@misc{arxiv2608.25776,
  title = {{EVOMAL: Self-Poisoning in Self-Evolving Coding Agents}},
  author = {Xiaodong Wu and Yu Shi and Qi Li et al.},
  year = {2026},
  eprint = {2608.25776},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.25776},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2605.18583,
  title = {{Overeager Coding Agents: Measuring Out-of-Scope Actions on Benign Tasks}},
  author = {Yubin Qu and Ying Zhang and Yanjun Zhang et al.},
  year = {2026},
  eprint = {2605.18583},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.18583},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2609.11757,
  title = {{Signing the Transaction but Not the Decision: Whisper Attacks and a Binding Defense for AP2}},
  author = {Unknown},
  year = {2026},
  eprint = {2609.11757},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.11757},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2607.03968,
  title = {{Refused in Chat, Written in Code: Workflow-Level Jailbreak Construction in IDE Coding Agents}},
  author = {Abhishek Kumar and Carsten Maple},
  year = {2026},
  eprint = {2607.03968},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.03968},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2604.14604,
  title = {{Hijacking Large Audio-Language Models via Context-Agnostic and Imperceptible Auditory Prompt Injection}},
  author = {Meng Chen and Kun Wang and Li Lu and Jiaheng Zhang and Tianwei Zhang},
  year = {2026},
  eprint = {2604.14604},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.14604},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2601.02670,
  title = {{Break Me If You Can: Self-Jailbreaking of Aligned LLMs via Lexical Insertion Prompting}},
  author = {Unknown},
  year = {2026},
  eprint = {2601.02670},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2601.02670},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2610.04375,
  title = {{Do Tool Calls Execute as Intended? Measuring and Repairing Intent-Execution Correspondence in LLM Agents}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.04375},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.04375},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2610.09240,
  title = {{Adversarial Images Hijack Web Agents from Visual Grounding to Browser Execution}},
  author = {Wanjing Han and Levi Taiji Li and Mu Zhang and Yue Jiang and Guanhong Tao},
  year = {2026},
  eprint = {2610.09240},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.09240},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2605.01970,
  title = {{Trojan Hippo Bench: A Dynamic Benchmark for Persistent Memory Attacks and Defenses in LLM Agents}},
  author = {Unknown},
  year = {2026},
  eprint = {2605.01970},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.01970},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2609.22076,
  title = {{APort Vault: Benchmarking AI Agent Payment Authorization with the Open Agent Passport}},
  author = {Unknown},
  year = {2026},
  eprint = {2609.22076},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.22076},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2610.08871,
  title = {{CredLeakBench: Evaluating Credential Leakage and Recovery in LLM Agents}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.08871},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.08871},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2606.09700,
  title = {{What the Eyes See, the LLMs Miss: Exploiting Human Perception for Adversarial Text Attacks}},
  author = {Qin Yang and Lu Malloy and Joshua Lee et al.},
  year = {2026},
  eprint = {2606.09700},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.09700},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2605.16626,
  title = {{SLEIGHT-Bench: Finding Blind Spots in AI Monitors}},
  author = {Unknown},
  year = {2026},
  eprint = {2605.16626},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.16626},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2605.12673,
  title = {{Do Androids Dream of Breaking the Game? Systematically Auditing AI Agent Benchmarks with BenchJack}},
  author = {Unknown},
  year = {2026},
  eprint = {2605.12673},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.12673},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2610.05532,
  title = {{DelegationBench: Measuring When AI Agents Should Ask Before Acting}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.05532},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.05532},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2609.27273,
  title = {{CAVEAT: Towards Robust Computer-Use Agents in Incentive-Misaligned Environments}},
  author = {Unknown},
  year = {2026},
  eprint = {2609.27273},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.27273},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2610.07939,
  title = {{CCDF: A Benchmark Dataset for Deepfake Detection in Real-World Surveillance Footage}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.07939},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.07939},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2608.04565,
  title = {{Breadcrumbing Search Agents}},
  author = {Xuebin Li and Hanqing Zhao and Siyuan Liang et al.},
  year = {2026},
  eprint = {2608.04565},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.04565},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2606.14517,
  title = {{From Shield to Target: Denial-of-Service Attacks on LLM-Based Agent Guardrails}},
  author = {Yuguang Zhou and Xunguang Wang and Pingchuan Ma and Zhantong Xue and Zhaoyu Wang and Shuai Wang},
  year = {2026},
  eprint = {2606.14517},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.14517},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2602.10179,
  title = {{When the Prompt Becomes Visual: Vision-Centric Jailbreak Attacks for Large Image Editing Models}},
  author = {Jiacheng Hou and Yining Sun and Ruochong Jin et al.},
  year = {2026},
  eprint = {2602.10179},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2602.10179},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2608.05563,
  title = {{When Experience Becomes Instruction: Trajectory Poisoning in Self-Evolving Agent Skill Systems}},
  author = {Jialuo Chen and Lingqi Jiang and Xinhao Deng et al.},
  year = {2026},
  eprint = {2608.05563},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.05563},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2605.14605,
  title = {{A Few Steps Further: Why Defenses Against Malicious Finetuning Erode Under Continued Training}},
  author = {Itay Zloczower and Eyal Lenga and Gilad Gressel and Yisroel Mirsky},
  year = {2026},
  eprint = {2605.14605},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.14605},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2610.09793,
  title = {{Formal Runtime Verification for Tool-Using LLM Agents: An Offline Same-Benchmark Study on AgentDojo and STAC}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.09793},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.09793},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2602.08877,
  title = {{Stress-Testing Alignment Audits With Prompt-Level Strategic Deception}},
  author = {Oliver Daniels and Perusha Moodley and Benjamin M. Marlin and David Lindner},
  year = {2026},
  eprint = {2602.08877},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2602.08877},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2603.13847,
  title = {{Sirens' Whisper: Inaudible Near-Ultrasonic Jailbreaks of Speech-Driven LLMs}},
