@misc{arxiv2609.18217,
  title = {{Measuring and Exploiting Implicit Trust in LLM Tool-Calling Pipelines}},
  author = {Murali Ediga},
  year = {2026},
  eprint = {2609.18217},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.18217},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2610.03448,
  title = {{Passing the Test You Trained On: Re-evaluating Prompt-Injection Detectors for LLM Agents}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.03448},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.03448},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2609.26761,
  title = {{A2M: Trace-Optimized Agent Hijacking in the MCP Ecosystem}},
  author = {Laizhen Li and Xuan Wang and Peicheng Zhao and Juanjuan Zhao and Kejiang Ye and Cheng-zhong Xu and Xitong Gao},
  year = {2026},
  eprint = {2609.26761},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.26761},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2609.39607,
  title = {{Pretext: Defeating Malicious Skill Detection Frameworks for AI Agents}},
  author = {Tobias Kaisar and Aritra Dhar},
  year = {2026},
  eprint = {2609.39607},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.39607},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2609.39065,
  title = {{Can Agents Trust Their Skills? Uncovering Unsafe Chains of Trust in Skill-Based LLM Agents}},
  author = {Yan Wang and Zhihao Zhang and Ke Chen and Kai Chen and Yaqin Zhang and Duohe Ma and Jun Dai and Xiaoyan Sun},
  year = {2026},
  eprint = {2609.39065},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.39065},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2609.38983,
  title = {{Approval Laundering: Systematizing Approval--Execution Binding Failures in AI Coding-Agent Harnesses}},
  author = {Yang Wang},
  year = {2026},
  eprint = {2609.38983},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.38983},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2610.01564,
  title = {{Chaining Skills to Hijack LLM Agents}},
  author = {Dong and Tian and Ma and Zixuan and Zhao and Haodong and Zhang and Huaien and Li and Shaofeng and Chen and Hao},
  year = {2026},
  eprint = {2610.01564},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.01564},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2610.00568,
  title = {{Emergent Unfaithfulness: How Alignment Training Causes Language Models to Silently Override Task Faithfulness}},
  author = {Pardis Sadat Zahraei and Janvijay Singh and Gokhan Tur and Dilek Hakkani-Tur},
  year = {2026},
  eprint = {2610.00568},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.00568},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2609.39050,
  title = {{Covert Assistance: Helpful LLM Agents Evade Oversight in Multi-Agent Systems}},
  author = {Unknown},
  year = {2026},
  eprint = {2609.39050},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.39050},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2610.03055,
  title = {{hacktrace: behavior-supervised detection of reward hacking during code generation}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.03055},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.03055},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2609.12001,
  title = {{Scan the Skill, Govern the Action: Composing Registry Verdicts with Runtime Consequence Control}},
  author = {Rohit Taneja},
  year = {2026},
  eprint = {2609.12001},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.12001},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2609.09404,
  title = {{An Experimental Evaluation of Multimodal Prompt Injection Attacks on Agentic AI Frameworks}},
  author = {Nguyen and Viet K. and Husain and Mohammad I.},
  year = {2026},
  eprint = {2609.09404},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.09404},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2610.02702,
  title = {{Silent Dissent: LLM Agents That Yield to the Majority Still Represent Their Original Premise}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.02702},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.02702},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2609.33039,
  title = {{Agent Safety From Within: Detecting Harmful Trajectories from LLM Internal States}},
  author = {Jiao and Difan and Anderson and Ashton},
  year = {2026},
  eprint = {2609.33039},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.33039},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2610.03585,
  title = {{Threat-Preserving Representation Sensitivity in Agent-Security Benchmarks}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.03585},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.03585},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2610.01365,
  title = {{Sleeping Secrets: How Fine-Tuning Reawakens Privacy Risks in Language Models}},
  author = {Jianhong Li and Jiahao Chen and Yuwen Pu and Chunyi Zhou and Oubo Ma and Zhou Feng and Hangtao Zhang and Jichao Bi and Chunqiang Hu},
  year = {2026},
  eprint = {2610.01365},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.01365},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2610.03089,
