jacob T. Emmerson and Phuong-Anh Nguyen-Le and Ronan Romano and Wilber Sean V. Anterola and Yann Billeter and Zhijing Jin},
  year = {2026},
  eprint = {2609.28335},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.28335},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2608.20563,
  title = {{Beyond End-to-End Success: Diagnosing Failures in Long-Horizon Security LLM Agents}},
  author = {Wei Shao and Chongzhou Fang and Zuxiong Tan and Zequan Liang and Setareh Rafatirad and Avesta Sasan and Houman Homayoun},
  year = {2026},
  eprint = {2608.20563},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.20563},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2609.10105,
  title = {{Beyond Training: A Feasibility Taxonomy for Inference-Time AI Governance}},
  author = {Samar Ansari},
  year = {2026},
  eprint = {2609.10105},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.10105},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2608.29030,
  title = {{Learning to Follow In-Context Watermark Instructions via Self-Distillation}},
  author = {Yepeng Liu and Tianyi Chen and Xuandong Zhao and Dawn Song and Yuheng Bu},
  year = {2026},
  eprint = {2608.29030},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.29030},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2607.11999,
  title = {{Underwriting the Agent Economy: The Blueprint for an AI Insurance Stack}},
  author = {Cristian Trout and Sanmi Koyejo and Sasha Romanosky and Giorgio Ripamonti and Lynn Thompson and Desiree Spain and Alex Taylor and Kevin Casey and Stephen Casper and Matthew Botvinick and Sean McGregor and Miles Brundage and A. Feder Coo},
  year = {2026},
  eprint = {2607.11999},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.11999},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2609.14843,
  title = {{A Responsive Present, a Shared Past, a Social Other: Teens' Overreliance on Companion AI Chatbots}},
  author = {Mohammad Namvarpour and Tyler Chang and Afsaneh Razi},
  year = {2026},
  eprint = {2609.14843},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.14843},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2608.00711,
  title = {{Tracing the Cascade: A Topology-Aware Evaluation Framework for Scientific Agent Hallucinations}},
  author = {Xinshun Feng and Ziqi Miao and Lijun Li and Jing Shao},
  year = {2026},
  eprint = {2608.00711},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.00711},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2609.02122,
  title = {{AI agents reshape consensus formation in human groups}},
  author = {Lin Chen and Ziyi Liu and Xia Hu and Yong Li},
  year = {2026},
  eprint = {2609.02122},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.02122},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2608.07808,
  title = {{The Anatomy of a Prompt Injection: A Component Model for Structured Analysis}},
  author = {Jeremy McHugh},
  year = {2026},
  eprint = {2608.07808},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.07808},
  note = {AI Safety HOT 2026-10-04}
}

@misc{aisafetyhot-mxv63eg3ub8xbyw0qoqo16or2,
  title = {{A scoping review on the mental health harms of LLM-based chatbots}},
  author = {Alexander Diel and John Torous and Pim Cuijpers and Jens Kleesiek and Felix Nensa and Niels Weber and Franziska Faust and Tania Josan Lalgi and Finley Sam Mellis and Martin Teufel and Alexander Bäuerle},
  year = {2026},
  url = {https://nature.com/articles/s41746-026-03054-x},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2608.30387,
  title = {{Attesting Outputs and Delegation Ancestry in Multi-Agent AI Systems}},
  author = {Lifei Liu and Haoran Yu},
  year = {2026},
  eprint = {2608.30387},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.30387},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2609.32004,
  title = {{Is invariance all you need for algorithmic fairness? Removing demographic information can create new bias}},
  author = {Aditya Parikh and Eike Petersen and Stella Frank and Enzo Ferrante and Melanie Ganz and Aasa Feragen},
  year = {2026},
  eprint = {2609.32004},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.32004},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2608.30083,
  title = {{Zero-Knowledge Predicate Proofs Between AI Agents: A Measured, Cross-Protocol Gateway and the Source-Integrity Gap}},
  author = {Ashok Subbabhatta Gopalakrishna},
  year = {2026},
  eprint = {2608.30083},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.30083},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2609.15803,
  title = {{Delegating Authorization to Misaligned Agents: Coalitional Alignment and Safe Control}},