  author = {Zijian Ling and Pingyi Hu and Xiuyong Gao et al.},
  year = {2026},
  eprint = {2603.13847},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2603.13847},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2610.09027,
  title = {{Visual Memory Attacks Can Persist Through The KV Cache}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.09027},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.09027},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2604.02623,
  title = {{Poison Once, Exploit Forever: Environment-Injected Memory Poisoning Attacks on Web Agents}},
  author = {Unknown},
  year = {2026},
  eprint = {2604.02623},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.02623},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2607.03220,
  title = {{CONTRA: Red-Teaming Configurations of Personalizable Agents}},
  author = {Jonathan Nöther and Adish Singla and Goran Radanovic},
  year = {2026},
  eprint = {2607.03220},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.03220},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2608.16246,
  title = {{CompoSkill: Compositional Skill Chain Attacks from Individually Scanner-Passing LLM Agent Skills}},
  author = {Mingxiao Liu and Zhoumian Jiang and Jianan Ma et al.},
  year = {2026},
  eprint = {2608.16246},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.16246},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2608.09732,
  title = {{ColluSkill: Adversarial Cross-Skill Composition for Evading Agent Skill Scanners}},
  author = {Puyu Zeng and Simeng Qin and Jingzhi Li and Ju Jia and Zheli Liu and Xiaojun Jia},
  year = {2026},
  eprint = {2608.09732},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.09732},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2610.09517,
  title = {{It Is Not Seeing the Hazard: A Frozen Vision-Language Safety Score Measures Its Caption Bank}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.09517},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.09517},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2510.10987,
  title = {{DITTO: A Spoofing Attack Framework on Watermarked LLMs via Knowledge Distillation}},
  author = {Hyeseon An and Shinwoo Park and Suyeon Woo and Yo-Sub Han},
  year = {2025},
  eprint = {2510.10987},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2510.10987},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2609.37468,
  title = {{Backdoor in the Loop: Compromising Agentic Search via Malicious Retrievers}},
  author = {Unknown},
  year = {2026},
  eprint = {2609.37468},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.37468},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2610.09384,
  title = {{The Persona Hierarchy Model: Understanding Contextual Generalization in Fine-Tuning LLMs}},
  author = {Jiachen Zhao and Zhengxuan Wu and David Bau and Weiyan Shi},
  year = {2026},
  eprint = {2610.09384},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.09384},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2610.10276,
  title = {{PatchBench: Measuring Collateral Damage in Activation Patching}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.10276},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.10276},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2609.32701,
  title = {{Despite Instructions: Frontier Agents Improvise Covert Channels at Test Time}},
  author = {Unknown},
  year = {2026},
  eprint = {2609.32701},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.32701},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2610.09981,
  title = {{Sensitive-Topic Leakage Through LLM Routing Metadata: Measurement and Mitigation}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.09981},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.09981},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2606.13044,
  title = {{No Hidden Prompts Needed! You Can Game AI Peer Review with Presentation-Only Revisions}},
  author = {Xu Yang and Zhizhou Sha and Junbo Li et al.},
  year = {2026},
  eprint = {2606.13044},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.13044},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2607.14493,
  title = {{Context Contamination in LLM Analysis of Network Security Logs: Poison with Passive Prompt Injection and Mitigation Evaluation}},
  author = {Rabimba Karanjai and Yang Lu and Hemanth Hegadehalli Madhavarao and Lei Xu and Weidong Shi},
  year = {2026},
  eprint = {2607.14493},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.14493},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2608.07430,
  title = {{Diffusion LLMs as Targets and Adversaries: Mechanistic Safety Exploits}},
  author = {Elena Dumitrescu and Gert Lek and Lydia Y. Chen and Jérémie Decouchant},
  year = {2026},
  eprint = {2608.07430},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.07430},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2605.21545,
  title = {{RefusalBench: Why Refusal Rate Misranks Frontier LLMs on Biological Research Prompts}},
  author = {Lukas Weidener and Marko Brkić and Mihailo Jovanović and Emre Ulgac and Aakaash Meduri},
  year = {2026},
  eprint = {2605.21545},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.21545},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2610.09920,
  title = {{Inverting Multi-Vector Visual Document Indices}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.09920},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.09920},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2610.10203,
  title = {{How to train your model organism}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.10203},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.10203},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2610.09371,
  title = {{The Confidence Game: Strategic Miscalibration in Human-AI Delegation}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.09371},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.09371},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2609.38909,
  title = {{Unlearning Deceptive Behaviors in LLMs with Contrastive Forget Sets}},
  author = {Unknown},
  year = {2026},
  eprint = {2609.38909},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.38909},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2605.19847,
  title = {{Auditing Privacy in Multi-Tenant RAG under Account Collusion}},
  author = {Florian A. D. Burnat},
  year = {2026},
  eprint = {2605.19847},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.19847},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2610.09159,
  title = {{SpecGuard: Proving a Task Is Broken Before the Agent Cheats}},
  author = {Param Biyani and Krishnamurthy Dvijotham},
  year = {2026},
  eprint = {2610.09159},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.09159},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2610.09600,
  title = {{SafeEvo: Deciphering the Safety Alignment Mechanism and Evolution in Language Models}},
  author = {Miao Yu and Zuming Jiang and Hao Huang and Yunpeng Li and Lu Yuan and Kun Wang},
  year = {2026},
  eprint = {2610.09600},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.09600},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2610.08144,
  title = {{Navier-Stokes lost in translation: Why Lean verification of AI autoformalisation does not guarantee correct natural language proofs}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.08144},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.08144},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2610.09819,