  title = {{Securing Computer-Use Agents Against Branch Steering Attacks}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.03089},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.03089},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2610.03153,
  title = {{EvoRiskBench: An Evolving Benchmark for Runtime Security Risks in Workspace Agents}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.03153},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.03153},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2610.02827,
  title = {{MLCommons Jailbreak Benchmark v1.0}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.02827},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.02827},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2610.03458,
  title = {{A Near-Zero Monitor Readout Is Not Evidence of Behavioral Control}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.03458},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.03458},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2610.02664,
  title = {{A GHOST in Long-Horizon Agents: Governance Hazard from Overlooked Safety Constraints across Turns}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.02664},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.02664},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2610.03185,
  title = {{Gains and Collapse in On-Policy Distillation:A Reinforcement Learning Perspective}},
  author = {Han Cui and Jianhao Yan and Yun Luo and Hongbo Zhang and Zhizhang Fu and Yue Zhang},
  year = {2026},
  eprint = {2610.03185},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.03185},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2610.03502,
  title = {{Certified Mechanistic Edits: Behavioral Guarantees for Skill Removal and Preservation}},
  author = {Md Sazid Uddin and Md. Khairul Alam Mazumder and M. F. Mridha},
  year = {2026},
  eprint = {2610.03502},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.03502},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2610.02886,
  title = {{Misinformation Without Triggers: From Factual Answers to Downstream Decisions}},
  author = {Lin Tian and Marian-Andrei Rizoiu},
  year = {2026},
  eprint = {2610.02886},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.02886},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2610.02373,
  title = {{HDI: GraphRAG auxiliary schema poisoning}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.02373},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.02373},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2610.01871,
  title = {{Walking the Embedding Space: Datastore Extraction from Multimodal RAG}},
  author = {Jica and Maria Carmen and Satvaty and Ali and Verberne and Suzan and Turkmen and Fatih},
  year = {2026},
  eprint = {2610.01871},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.01871},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2610.00320,
  title = {{Refusal Localizes, the Damage Relocates: Safety Layers Under Few-Sample Fine-Tuning}},
  author = {Jungseob Lee and Dongyub Jude Lee and Sugyeong Eo and Seongtae Hong and Seungyoon Lee and Heuiseok Lim},
  year = {2026},
  eprint = {2610.00320},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.00320},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2610.02588,
  title = {{Open-Endedness Bench: Measuring Epistemic Process from Agent Records}},
  author = {Chengyang Shi and Xianglin Ji and Jintao Huang and Jicheng Wang and Yifeng He and Jiachen Liu},
  year = {2026},
  eprint = {2610.02588},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.02588},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2606.09084,
  title = {{Context-Fractured Decomposition Attacks on Tool-Using LLM Agents: Exploiting Artifact Provenance Gaps}},
  author = {Lin and Xiaofeng and Yang and Yukai and Guo and Daniel and Nale and Sahil Arun and Fleming and Charles and Cheng and Guang},
  year = {2026},
  eprint = {2606.09084},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.09084},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2610.01995,
  title = {{Can AI Oversight Be Zero Knowledge?}},
  author = {Alessandro Chiesa and Ziyi Guan and Burcu Yildiz},
  year = {2026},
  eprint = {2610.01995},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.01995},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2605.30883,
  title = {{TRACE: Task-Aware Adaptive Self-Evolving Agentic Jailbreaking}},
  author = {Zeng and Churui and Xiu and Kedong and Qi and Weiwei and Hao and Yuqi and Lu and Chaochao and He and Liang and Qin and Zhan and Zheng and Tianhang},
  year = {2026},
  eprint = {2605.30883},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.30883},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2610.03014,
  title = {{Beyond Predefined Sinks: Security-Aware Dependency Analysis for LLM Agents}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.03014},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.03014},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2610.02413,
  title = {{Prompted to Discriminate: Generalizing Malicious-Input Probes in the Wild}},
  author = {Elad David and Max Fomin},
  year = {2026},
  eprint = {2610.02413},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.02413},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2610.02432,