  author = {Natalie Collina and Surbhi Goel and Aaron Roth and Sikata Bela Sengupta},
  year = {2026},
  eprint = {2609.15803},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.15803},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2609.25443,
  title = {{ZeroGate: Trust-Preserving Fast Paths for Governed AI Agent Runtimes}},
  author = {Zexun Wang},
  year = {2026},
  eprint = {2609.25443},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.25443},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2609.09875,
  title = {{AgentAudit: An Open, Extensible Framework for Full-Lifecycle Trust Evaluation of AI Agents}},
  author = {Shrey Nag and Sachita and Abhishek Kumar Singh and Lipi Goel and Rajeshwar Singh Janwar},
  year = {2026},
  eprint = {2609.09875},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.09875},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2607.19595,
  title = {{Twin Agent: Context Residual Compression for Privilege Separated Agents}},
  author = {Zhanhao Hu and Dennis Jacob and Xiao Huang and Zhaorun Chen and Bo Li and David Wagner},
  year = {2026},
  eprint = {2607.19595},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.19595},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2609.33086,
  title = {{From Constitutions to Control: Interpretable Rewards for Aligning Language Models}},
  author = {Johann D. Gaebler and Calvin Isley and Max Lamparth and Stephen Casper and Sharad Goel},
  year = {2026},
  eprint = {2609.33086},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.33086},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2609.19989,
  title = {{Benchmarking LLM Compliance with China AI Generated Content Regulations}},
  author = {Chenrui Cui and Hongye Fang and Lisha Song and Weichao Chen and Yue Zhu and Gang Xu},
  year = {2026},
  eprint = {2609.19989},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.19989},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2609.34591,
  title = {{TULIP: Targeted LLM Unlearning at Layers Identified Per-Input}},
  author = {Yejin Kim and William F. Shen and Seokwon Jung and Daeun Park and Seong Joon Oh},
  year = {2026},
  eprint = {2609.34591},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.34591},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2609.14631,
  title = {{IntentCap: LLM Agent Capabilities Should Follow Task Intent and Context Source}},
  author = {Yusheng Zheng and Wenhui Zhang and Yu Mao},
  year = {2026},
  eprint = {2609.14631},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.14631},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2607.19855,
  title = {{Adversarial Frontiers: Minimum-Norm Attack Ensembles for Robustness Evaluation}},
  author = {Luca Scionis and Luca Melis and Maura Pintor and Fabio Brau and Ambra Demontis and Giorgio Fumera and Fabio Roli and Battista Biggio},
  year = {2026},
  eprint = {2607.19855},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.19855},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2609.24986,
  title = {{Who Does What in AI Auditing? Designing Human-AI Collaboration for Auditing Generative AI}},
  author = {Eunkyu Park and Markelle Roesti and Wesley Hanwen Deng and Renata Barreto and Mohammad Tahaei and Kenneth Holstein and Jason Hong and Motahhare Eslami},
  year = {2026},
  eprint = {2609.24986},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.24986},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2607.28568,
  title = {{Frontis-MA1: Training an AI4AI Model towards Recursive Self-Improvement in Machine Learning Engineering}},
  author = {Junlin Yang and Che Jiang and Yu Fu and Tianwei Luo and Can Ren and Weizhi Wang and Kaikai Zhao and Hongyi Liu and Yuxin Zuo and Yuru Wang and Yuchen Fan and Kai Tian and Zhenzhao Yuan and Xiaojian Lin and Li Sheng and Rushi Qiang and Guoli Jia and Xi},
  year = {2026},
  eprint = {2607.28568},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.28568},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2609.35312,
  title = {{MemoReason: Evaluating the Effect of Parametric Memory on Contextual Reasoning in LLMs}},
  author = {Unknown},
  year = {2026},
  eprint = {2609.35312},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.35312},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2610.01539,
  title = {{The AI Assessment Sandbox Configurator: A Framework to Support Technical Assessment in AI Regulatory Sandboxes}},
  author = {Alessio Buscemi},
  year = {2026},
  eprint = {2610.01539},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.01539},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2609.39450,