  title = {{Backdooring Acoustic Foundation Models for Physically Realizable Triggers}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.09819},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.09819},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2610.09667,
  title = {{Shared and structured inputs undermine collective random choice by reasoning AI agents}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.09667},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.09667},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2608.04741,
  title = {{LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agents}},
  author = {Longtao Guo and Zelin Zhang and Kaifeng Huang and Yang Shi},
  year = {2026},
  eprint = {2608.04741},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.04741},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2608.04192,
  title = {{Behavioral Skill Reconstruction: Reconstructing Hidden Functionality from LLM Agent Skills}},
  author = {Peichun Hua and Haoxuan Xu and Mengyuan Li},
  year = {2026},
  eprint = {2608.04192},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.04192},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2606.04329,
  title = {{From Untrusted Input to Trusted Memory: A Systematic Study of Memory Poisoning Attacks in LLM Agents}},
  author = {Pritam Dash and Tongyu Ge and Aditi Jain and Tanmay Shah and Zhiwei Shang},
  year = {2026},
  eprint = {2606.04329},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.04329},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2606.21077,
  title = {{OTTER: A Red-Teaming System for Toxicity-Evading Jailbreak Prompt Optimization}},
  author = {Jerry Wang and Hsin-Ling Hsu and Yi-Cheng Lai and Nai-Chia Chen and Fang Yu},
  year = {2026},
  eprint = {2606.21077},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.21077},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2606.04075,
  title = {{Large Language Models Hack Rewards, and Society}},
  author = {Wei Liu and Xinyi Mou and Hanqi Yan and Zhongyu Wei and Yulan He},
  year = {2026},
  eprint = {2606.04075},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.04075},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2607.21619,
  title = {{Adversarial Style Optimization: Enhancing VLM Jailbreaks by GRPO-based Stylistic Triggers Optimization}},
  author = {Bingjun Luo and Jialin Guo and Yue Yao and Xinpeng Ding},
  year = {2026},
  eprint = {2607.21619},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.21619},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2610.09708,
  title = {{Black-Box Adversarial Patch Attacks on VLAs via Ancestor VLM Exploitation}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.09708},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.09708},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2610.07798,
  title = {{Thin Evidence, Thick Priors: How Language Models Substitute Identity for Missing Financial Facts}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.07798},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.07798},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2606.29887,
  title = {{SafePyramid: A Hierarchical Benchmark for In-context Policy Guardrailing}},
  author = {Jiacheng Zhang and Haoyu He and Sen Zhang et al.},
  year = {2026},
  eprint = {2606.29887},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.29887},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2605.30040,
  title = {{Token Inflation: How Dishonest Providers Can Overcharge for Large Language Model Usage}},
  author = {Shahinul Hoque and Jinghuai Zhang and Jinyuan Sun and Fnu Suya},
  year = {2026},
  eprint = {2605.30040},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.30040},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2605.24312,
  title = {{Five Queries Are Enough: Query-Efficient and Surrogate-Free Membership Inference Attacks on RAG via Entailment}},
  author = {Nguyen Linh Bao Nguyen and Wanlun Ma and Viet Vo et al.},
  year = {2026},
  eprint = {2605.24312},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.24312},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2605.26156,
  title = {{Turning Bias into Bugs: Bandit-Guided Style Manipulation Attacks on LLM Judges}},
  author = {Xianglin Yang and Bryan Hooi and Gelei Deng and Tianwei Zhang and Jin Song Dong},
  year = {2026},
  eprint = {2605.26156},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.26156},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2605.13338,
  title = {{Inducing Overthink: Hierarchical Genetic Algorithm-based DoS Attack on Black-Box Large Language Reasoning Models}},
  author = {Shuqiang Wang and Wei Cao and Jiaqi Weng et al.},
  year = {2026},
  eprint = {2605.13338},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.13338},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2603.01454,
  title = {{VidDoS: Universal Denial-of-Service Attack on Video-based Large Language Models}},
  author = {Duoxun Tang and Dasen Dai and Jiyao Wang and Xiao Yang and Jianyu Wang and Siqi Cai},
  year = {2026},
  eprint = {2603.01454},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2603.01454},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2606.09499,
  title = {{Targeting World Models to Compromise Robot Learning Pipelines}},
  author = {Unknown},
  year = {2026},
  eprint = {2606.09499},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.09499},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2511.18921,
  title = {{BackdoorVLM: A Benchmark for Backdoor Attacks and Defenses on Vision-Language Models}},
  author = {Unknown},
  year = {2025},
  eprint = {2511.18921},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2511.18921},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2610.10062,
  title = {{Loud Failures, Quiet Failures: Fault Detection and Recovery in Tool-Using Language Model Agents}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.10062},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.10062},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2610.09944,
  title = {{AgentTime: Can Agents Estimate and Control Their Own Runtime?}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.09944},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.09944},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2608.15578,
  title = {{ARENA: Automated Red-Teaming for Large Audio Language Models}},
  author = {Jiaming He and Zhicong Huang and Tian Jin et al.},
  year = {2026},
  eprint = {2608.15578},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.15578},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2605.18168,
  title = {{Acoustic Interference: A New Paradigm Weaponizing Acoustic Latent Semantic for Universal Jailbreak against Large Audio Language Models}},
  author = {Yanyun Wang and Yu Huang and Zi Liang and Xixin Wu and Li Liu},
  year = {2026},
  eprint = {2605.18168},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.18168},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2605.24421,
  title = {{Poisoning the Watchtower: Prompt Injection Attacks Against LLM-Augmented Security Operations Through Adversarial Log Content}},
  author = {Rohan Pandey and Archit Bhujang},
  year = {2026},
  eprint = {2605.24421},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.24421},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2608.01759,
  title = {{Benign Alone, Harmful Together: Exploiting Experience Composition in Self-Evolving LLM Agents}},