  title = {{Evaluating and Improving the Robustness of Large Language Models to Input Sequence Variations}},
  author = {Narek Maloyan},
  year = {2026},
  eprint = {2610.02432},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.02432},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2610.03430,
  title = {{JIL: Adversarial Manipulation of LLM Request Scheduling}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.03430},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.03430},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2609.39352,
  title = {{Hiding in Plain Sight: Decoupling Pretext from Actuation for Skill Poisoning in LLM Agents}},
  author = {Wenxin Wu and Lingyong Yan and Lei Sha and Shuaiqiang Wang and Jiashu Zhao},
  year = {2026},
  eprint = {2609.39352},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.39352},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2610.03124,
  title = {{The Fragility of Trigger-Tag Mechanisms for Misuse Detection in Open-Weight LLMs}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.03124},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.03124},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2610.02986,
  title = {{OLMo-Detect: A Multi-Stage Confounder-Controlled Benchmark for Membership Inference on LLMs}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.02986},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.02986},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2610.02910,
  title = {{Frequency Is Not Sensitivity: Identifying Safety-Sensitive Experts in Sparse MoE LLM}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.02910},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.02910},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2609.02095,
  title = {{READY or Not: Reliable Enterprise Agent Deployment}},
  author = {Veronica Chatrath},
  year = {2026},
  eprint = {2609.02095},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.02095},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2610.01508,
  title = {{OverAct: Measuring and Mitigating Proactive Over-Authorization in LLM Tool-Calling Agents}},
  author = {Zhang and Taolin and Wan and Jiuheng and Wang and Hanyu and Hu and Tingyuan and Wang and Chengyu},
  year = {2026},
  eprint = {2610.01508},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.01508},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2610.03195,
  title = {{Source Preference in the Wild: How LLM Agents Favor Items by Source, and How to Reduce It}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.03195},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.03195},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2610.03509,
  title = {{Efficient Reasoning Training Does Not Always Harm CoT Faithfulness and Monitorability}},
  author = {Samuel Lewis-Lim and Xingwei Tan and Mario Sanger and Zhixue Zhao and Nikolaos Aletras},
  year = {2026},
  eprint = {2610.03509},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.03509},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2610.02303,
  title = {{PowerBench: Measuring Language Model Bias in Power-shifting Requests}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.02303},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.02303},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2610.03095,
  title = {{Peer Influence across Heterogeneous AI Models}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.03095},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.03095},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2610.02568,
  title = {{Mitigating Social Sycophancy via Pluralistic Preference Optimization}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.02568},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.02568},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2610.00972,
  title = {{VeriHarness: Scaling Agentic Verification for Long-Horizon Tasks}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.00972},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.00972},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2610.03470,
  title = {{CorrectGuard: Eyes-Off Correctness Estimation for Black-Box Security Guardrails}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.03470},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.03470},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2610.02349,
  title = {{MIRROR: Quorum-Based Integrity for Multi-Agent Communications}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.02349},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.02349},
  note = {AI Safety HOT 2026-10-05}
}

@misc{aisafetyhot-pgo2h25ajp1foz4fqqrdpblha,
  title = {{Artificial Intelligence–Associated Psychosis}},
  author = {Jamie Harbourd and Suresh Yadav and Kagan Temur and Sandeep Grover},
  url = {https://psychiatrist.com/pcc/artificial-intelligence-associated-psychosis},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2610.01490,
  title = {{The Persona Is Still There, but Who Is Speaking? Latent Identity Reversion in Persistent AI Agents}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.01490},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.01490},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2610.02829,