  title = {{ActionGuard: Tool Call Authorization under Poisoned Skills}},
  author = {Jihun Han and Yejin Jang and Byung Il Kwak and Mee Lan Han},
  year = {2026},
  eprint = {2609.39450},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.39450},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2610.00715,
  title = {{Robust Nash Alignment under Preference Uncertainty}},
  author = {Shihab Ahmed and Debamita Ghosh and David Tang and Yudan Wang and Alvaro Velasquez and Yue Wang},
  year = {2026},
  eprint = {2610.00715},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.00715},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2609.06140,
  title = {{Counter-Swarm Doctrine: Containing Coordinated Agent Intrusions}},
  author = {Gregory N Frank},
  year = {2026},
  eprint = {2609.06140},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.06140},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2607.14532,
  title = {{Probabilistic "Copies" in Generative AI Models}},
  author = {Mark A. Lemley and A. Feder Cooper},
  year = {2026},
  eprint = {2607.14532},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.14532},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2609.38093,
  title = {{Character Training for Risk-Averse Agents}},
  author = {Unknown},
  year = {2026},
  eprint = {2609.38093},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.38093},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2609.16260,
  title = {{Mapping U.S. Federal AI Governance Against Sector Vulnerability}},
  author = {Ho Ting Hung and Angelica Chowdhury and James Teague and Simon Mylius and Spencer Michaels and Peter Slattery and Alexander Saeri and Neil Thompson},
  year = {2026},
  eprint = {2609.16260},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.16260},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2608.07346,
  title = {{\$A^2E\$ : An End-to-End Agent Auditing Engine}},
  author = {Haoning Wang and Mingxun Zhang and Chenyue Yu and Yingjun Shang and Xing Xie and Xia Hu and Guanchu Wang and Na Zou},
  year = {2026},
  eprint = {2608.07346},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.07346},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2609.35366,
  title = {{Planarian: Managing Agent State with Statepoints}},
  author = {Jinnan Guo and Hao Mark Chen and Kapil Vaswani and Andrew Paverd and Peter Pietzuch},
  year = {2026},
  eprint = {2609.35366},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.35366},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2609.29647,
  title = {{AgentKernel: The Trust-Native Agentic Operating System}},
  author = {Zhenhua Zou and Sheng Guo and Qiuyang Zhan and Lepeng Zhao and Shuo Li and Zhuotao Liu},
  year = {2026},
  eprint = {2609.29647},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.29647},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2610.00371,
  title = {{Deny Without Disabling: Authorization-Paired Evaluation and Control for Multi-Agent Systems}},
  author = {Yunbei Zhang and Saiyue Lyu and Janet Wang and Yingqiang Ge and Jiang Guo and Jihun Hamm and Chandan K Reddy},
  year = {2026},
  eprint = {2610.00371},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.00371},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2607.21317,
  title = {{Open Veins of Algorithmic Auditing: Why AI Assessment Lags Behind Its Deployment in the Global South}},
  author = {Gemma Galdon Clavell and Alexandra Magaard},
  year = {2026},
  eprint = {2607.21317},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.21317},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2607.29190,
  title = {{CAGE: Certified Authorization under Typed-Return Uncertainty for Tool-Using Agents}},
  author = {Blaise Delattre and Cong Wang and Yang Cao},
  year = {2026},
  eprint = {2607.29190},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.29190},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2607.05163,
  title = {{Open Problems in AI Incident Governance}},
  author = {Harleen Kaur Sidhu; Rebecca Scholefield; Nour Annan; Kevin Hernandez; Isabel Nieh Hou; Abdulrahman Alshaikhi; Ze Shen Chin; Rokas Gipiškis},
  year = {2026},
  eprint = {2607.05163},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.05163},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2609.04665,
  title = {{Harness-agnostic detection and immunization of reward hacking in self-evolving language models}},
  author = {Rongxin Yang and Yang Liu and Shang Luo and Haoxuan Jia and Chongyang Zhang and Hao Zheng and Yingguang Yang and Yulin Huang and Jianshen Zhang and Yongzhi Qi and Kefu Xu and Congjing Ran and Bin Chong},
  year = {2026},