  author = {Bingyu Yan and Xiaoming Zhang and Chaozhuo Li and Ziyi Zhou and Yirui Qi and Litian Zhang},
  year = {2026},
  eprint = {2608.01759},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.01759},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2608.12273,
  title = {{Convergent Detour Hijacking: Task-Preserving Resource Amplification in Skill-Based LLM Agents}},
  author = {Junliang Liu and Ruoyu Li and Wenxin Tang et al.},
  year = {2026},
  eprint = {2608.12273},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.12273},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2608.05108,
  title = {{Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming}},
  author = {Yanting Wang and Chenlong Yin and Runpeng Geng and Jinyuan Jia},
  year = {2026},
  eprint = {2608.05108},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.05108},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2605.17971,
  title = {{Babel: Jailbreaking Safety Attention via Obfuscation Distribution Optimized Sampling}},
  author = {Ziwei Wang and Jing Chen and Ruichao Liang et al.},
  year = {2026},
  eprint = {2605.17971},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.17971},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2509.09488,
  title = {{Prompt Pirates Need a Map: Stealing Seeds helps Stealing Prompts}},
  author = {Felix Mächtle and Ashwath Shetty and Jonas Sander and Nils Loose and Sören Pirk and Thomas Eisenbarth},
  year = {2025},
  eprint = {2509.09488},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2509.09488},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2606.01212,
  title = {{DiscourseFlip: An Oblique Discourse-Level Opinion Manipulation Attack against Black-box Retrieval-Augmented Generation}},
  author = {Yuyang Gong and Miaokun Chen and Jiawei Liu et al.},
  year = {2026},
  eprint = {2606.01212},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.01212},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2610.09264,
  title = {{Package Hallucination Attacks on Coding Agents through Prompt Injection in Rule Files}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.09264},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.09264},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2608.01117,
  title = {{SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks}},
  author = {Unknown},
  year = {2026},
  eprint = {2608.01117},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.01117},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2605.04446,
  title = {{Misrouter: Exploiting Routing Mechanisms for Input-Only Attacks on Mixture-of-Experts LLMs}},
  author = {Zekun Fei and Zihao Wang and Weijie Liu et al.},
  year = {2026},
  eprint = {2605.04446},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.04446},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2605.11047,
  title = {{Red-Teaming Agent Execution Contexts: Open-World Security Evaluation on OpenClaw}},
  author = {Hongwei Yao and Yiming Liu and Yiling He and Bingrun Yang},
  year = {2026},
  eprint = {2605.11047},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.11047},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2607.00481,
  title = {{Beyond the Prompt: Jailbreaking Function-Calling LLMs via Simulated Moderation Traces}},
  author = {Junlong Liu and Haobo Wang and Weiqi Luo and Xiaojun Jia},
  year = {2026},
  eprint = {2607.00481},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.00481},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2605.18915,
  title = {{DMN: A Compositional Framework for Jailbreaking Multimodal LLMs with Multi-Image Inputs}},
  author = {Wenzhuo Xu and Zhipeng Wei and Zonghao Ying et al.},
  year = {2026},
  eprint = {2605.18915},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.18915},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2607.00422,
  title = {{KidnapRAG: A Black-Box Attack for Hijacking Reasoning in Agentic Retrieval-Augmented Generation Systems}},
  author = {Chanwoo Choi and Euntae Kim and Kyuho Lee et al.},
  year = {2026},
  eprint = {2607.00422},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.00422},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2606.12918,
  title = {{MAStrike: Shapley-Guided Collusive Red-Teaming on Multi-Agent Systems}},
  author = {Chejian Xu and Zhaorun Chen and Jingyang Zhang et al.},
  year = {2026},
  eprint = {2606.12918},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.12918},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2607.02961,
  title = {{Overloading Large Vision-Language Models for Jailbreaking}},
  author = {Haoyu Zhang and Yangyang Guo and Mohan Kankanhalli},
  year = {2026},
  eprint = {2607.02961},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.02961},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2608.02681,
  title = {{Safety in Batches? Understanding and Mitigating Safety Failures in Batch Prompting}},
  author = {Kihyun Kim and Hee-Seon Kim and Wonjun Lee and Changick Kim},
  year = {2026},
  eprint = {2608.02681},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.02681},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2605.21541,
  title = {{Frequency-Domain Regularized Adversarial Alignment for Transferable Attacks against Closed-Source MLLMs}},
  author = {Leitao Yuan and Qinghua Mao and Daizong Liu et al.},
  year = {2026},
  eprint = {2605.21541},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.21541},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2605.08310,
  title = {{WebTrap: Stealthy Mid-Task Hijacking of Browser Agents During Navigation}},
  author = {Zhichao Liu and Wenbo Pan and Haining Yu and Ge Gao and Tianqing Zhu and Xiaohua Jia},
  year = {2026},
  eprint = {2605.08310},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.08310},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2608.00718,
  title = {{Adversarial Attacks in Multi-Agent LLM Pipelines: Unveiling Structural Vulnerabilities in Agentic AI Architectures}},
  author = {Faisal Haque Bappy and Tahrim Hossain and Tarannum Shaila Zaman and Raiful Hasan and Kamrul Hasan and Tariqul Islam},
  year = {2026},
  eprint = {2608.00718},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.00718},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2605.19722,
  title = {{Measuring Safety Alignment Effects in Autonomous Security Agents}},
  author = {Isaac David and Arthur Gervais},
  year = {2026},
  eprint = {2605.19722},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.19722},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2610.10358,
  title = {{Open-MMUnlearning: Unifying Methods and Evaluation for MLLM Unlearning}},
  author = {Junkai Chen and Yuhao He and Qianshan Wei and Junxiang You and Jingwen Shao and Junkai Lin and Zhongkai Yue and Xiaotian Ye and Zhengbo Jiao and Jiali Cheng and Zhijie Deng and Kening Zheng and Ruiqi Liu and Hadi Amiri and Yi Yu and Zhenan Sun and Qi Li and Ka-Ho Chow and Sijia Liu and Liang Wang and Jiaqi Li and Shu Wu},
  year = {2026},
  eprint = {2610.10358},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.10358},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2604.12447,
  title = {{HazardArena: Evaluating Semantic Safety in Vision-Language-Action Models}},
  author = {Unknown},
  year = {2026},
  eprint = {2604.12447},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.12447},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2610.09279,