  title = {{Clinical Concept Centers in LLMs}},
  author = {Aishik Nagar and Abhishek Vaidyanathan and Arun-Kumar Kaliya-Perumal and Elijah Tzen Hsuen Boey and Stefan Winkler},
  year = {2026},
  eprint = {2610.02829},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.02829},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2610.02741,
  title = {{On the Chain-of-Thought Monitorability of Looped Language Models}},
  author = {Han Wang and Ishwar B Balappanawar and Huan Zhang},
  year = {2026},
  eprint = {2610.02741},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.02741},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2610.02418,
  title = {{Mitigating Private Data Leakage in LLMs with Whiteout}},
  author = {Anna Yoo Jeong Ha and Ronik Bhaskar and Haitao Zheng and Ben Y. Zhao},
  year = {2026},
  eprint = {2610.02418},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.02418},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2610.02869,
  title = {{AgentTrap: Stateful Feedback Deception against Autonomous Penetration Testing Agents}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.02869},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.02869},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2610.02569,
  title = {{Pincer: Resource Authorization for Agents using a Digital Twin}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.02569},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.02569},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2610.02874,
  title = {{SceneFactory-3D: Lifting 2D Traffic Scenes into 3D Physical Counterfactuals for Scalable Physically Grounded Safety Evaluation}},
  author = {Yicheng Zhu and Linfeng Tian and Tianmu Zhao and Yang Chen and Fan Zuo and Tao Li and Zilin Bian},
  year = {2026},
  eprint = {2610.02874},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.02874},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2610.02928,
  title = {{Discriminating Fixture Coverage in Agent-Infrastructure Verification Suites}},
  author = {Xin Xu and Siru Tao},
  year = {2026},
  eprint = {2610.02928},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.02928},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2610.02302,
  title = {{Intent-Hiding Jailbreaks: An Information-Theoretic Framework for Compositional Attacks}},
  author = {Fengwei Tian and Ravi Tandon},
  year = {2026},
  eprint = {2610.02302},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.02302},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2610.02861,
  title = {{Containing the Autonomous Operator: A Defense-in-Depth Framework and Reference Architecture for Securing AI Agents on Kubernetes}},
  author = {Simhadri Podala Narasimha},
  year = {2026},
  eprint = {2610.02861},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.02861},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2610.02853,
  title = {{Bounded Reachability \& Jailbreak Detection via Contraction-Constrained State Space Models}},
  author = {Omanshu Thapliyal},
  year = {2026},
  eprint = {2610.02853},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.02853},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2610.02920,
  title = {{HASTE: Evolving Agent Harnesses Against Emerging Attacks Using Sparse Evidence}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.02920},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.02920},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2610.02557,
  title = {{How to Have a Sensitive Debate: An Instance-Optimal Protocol for AI Debate}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.02557},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.02557},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2610.02268,
  title = {{From Mathematical to Executable Certificates for Machine Unlearning}},
  author = {Ziyu Zhao and Xinyu Wang and Xiaowen Chang and Yixuan He},
  year = {2026},
  eprint = {2610.02268},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.02268},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2610.01170,
  title = {{HeadEdit: Calibrating Language Model Behavior Through the Frozen Unembedding Matrix}},
  author = {Zirui He and Haiyan Zhao and Jingyu Hu and Yinghao Wu and Chenxi Yuan and Yingcong Li and Yandong Bai and Mengnan Du},
  year = {2026},
  eprint = {2610.01170},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.01170},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2610.03093,
  title = {{LS-AR: Future-Predictive Latent Steering in Autoregressive LLMs}},
  author = {Anubha Gupta and Eduardo Pignatelli},
  year = {2026},
  eprint = {2610.03093},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.03093},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2610.03166,
  title = {{LiBRA: Detection-Aware Image Watermark Removal via Bidirectional Latent Optimization}},
  author = {Saibo Ye and Huajie Chen and Xin Guo and Le Yang and Chi Liu and Xiangyu Hu and Jingjing Guo and Tianqing Zhu},
  year = {2026},
  eprint = {2610.03166},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.03166},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2610.02281,