  eprint = {2609.04665},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.04665},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2607.27499,
  title = {{A dataset of rated conceptual arguments}},
  author = {Emery Cooper and Caspar Oesterheld and Linh Chi Nguyen and Alexander Kastner and Ethan Perez},
  year = {2026},
  eprint = {2607.27499},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.27499},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2609.28137,
  title = {{"We'll Fix It Later": Education, AI, and the Deferral of Privacy in EdTech}},
  author = {Meghna Manoj Nair and Rachel Greenstadt},
  year = {2026},
  eprint = {2609.28137},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.28137},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2609.36054,
  title = {{What if automating AI R\&D triggers an intelligence explosion?}},
  author = {Alan Chan and Christoph Winter and Andrew Barto and Jakub Pachocki and Geoffrey Hinton and Eric Horvitz and Yoshua Bengio and Dawn Song and Jack Clark and Hilary Greaves and Anton Korinek and Samuel Hammond and Thore Graepel and Ben Bariac},
  year = {2026},
  eprint = {2609.36054},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.36054},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2609.40360,
  title = {{Semifactual Credit-Augmented Policy Optimization}},
  author = {Junshu Pan and Zhizhang Fu and Shulin Huang and Yiran Ding and Zifan Cheng and Wenqi Shao and Qiaosheng Zhang and Yue Zhang},
  year = {2026},
  eprint = {2609.40360},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.40360},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2608.04830,
  title = {{ContextWeave: A Real-World Workflow Benchmark}},
  author = {Bo Wang and Yuqian Yao and Enxi Wang and Luozhijie Jin and Yang Liu and Yiran Suo and Yuxuan Cai and Enyu Zhou and Yufei Gao and Honglin Guo and Tianyu Huai and Li Ji and Zhikai Lei and Bufan Li and Lizhi Lin and Jinxiu Liu and Jie Yang and Jiazheng Z},
  year = {2026},
  eprint = {2608.04830},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.04830},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2608.14380,
  title = {{AgentRewind: Recoverable Execution for Long-Horizon LLM Agents}},
  author = {Yu Zhuang and Kefei Chen and Yitong Duan and Shuxin Zheng and Jian Li and Xu-Yao Zhang},
  year = {2026},
  eprint = {2608.14380},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.14380},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2609.35557,
  title = {{The Compiler May Read It, the Agent May Not: Keeping Part of a Research Code Away from a Coding Agent}},
  author = {Shobhan Roy},
  year = {2026},
  eprint = {2609.35557},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.35557},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2607.13716,
  title = {{CAVA: Canonical Action Verification and Attestation for Runtime Governance of Agentic AI Systems}},
  author = {Zexun Wang},
  year = {2026},
  eprint = {2607.13716},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.13716},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2609.20720,
  title = {{What Parents Can See: Divergent Accounts of Youth AI Companion Use in Parenting and Teenager Subreddits}},
  author = {Thomas Berkane and Anne Bischops and Anika Mellacheruvu and Maimuna Majumder},
  year = {2026},
  eprint = {2609.20720},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.20720},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2608.10502,
  title = {{From Faulty Memories to Corrected Actions: Dependency-Guided Rollback Repair for Memory-Augmented Agents}},
  author = {Caili Yu; Yiqi Wang; Jiaqi Zhang; Yiqun Duan; Mingkai Zheng; Zhangkai Wu; Kaize Shi; Taotao Cai},
  year = {2026},
  eprint = {2608.10502},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.10502},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2609.34862,
  title = {{JEV as a Judge for Agent Trace Security: An Empirical Comparison with Generative LLM Judges}},
  author = {Zhiqiang Wang and Yichao Gao},
  year = {2026},
  eprint = {2609.34862},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.34862},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2609.21561,
  title = {{On Repulsive and Attractive Teachers: Separating Correctness from Behavior in Self-Distillation}},
  author = {Anton Baumann; Akmal Ashirmatov; Leo Schmidt-Traub; Frederike Lübeck; Jonas Hübotter; Thomas Kleine Buening; Andreas Krause},
  year = {2026},
  eprint = {2609.21561},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.21561},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2609.38106,
  title = {{Pruning for Efficiency, Paying in Fairness: Demographic Disparities in Pruned Speech-LLMs}},