  title = {{AI-Assisted Submissions in Online Research Are Rare and Highly Concentrated but Routinely Approved}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.09279},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.09279},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2609.34974,
  title = {{Before Acting, Change the State: Prospective State Intervention for Web Agents under Deceptive Interfaces}},
  author = {Unknown},
  year = {2026},
  eprint = {2609.34974},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.34974},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2608.21929,
  title = {{SkillBloat: Token Amplification Attacks via Skill Injection in LLM Coding Agents}},
  author = {Yuanjin Zheng and Jingbang Chen},
  year = {2026},
  eprint = {2608.21929},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.21929},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2602.15927,
  title = {{Visual Memory Injection Attacks for Multi-Turn Conversations}},
  author = {Christian Schlarmann and Matthias Hein},
  year = {2026},
  eprint = {2602.15927},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2602.15927},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2606.11265,
  title = {{When Poison Fails After Retrieval: Revisiting Corpus Poisoning under Chunking and Reranking Pipelines}},
  author = {Xi Nie and Hongwei Li and Shenghao Wu and Mingxuan Li and Jiachen Li and Wenbo Jiang},
  year = {2026},
  eprint = {2606.11265},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.11265},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2609.01325,
  title = {{VerTox: Verifiable Reward-Guided Corpus Poisoning Against Neural Ranking Models}},
  author = {Unknown},
  year = {2026},
  eprint = {2609.01325},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.01325},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2610.09703,
  title = {{Understanding and Mitigating Token-Pruning-Induced Vulnerabilities in VLMs}},
  author = {Shuailong Wang and Xinyu Lyu and Shengming Yuan and Jingkuan Song and Heng Tao Shen and Lianli Gao},
  year = {2026},
  eprint = {2610.09703},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.09703},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2604.06240,
  title = {{The Art of Building Verifiers for Computer Use Agents}},
  author = {Unknown},
  year = {2026},
  eprint = {2604.06240},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.06240},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2605.21401,
  title = {{Open-source LLMs administer maximum electric shocks in a Milgram-like obedience experiment}},
  author = {Roland Pihlakas and Jan Llenzl Dagohoy},
  year = {2026},
  eprint = {2605.21401},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.21401},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2604.24082,
  title = {{Jailbreaking Frontier Foundation Models Through Intention Deception}},
  author = {Xinhe Wang and Katia Sycara and Yaqi Xie},
  year = {2026},
  eprint = {2604.24082},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.24082},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2610.03036,
  title = {{WebFovea: When the Model Is Right but the Click Is Wrong -- Reliable Round Trips for Vision-Based Web Agents on Live Websites}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.03036},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.03036},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2606.20626,
  title = {{Efficient Safety Benchmarking via Item Response Theory}},
  author = {Fabio Spagliardi and Mírian Silva and Ayan Datta and Aiden Zhou and Vamshi Bonagiri and Diogo Cruz},
  year = {2026},
  eprint = {2606.20626},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.20626},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2606.04923,
  title = {{Reproducing, Analyzing, and Detecting Reward Hacking in Rubric-Based Reinforcement Learning}},
  author = {Xuekang Wang and Zhuoyuan Hao and Shuo Hou and Hao Peng and Juanzi Li and Xiaozhi Wang},
  year = {2026},
  eprint = {2606.04923},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.04923},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2606.07874,
  title = {{Safety is Contextual, LLM-Judges Are Not: Navigating the Rigid Priors of Evaluators}},
  author = {Anissa Alloula and Federico Licini and Ava Batchkala and Seraphina Goldfarb-Tarrant},
  year = {2026},
  eprint = {2606.07874},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.07874},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2609.01491,
  title = {{GlossoGen: Emergent Language in Complex Multi-Agent LLM Interactions}},
  author = {Unknown},
  year = {2026},
  eprint = {2609.01491},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.01491},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2602.00851,
  title = {{Persuasion Propagation: Does Persuasion Change AI Agent Behavior?}},
  author = {Unknown},
  year = {2026},
  eprint = {2602.00851},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2602.00851},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2610.09000,
  title = {{How Fragile Is On-Device Language Model Safety? Localizing Safety-Critical Parameters for Sparse Fault Analysis}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.09000},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.09000},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2610.09941,
  title = {{Purifying Backdoored Large Vision-Language Models by Removing Hijacked Directions}},
  author = {Bojun Yang and Haochen Zhou and Zhifang Zhang and Haobo Wang and Songze Li and Lei Feng},
  year = {2026},
  eprint = {2610.09941},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.09941},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2610.10150,
  title = {{On the Reliability of LLM-Based Vulnerability Patching Benchmarks}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.10150},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.10150},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2610.09496,
  title = {{Sparse Feature Policy Unlearning Mitigates State Hallucination in Vision-Language-Action Models}},
  author = {Jiho Lee and Jeongeun Park and Heayoun Choi and Taekyung Kim and Eunwoo Kim},
  year = {2026},
  eprint = {2610.09496},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.09496},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2610.10232,
  title = {{LLM Persuasion Is in the Eye of the Evaluation}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.10232},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.10232},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2610.09469,
  title = {{Secure-CUA: Controlling Untrusted Influence in Computer-Use Agents}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.09469},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.09469},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2606.12716,
  title = {{Does AI Reviewer See the Full Picture? Attacking and Defending Multimodal Peer Review}},
  author = {Xinyu Zhao and Rana Muhammad Shahroz Khan and Zhen Xu and Zhen Tan and Tianlong Chen},
  year = {2026},
  eprint = {2606.12716},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.12716},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2606.21155,
  title = {{Who Checks the Citations? Benchmarking Legal Hallucination Detection}},
  author = {Patty Liu and Dominik Stammbach and Peter Henderson},
  year = {2026},
  eprint = {2606.21155},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.21155},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2605.05709,
  title = {{Conceal, Reconstruct, Jailbreak: Exploiting the Reconstruction-Concealment Tradeoff in MLLMs}},