  title = {{AI Risk Observatory: AI risk disclosure in UK annual reports}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.02281},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.02281},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2608.26762,
  title = {{Equal Ranking Quality, Different Decisions: Measuring and Reducing Order Dependence in LLM Scorers}},
  author = {Unknown},
  year = {2026},
  eprint = {2608.26762},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.26762},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2610.00902,
  title = {{Mean field games as a tool for AI safety: a worked example from the July 2026 Hugging Face incident}},
  author = {Graber and P. Jameson},
  year = {2026},
  eprint = {2610.00902},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.00902},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2610.02824,
  title = {{MetaRubric: Learning to Reward for Rubric-Based Reinforcement Learning}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.02824},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.02824},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2610.03033,
  title = {{Numerical signalling and coordination among LLM agents}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.03033},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.03033},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2610.02662,
  title = {{Mind the Refinement Gap: When Safe High-Level Robot Plans Produce Unsafe Executions}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.02662},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.02662},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2609.15802,
  title = {{The Economics of Recursive Self-Improvement}},
  author = {Tom Cunningham},
  year = {2026},
  eprint = {2609.15802},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.15802},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2610.02456,
  title = {{SideKernel: A Usable microVM Sandbox for AI Coding Agents on macOS}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.02456},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.02456},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2610.02781,
  title = {{OPD Before RL: Warm-Starting Rubric-Based RL with On-Policy Distillation}},
  author = {Xinpeng Wang and Wei Shi and Yu-Chia Chen and Maria Zontak and Yun He and Richard Yuanzhe Pang},
  year = {2026},
  eprint = {2610.02781},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.02781},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2610.03574,
  title = {{HyperBrowseComp: A Multilingual and Multimodal Stress Test for Web-Browsing Agents}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.03574},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.03574},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2610.02817,
  title = {{RMCW: A Deletion-Robust Watermark Based on Reed--Muller Codes for Language Models}},
  author = {Yi Wang and Baicheng Chen and Yu Wang and Jian Zhao and Yilei Chen and Tianxing He},
  year = {2026},
  eprint = {2610.02817},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.02817},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2610.03196,
  title = {{Beyond Reward Hacking: Proxy Divergence Across Four Layers of a Staged Humanoid Learning Pipeline}},
  author = {Arunabh Bora},
  year = {2026},
  eprint = {2610.03196},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.03196},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2610.02841,
  title = {{How Robust Is Multimodal Claim Verification to LLM Rewriting?}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.02841},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.02841},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2610.02844,
  title = {{DNAlign: Dynamic Null-Space Safe Alignment for LLMs}},
  author = {Jisheng Dang and Yushuo Zhao and Dewei Liu and Junfeng Fang and Bimei Wang and Tiantian Rao and Hong Peng and Bin Hu and Tat-Seng Chua},
  year = {2026},
  eprint = {2610.02844},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.02844},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2610.03073,
  title = {{SecJev: Bringing Security Expertise to System One Decision Models}},
  author = {Zheng Chen and Fei Yu and Haohao Huang and Yang Li and Anlong Chen and Lei Chen},
  year = {2026},
  eprint = {2610.03073},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.03073},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2610.02293,
  title = {{HakemBench: A Turkish Benchmark of Typed Decisions}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.02293},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.02293},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2609.34519,
  title = {{EOPSA: Efficient On-Policy Self-Distilled Safety Alignment}},
  author = {Qirui Liu},
  year = {2026},
  eprint = {2609.34519},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.34519},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2609.05947,
  title = {{Beyond Final Decisions: A Process-Centric Benchmark for Transparent AI-Assisted Peer Review}},
  author = {Siming Yuan},
  year = {2026},