  author = {Ganesh Pavan Kartikeya Bharadwaj Kolluri and Michael Kampouridis and Ravi Shekhar},
  year = {2026},
  eprint = {2609.38106},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.38106},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2607.19913,
  title = {{JANUS: Foreseeing Latent Risk for Long-Horizon Agent Safety}},
  author = {Yuan Xiong and Linji Hao and Shizhu He and Yequan Wang and Lijun Li},
  year = {2026},
  eprint = {2607.19913},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.19913},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2608.14611,
  title = {{The 2026 Singapore Consensus on Global AI Safety Research Priorities}},
  author = {Stephen Casper and Oskar Galeev and Yoshua Bengio and Mohan Kankanhalli and Lee Wan Sie and Tegan Maharaj and Chris Meserole and Luke Ong and Stuart Russell and Dawn Song and Max Tegmark and Brian Tse and Xue Lan and Andrew Yao and Zhang Ya-Q},
  year = {2026},
  eprint = {2608.14611},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.14611},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2609.40034,
  title = {{Efficient Active Auditing of Multi-Group Fairness with Bias Probes}},
  author = {Ayoub Ajarra and Debabrota Basu},
  year = {2026},
  eprint = {2609.40034},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.40034},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2608.27924,
  title = {{What Makes Agent Memory Useful for Reliable Unanswerable Question Handling?}},
  author = {Chuanyuan Tan and Junjie Yu and Yuxin Wang and Yining Zheng and Xipeng Qiu and Wenliang Chen},
  year = {2026},
  eprint = {2608.27924},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.27924},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2609.39537,
  title = {{A Reusable Semantic Web Framework for Evidence-Grounded Fundamental Rights Impact Assessments under the EU AI Act}},
  author = {Faith Olopade and Delaram Golpayegani and David Lewis},
  year = {2026},
  eprint = {2609.39537},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.39537},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2607.18459,
  title = {{Intelligent Cause Prioritisation? An Analysis of AI Policy Priorities and Governance in Africa}},
  author = {Osaremen Iluobe and Kisso Selvan},
  year = {2026},
  eprint = {2607.18459},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.18459},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2609.16694,
  title = {{Toward Secure AI-Powered Penetration Testing Agents: Security Threats, Guardrails, and Architectural Perspectives}},
  author = {Rahul Dev T Y and Hiran V Nath},
  year = {2026},
  eprint = {2609.16694},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.16694},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2609.35266,
  title = {{Continuous Assurance of Agentic Security Auditors for Software Delivery Decision Gates}},
  author = {Guy Lupo and Nguyen Hung Nguyen and Viet Vo and M. A. P. Chamikara and Guangdong Bai and Nazatul Haque Sultan and Alsharif Abuadbba},
  year = {2026},
  eprint = {2609.35266},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.35266},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2608.12863,
  title = {{AI and Consumer Rights in India Working Paper}},
  author = {Omir Kumar and Sriya Sridhar and Vibhav Mithal and Balaraman Ravindran},
  year = {2026},
  eprint = {2608.12863},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.12863},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2609.22206,
  title = {{Dissecting Training-Free Uncertainty Estimation in Multimodal Large Language Models}},
  author = {Soroush Seifi and Vaggelis Dorovatas and Lin Li and Yarin Gal and Rahaf Aljundi},
  year = {2026},
  eprint = {2609.22206},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.22206},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2610.02005,
  title = {{Counting Moves, Weighing Voices: Bayesian Dialectical Argumentation for Calibrated Multi-LLM Councils under Persistent Adversaries}},
  author = {Ionel Eduard Stan and Paolo Napoletano},
  year = {2026},
  eprint = {2610.02005},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.02005},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2608.21326,
  title = {{Invisible Agents, Uninformed Patients: Towards Responsible Deployment Of Autonomous AI Diagnostic Agents In Sub-Saharan Africa}},
  author = {Percy Brown and Kweku Yamoah},
  year = {2026},
  eprint = {2608.21326},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.21326},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2608.02110,