  author = {Md Farhamdur Reza and Richeng Jin and Tianfu Wu and Huaiyu Dai},
  year = {2026},
  eprint = {2605.05709},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.05709},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2610.09004,
  title = {{Removing Information Content Does Not Certify Tamper Resistance in Open-Weight Models}},
  author = {Domenic Rosati and Alessa Carbo and Ali Dadsetan and Hong Huang and Matthew Young and Subhabrata Majumdar and Frank Rudzicz and Hassan Sajjad},
  year = {2026},
  eprint = {2610.09004},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.09004},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2609.14744,
  title = {{Runtime Authorization for Resources Acquired by AI Agents}},
  author = {Unknown},
  year = {2026},
  eprint = {2609.14744},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.14744},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2607.25936,
  title = {{From Role Prompt to Infinite Thinking: Exploiting Persona Conditioning for Inference Cost Attacks in LLMs}},
  author = {Zhiyi Mou and Wangze Ni and Tianfang Xiao et al.},
  year = {2026},
  eprint = {2607.25936},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.25936},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2604.23067,
  title = {{Training a General Purpose Automated Red Teaming Model}},
  author = {Aishwarya Padmakumar and Leon Derczynski and Traian Rebedea and Christopher Parisien},
  year = {2026},
  eprint = {2604.23067},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.23067},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2605.08382,
  title = {{SecureForge: Finding and Preventing Vulnerabilities in LLM-Generated Code via Prompt Optimization}},
  author = {Houjun Liu and Lisa Einstein and John Yang et al.},
  year = {2026},
  eprint = {2605.08382},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.08382},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2610.07557,
  title = {{CheckerBench: Can Long-Horizon Agents Synthesize Static-Analysis Checkers?}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.07557},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.07557},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2610.09964,
  title = {{Successive Training Stages and Large Language Model Persuasion: Effects of Misalignment, Supervised Fine-Tuning, and Preference Optimization}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.09964},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.09964},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2610.09935,
  title = {{AgentTracer: Tracing Indirect Prompt Injection Attack through Fine-Grained Intention-Execution Alignment}},
  author = {Zitong Yao and Jiangrong Wu and Yixi Lin and Anrui Huang and Luoyun Zhang and Yuhong Nan},
  year = {2026},
  eprint = {2610.09935},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.09935},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2606.16751,
  title = {{Automated jailbreak attack targeting multiple defense strategies}},
  author = {Qi Wang and Chengcheng Wan and Weijia He et al.},
  year = {2026},
  eprint = {2606.16751},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.16751},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2606.05609,
  title = {{SlotGCG: Exploiting the Positional Vulnerability in LLMs for Jailbreak Attacks}},
  author = {Seungwon Jeong and Jiwoo Jeong and Hyeonjin Kim and Yunseok Lee and Woojin Lee},
  year = {2026},
  eprint = {2606.05609},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.05609},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2610.08951,
  title = {{ASPIRE: Agentic Safety \& Prompt Injection Red-teaming Engine}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.08951},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.08951},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2606.22673,
  title = {{Agent MechSuits: Mechanistic Subspace Safety Steering for Multi-Turn CLI Agents}},
  author = {Unknown},
  year = {2026},
  eprint = {2606.22673},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.22673},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2610.10310,
  title = {{RSIGym: A Flexible Environment for Recursive Self-Improvement}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.10310},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.10310},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2610.04763,
  title = {{Tracing model-generated DNA with position-independent watermarking}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.04763},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.04763},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2606.15899,
  title = {{SkillVetBench: LLM-as-Judge for Multi-Dimensional Security Risk Evaluation in Open-Source LLM Agent Skills}},
  author = {Ismail Hossain and Sai Puppala and Md Jahangir Alam and Tanzim Ahad and Sajedul Talukder},
  year = {2026},
  eprint = {2606.15899},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.15899},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2509.05219,
  title = {{Conversational AI increases political knowledge as effectively as self-directed internet search}},
  author = {Unknown},
  year = {2025},
  eprint = {2509.05219},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2509.05219},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2610.10064,
  title = {{Comprehension Audits to Mitigate Risks from Automated AI Research}},
  author = {Ronald J. Bodkin and Bahrad A. Sokhansanj and Gillian K. Hadfield},
  year = {2026},
  eprint = {2610.10064},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.10064},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2610.09581,
  title = {{Correct Answers, Unsupported Findings: Evidence Binding in Forensic Reconstruction of LLM Agent Logs}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.09581},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.09581},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2607.01276,
  title = {{Embedding Inference Attack}},
  author = {Cedric Fitiavana Raelijohn and Sébastien Gambs and Jean-Francois Rajotte},
  year = {2026},
  eprint = {2607.01276},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.01276},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2606.24819,
  title = {{HelpBench: Assessing the Ability of LLMs to Provide Privacy, Safety, and Security Advice}},
  author = {Sarah Meiklejohn and Sunny Consolvo and Patrick Gage Kelley et al.},
  year = {2026},
  eprint = {2606.24819},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.24819},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2606.09701,
  title = {{Learning to Attack and Defend: Adaptive Red Teaming of Language Models via GRPO}},
  author = {Blake Bullwinkel and Eugenia Kim and Amanda Minnich and Mark Russinovich},
  year = {2026},
  eprint = {2606.09701},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.09701},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2610.09033,
  title = {{Quad-State Safety Evaluation of Open-Weight Large Language Models on Non-Canonical Inputs}},
  author = {Pavan Maddula},
  year = {2026},
  eprint = {2610.09033},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.09033},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2604.10893,
  title = {{Beyond A Fixed Seal: Adaptive Stealing Watermark in Large Language Models}},
  author = {Shuhao Zhang and Yuli Chen and Jiale Han and Bo Cheng and Jiabao Ma},
  year = {2026},