  eprint = {2609.05947},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.05947},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2610.03498,
  title = {{Detect and Suppress: A Mechanistic Defense against Adversarial Patches in VLA Models}},
  author = {Yukiya Horiba and Koshiro Aoki and Shunsuke Yasuki and Bum Jun Kim and Taiki Miyanishi},
  year = {2026},
  eprint = {2610.03498},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.03498},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2609.39820,
  title = {{Learning from Runtime Feedback through Failure-Bank Self-Evolution for Vision-Language-Action Models}},
  author = {Unknown},
  year = {2026},
  eprint = {2609.39820},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.39820},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2610.03315,
  title = {{Lightweight, Rubric-Guided Trajectory Evaluation for Production AI Agents}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.03315},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.03315},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2610.02391,
  title = {{Hesitation Has a Geometry: Entropy-Trained Hyperbolic Probes for Sparse Activation Steering}},
  author = {Zeyong Zhang and Tung Sum Thomas Kwok and Tengfei Ma and Mengjia Xu},
  year = {2026},
  eprint = {2610.02391},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.02391},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2610.02126,
  title = {{Local Support Learning}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.02126},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.02126},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2610.03240,
  title = {{Collective Bias Mitigation via Model Routing and Collaboration}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.03240},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.03240},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2610.03434,
  title = {{Persona Guardrail: A Production-Grade Defense Framework for Agentic Systems}},
  author = {Bijeeta Pal and Sridhar Reddy Maddireddy and Muhaimin Bin Munir and Zoltan Puha and Max Zhurovich and Adi Raghavendra and Sean Tout},
  year = {2026},
  eprint = {2610.03434},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.03434},
  note = {AI Safety HOT 2026-10-05}
}

@misc{aisafetyhot-aoa3ogbs9h1ksw5i3ixa1md2j,
  title = {{MiMo-V2.6: Scaling Reinforcement Learning Towards Self-Improvement}},
  author = {LLM-Core Xiaomi},
  year = {2026},
  url = {https://huggingface.co/XiaomiMiMo/MiMo-V2.6-Pro-RL/blob/main/MiMo_V2_6_technical_report.pdf},
  note = {AI Safety HOT 2026-10-05}
}

@misc{aisafetyhot-eh7tflo2dbmkv0fb9t5zx9h6c,
  title = {{Aleph Alpha发布德英双语开放权重模型Kolibri}},
  author = {Unknown},
  url = {https://huggingface.co/Aleph-Alpha/Kolibri-1},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2610.03163,
  title = {{Predicting Steering Vectors and Adapter Weights for Few-Shot Author-Style Transfer}},
  author = {Leonard Popp and Danni Liu and Supriti Sinhamahapatra and Jan Niehues},
  year = {2026},
  eprint = {2610.03163},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.03163},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2610.03389,
  title = {{From Patching to Pruning Visual Computation in Vision Language Models}},
  author = {Rahul Chowdhury and Timothy A Rupprecht and Xuan Shen and Shaoyi Huang and Pu Zhao and Yanzhi Wang},
  year = {2026},
  eprint = {2610.03389},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.03389},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2610.03698,
  title = {{Decoding the Functional Roles of Register and High-Norm Patch Tokens in Vision Transformers}},
  author = {Neel Varma and Andrew Rufail and Dipika Khullar and Vasu Sharma},
  year = {2026},
  eprint = {2610.03698},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.03698},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2610.03641,
  title = {{IDRF: Inverse-Distilled Reward Fine-tuning of Masked Discrete Diffusion Models}},
  author = {Vladislav Gromadskii and David Li and Samson Gourevitch and Yazid Janati and Eric Moulines and Maxim Panov and Alexander Korotin},
  year = {2026},
  eprint = {2610.03641},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.03641},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2610.02967,
  title = {{Post-Training Frontier Text-to-Image Models by Composing Preference and Rubric Rewards}},
  author = {Yuanhao Ban and I-Hung Hsu and Anastasios Angelopoulos and Wei-Lin Chiang and Ion Stoica and Cho-Jui Hsieh},
  year = {2026},
  eprint = {2610.02967},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.02967},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2609.31562,
  title = {{Agentic Economies for Autonomous Scientific Discovery}},
  author = {Nenad Tomasev},
  year = {2026},
  eprint = {2609.31562},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.31562},
  note = {AI Safety HOT 2026-10-05}
}

@misc{arxiv2610.02504,
  title = {{HXAI: Hierarchical Privacy-Preserving Explainable AI in Distributed Energy Systems}},
  author = {Poushali Sengupta and Sabita Maharjan and Frank Eliassen and Yan Zhang},
  year = {2026},
  eprint = {2610.02504},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.02504},
  note = {AI Safety HOT 2026-10-05}
}