  title = {{IACM-RL: Intent-Aware Context Management and Reinforcement Learning for Complex Tool Invocation under Dynamic Intent Fluctuations}},
  author = {Dingwei Zhu and Jiahan Li and Chengjun Pan and Yunxian Yang and Yunbin Zhao and Yunke Zhang and Zhonghang Lu and Zhuohui Sheng and Chenhao Huang and Jiahang Lin and Yajie Yang and Junlin Shang and Shichun Liu and Yuhui Wang and Honglin Guo and J},
  year = {2026},
  eprint = {2608.02110},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.02110},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2610.01005,
  title = {{Tolerance-Based Fairness Auditing: Violation Certification and Sensitivity Screening}},
  author = {Jie Tang and Chuanlong Xie and Lixing Zhu},
  year = {2026},
  eprint = {2610.01005},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.01005},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2609.10992,
  title = {{Demystifying the Privacy-Utility Trade-off in LLM Interactions}},
  author = {Zhenhua Liu and Zhanxu Xie and Junjie Yu and Tong Zhu and Lijun Li and Wenliang Chen},
  year = {2026},
  eprint = {2609.10992},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.10992},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2607.24177,
  title = {{EXE-Bench: Ranking the Tradeoffs of AI-based Windows Malware Detectors for Real-World Usability}},
  author = {Andrea Ponte and Daniel Gibert and Matous Kozak and Dmitrijs Trizna and Maura Pintor and Battista Biggio and Fabio Roli and Luca Demetrio},
  year = {2026},
  eprint = {2607.24177},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.24177},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2609.32030,
  title = {{Who Governs Data in the AI Era? A Computational Analysis of the U.S. Privacy Workforce in Job Postings}},
  author = {Ramazan Yener and Muhammad Hassan and Masooda Bashir},
  year = {2026},
  eprint = {2609.32030},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.32030},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2609.39025,
  title = {{A Rank Graduation metric for Algorithmic fairness}},
  author = {Dalia Atif and Paolo Giudici},
  year = {2026},
  eprint = {2609.39025},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.39025},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2608.15304,
  title = {{Understanding Cognition-Induced Risks in Agentic AI Systems}},
  author = {Guanchu Wang and Qinuo Li and Mengnan Du and Xia Hu and Bowen Zhou},
  year = {2026},
  eprint = {2608.15304},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.15304},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2608.14632,
  title = {{DeMTS: Denoising Trajectories as Multivariate Time Series for Hallucination Detection in Diffusion Language Models}},
  author = {Xin Zhang and Yili Wang and Yue Tan and Xin He and Yanyu Qian and Yixin Liu and Yi Chang and Shirui Pan and Xin Wang},
  year = {2026},
  eprint = {2608.14632},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.14632},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2609.10630,
  title = {{AI Safety: Not Optional, Not Later}},
  author = {Qinghua Lu and Yoshua Bengio},
  year = {2026},
  eprint = {2609.10630},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.10630},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2610.01495,
  title = {{Auditing Routing Entropy as an Uncertainty Signal in Attention-Residual Transformers}},
  author = {Wenhao Liang and Lin Yue and Wei Emma Zhang and Mingyu Guo and Olaf Maennel and Weitong Chen},
  year = {2026},
  eprint = {2610.01495},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.01495},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2607.24017,
  title = {{Disentangling Semantic Attention from Structural Bias in the Attention Manifold}},
  author = {Pengkun Jiao and Bin Zhu and Jingjing Chen and Yu-gang Jiang},
  year = {2026},
  eprint = {2607.24017},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.24017},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2609.08394,
  title = {{Windows Malware Detector as a Compound AI System: Trade-Offs in Accuracy, Efficiency, and Adversarial Robustness}},
  author = {Andrea Ponte and Luca Demetrio and Luca Oneto and Battista Biggio and Fabio Roli},
  year = {2026},
  eprint = {2609.08394},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.08394},
  note = {AI Safety HOT 2026-10-04}
}

@misc{arxiv2608.03642,
  title = {{Empirical Analysis of Evasion and Poisoning Against Malware Data Drift Detection}},
  author = {Mingyue Yang and David Lie and Nicolas Papernot},
  year = {2026},
  eprint = {2608.03642},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.03642},
  note = {AI Safety HOT 2026-10-04}
}