  eprint = {2604.10893},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.10893},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2508.06837,
  title = {{Towards Effective Prompt Stealing Attack against Text-to-Image Diffusion Models}},
  author = {Shiqian Zhao and Chong Wang and Yiming Li et al.},
  year = {2025},
  eprint = {2508.06837},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2508.06837},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2609.39306,
  title = {{ReSAIL: Mitigating Collapse in Iterative Agent Self-Distillation}},
  author = {Unknown},
  year = {2026},
  eprint = {2609.39306},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.39306},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2610.08917,
  title = {{CARE: Certifying Acceleration for Vision-Language-Action Inference}},
  author = {Rui Liu and Tong Zheng and Jindong Gu and Zhipeng Wang},
  year = {2026},
  eprint = {2610.08917},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.08917},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2605.22258,
  title = {{Harder to Defend: Towards Chinese Toxicity Attacks via Implicit Enhancement and Obfuscation Rewriting}},
  author = {Jingyi Kang and Junyu Lu and Bo Xu et al.},
  year = {2026},
  eprint = {2605.22258},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.22258},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2605.07481,
  title = {{Vaporizer: Breaking Watermarking Schemes for Large Language Model Outputs}},
  author = {Jonathan Hong Jin Ng and Anh Tu Ngo and Anupam Chattopadhyay},
  year = {2026},
  eprint = {2605.07481},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.07481},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2605.27016,
  title = {{Evaluating the Relevance of Uncertainty Estimators for LLM Hallucination}},
  author = {Yedidia Agnimo and Anna Korba and Annabelle Blangero and Nicolas Chesneau and Karteek Alahari},
  year = {2026},
  eprint = {2605.27016},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.27016},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2603.29418,
  title = {{Covert Visual Prompt Injection against Commercial Multimodal Large Language Models}},
  author = {Meiwen Ding and Song Xia and Chenqi Kong and Xudong Jiang},
  year = {2026},
  eprint = {2603.29418},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2603.29418},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2605.20203,
  title = {{GrandGuard: Taxonomy, Benchmark, and Safeguards for Elderly-Chatbot Interaction Safety}},
  author = {Changxuan Fan and Xi Yang and Yueyuan Zheng et al.},
  year = {2026},
  eprint = {2605.20203},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.20203},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2610.06339,
  title = {{BabelFake: A Multilingual Audio-Visual DeepFake Benchmark}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.06339},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.06339},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2606.02302,
  title = {{SeClaw: Spec-Driven Security Task Synthesis for Evaluating Autonomous Agents}},
  author = {Hao Cheng and Changtao Miao and Tianle Song et al.},
  year = {2026},
  eprint = {2606.02302},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.02302},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2610.08699,
  title = {{nanoMuse: An Open-Source Personal Agent for Every Device You Own}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.08699},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.08699},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2610.10405,
  title = {{Reasoning-Token Spikes Under Prompted Untruthful Responding in Large Language Models}},
  author = {Maverick Morales and Tom\'a\vs Dominik and Vermut Gao and Katrina Shirey and Paulius Rimkevi\vcius and Aaron Schurger and Uri Maoz},
  year = {2026},
  eprint = {2610.10405},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.10405},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2609.28372,
  title = {{Shopping by algorithm: How agentic AI deploys human heuristics as a surrogate consumer}},
  author = {Unknown},
  year = {2026},
  eprint = {2609.28372},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.28372},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2609.38296,
  title = {{AI Agents are Vulnerable to Radicalization}},
  author = {Unknown},
  year = {2026},
  eprint = {2609.38296},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.38296},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2606.18062,
  title = {{Security and Privacy Prompts in the Wild: What Users Ask LLMs and How LLMs Respond}},
  author = {Hobin Kim and Xiaoyuan Wu and Omer Akgul and Lujo Bauer and Nicolas Christin},
  year = {2026},
  eprint = {2606.18062},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.18062},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2610.04299,
  title = {{Questioning the Questions: Sustaining Self-Evolution in Reasoning Models}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.04299},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.04299},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2610.09087,
  title = {{U-Space: Uncovering When and Why Uncertainty Arises in Language Models}},
  author = {Tobias Braun and Nils Loose and Alexander Herzog and Virginia Ceccatelli and Marcus Rohrbach and Thomas Eisenbarth and Lorenzo Cavallaro},
  year = {2026},
  eprint = {2610.09087},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.09087},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2610.10285,
  title = {{AI Safety Considerations for Agents With Limited Time to Act}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.10285},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.10285},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2605.20530,
  title = {{AgentAtlas: Beyond Outcome Leaderboards for LLM Agents}},
  author = {Parsa Mazaheri and Kasra Mazaheri},
  year = {2026},
  eprint = {2605.20530},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.20530},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2610.09082,
  title = {{Move Fast and Mend Things: Keeping Up with Evolving AI Harms Using Social Media Commentary}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.09082},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.09082},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2607.27373,
  title = {{RoguePrompt: Dual-Layer Encoding for Self-Reconstruction to Circumvent LLM Moderation}},
  author = {Benyamin Tafreshian and Prathamesh Dhake},
  year = {2026},
  eprint = {2607.27373},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.27373},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2608.27439,
  title = {{RedEvoAgent: Automatic Red-Teaming Agent with Experience-Driven Skill Evolution}},
  author = {Junjie Zhang and Hui Liu and Kecheng Chen and Xianbo Mo and Changsheng Chen and Haoliang Li},
  year = {2026},
  eprint = {2608.27439},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.27439},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2605.00553,
  title = {{Stable-GFlowNet: Toward Diverse and Robust LLM Red-Teaming via Contrastive Trajectory Balance}},
  author = {Minchan Kwon and Sunghyun Baek and Minseo Kim and Jaemyung Yu and Dongyoon Han and Junmo Kim},
  year = {2026},
  eprint = {2605.00553},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.00553},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2610.10345,
  title = {{SLDR: Defending Against Malicious Fine-tuning via Selective Layers Recovery and Dynamic Routing}},
  author = {Hui Zhang and Yachao Yuan and Jiayun Wang and Yuanzhuo Li and Hongtao Wang and Yali Yuan},
  year = {2026},
  eprint = {2610.10345},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.10345},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2606.18021,
  title = {{LegalHalluLens: Typed Hallucination Auditing and Calibrated Multi-Agent Debate for Trustworthy Legal AI}},
  author = {Lalit Yadav and Akshaj Gurugubelli},
  year = {2026},
  eprint = {2606.18021},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.18021},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2610.09683,
  title = {{System Switch: When Should a Fast Decision Model Stop and Think?}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.09683},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.09683},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2605.11036,
  title = {{Sequential Behavioral Watermarking for LLM Agents}},
  author = {Hyeseon An and Shinwoo Park and Dongsu Kim and Yo-Sub Han},
  year = {2026},
  eprint = {2605.11036},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.11036},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2610.08887,
  title = {{Steering Follows Geometry, Not Labels: Emotion Directions in a Full-Duplex Speech Model}},
  author = {Pulak Kuli},
  year = {2026},
  eprint = {2610.08887},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.08887},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2604.06820,
  title = {{What Does a Sharing Question Add? Auditing LLM Survey Scores for Misinformation}},
  author = {Unknown},
  year = {2026},
  eprint = {2604.06820},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.06820},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2609.27452,
  title = {{Issuer-Sovereign Agentic Payments}},
  author = {Unknown},
  year = {2026},
  eprint = {2609.27452},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.27452},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2601.04261,
  title = {{Inhibitory Attacks on Backdoor-based Fingerprinting for Large Language Models}},
  author = {Hang Fu and Wanli Peng and Yinghan Zhou and Jiaxuan Wu and Juan Wen and Yiming Xue},
  year = {2026},
  eprint = {2601.04261},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2601.04261},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2605.25893,
  title = {{D²-Monitor: Dynamic Safety Monitoring for Diffusion LLMs via Hesitation Signals}},
  author = {Unknown},
  year = {2026},
  eprint = {2605.25893},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.25893},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2606.11425,
  title = {{JailbreakOPT: Tool-Assisted Iterative Jailbreak Prompt Optimization}},
  author = {Ge Shi and Jun Yin and Donglin Xie and Fangyi Liu and Yucan Li and Menglin Liu},
  year = {2026},
  eprint = {2606.11425},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.11425},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2607.04379,
  title = {{Knowledge Base Poisoning Attacks and Defense for Policy-Aware LLM-RAG Framework}},
  author = {Om Solanki and Lopamudra Praharaj and Deepti Gupta and Maanak Gupta},
  year = {2026},
  eprint = {2607.04379},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.04379},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2603.10010,
  title = {{FERRET: Framework for Expansion Reliant Red Teaming}},
  author = {Ninareh Mehrabi and Vitor Albiero and Maya Pavlova and Joanna Bitton},
  year = {2026},
  eprint = {2603.10010},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2603.10010},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2610.09043,
  title = {{Careful Judge: Safe and Efficient Human-AI Collaborative Decision Making}},
  author = {Chenyu Zhang and Rachel Luo and Boyi Li and Anjali Parashar and Marco Pavone and Apoorva Sharma},
  year = {2026},
  eprint = {2610.09043},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.09043},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2608.03272,
  title = {{Attacking and Defending Multi-Agent Collaborative Filtering Systems Through Connectivity}},
  author = {Unknown},
  year = {2026},
  eprint = {2608.03272},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.03272},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2605.18984,
  title = {{Artifact-Bench: Evaluating MLLMs on Detecting and Assessing the Artifacts of AI-Generated Videos}},
  author = {Yuqi Tang and Yang Shi and Zhuoran Zhang et al.},
  year = {2026},
  eprint = {2605.18984},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.18984},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2610.09973,
  title = {{From Expected Harmfulness to Likelihood: A Probabilistic Reformulation of Jailbreaking LLM Agents}},
  author = {Juanyang Xu and Zheng Wang and Xingyu Zhao and Siddartha Khastgir and Andi Zhang},
  year = {2026},
  eprint = {2610.09973},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.09973},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2606.24115,
  title = {{A Benchmark for Hallucination Detection in VLMs for Gastrointestinal Endoscopy}},
  author = {Aminu Lawal and Niyoj Oli and Sachin Acharya and Prashnna Gyawali and Maria Carmen Romano and Binod Bhattarai},
  year = {2026},
  eprint = {2606.24115},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.24115},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2603.08275,
  title = {{AdaCultureSafe: Adaptive Cultural Safety Grounded by Cultural Knowledge in Large Language Models}},
  author = {Hankun Kang and Di Lin and Zhirong Liao et al.},
  year = {2026},
  eprint = {2603.08275},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2603.08275},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2610.09892,
  title = {{Defensive Sufficiency in a Stackelberg Model of AI Security}},
  author = {Subhabrata Majumdar and Rajlakshmi Chavan},
  year = {2026},
  eprint = {2610.09892},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.09892},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2606.12420,
  title = {{Eigenism: Ethics for a Human-AI Future}},
  author = {Unknown},
  year = {2026},
  eprint = {2606.12420},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.12420},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2610.10000,
  title = {{Beyond Reward Suppression: Near-Optimal Offline Attacks on Warm-Start Bandits with Bounded Rewards}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.10000},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.10000},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2603.29497,
  title = {{Distilling Human-Aligned Privacy Sensitivity Assessment from Large Language Models}},
  author = {Gabriel Loiseau and Damien Sileo and Damien Riquet and Maxime Meyer and Marc Tommasi},
  year = {2026},
  eprint = {2603.29497},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2603.29497},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2605.24765,
  title = {{CyberMaskQA: A Privacy-Aware Benchmark for Evaluating Large Language Models in Cybersecurity Question Answering}},
  author = {Matilda Gaddi and Jin Noh and Onat Gungor and Tajana Rosing},
  year = {2026},
  eprint = {2605.24765},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.24765},
  note = {AI Safety HOT 2026-10-08}
}

@misc{arxiv2610.08884,
  title = {{Task-Sufficient Contraction: Source Selection for Machine Information Interfaces}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.08884},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.08884},
  note = {AI Safety HOT 2026-10-08}
}