---
title: "SafeAgent — paper by Zhou et al. (2026) — summary and ideas"
description: "SafeAgent instead builds safety into the model through fine-tuning on fully synthetic data, so no… 62 references, cited by 1 paper here."
authors: ["Xueyang Zhou", "Weidong Wang", "Lin Lu", "Jiawen Shi", "Guiyao Tie", "Xu Yongtian", "Lixing Chen", "Pan Zhou", "Neil Zhenqiang Gong", "Lichao Sun"]
year: 2026
venue: "Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)"
source: "https://aclanthology.org/2026.acl-long.1501/"
doi: "10.18653/v1/2026.acl-long.1501"
licence: "CC BY 4.0 (ACL Anthology)"
licence_url: "https://creativecommons.org/licenses/by/4.0/"
summary_licence: "Elamur Cosmic License"
canonical: "https://research.elamur.ai/free/en/papers/zhou-2026-safeagent-safeguarding-llm-agents-automated/"
---
[Elamur Research](https://md.research.elamur.ai/free/en/) · [this page in HTML](https://research.elamur.ai/free/en/papers/zhou-2026-safeagent-safeguarding-llm-agents-automated/)

[home](https://md.research.elamur.ai/free/en/) / [papers](https://md.research.elamur.ai/free/en/papers/) / [2026](https://md.research.elamur.ai/free/en/papers/2026/page/17/) / SafeAgent: Safeguarding LLM Agents via an Automated Risk Simulator

# SafeAgent: Safeguarding LLM Agents via an Automated Risk Simulator

**Authors:** Xueyang Zhou, [Weidong Wang](https://md.research.elamur.ai/free/en/authors/weidong-wang/), Lin Lu, Jiawen Shi, [Guiyao Tie](https://md.research.elamur.ai/free/en/authors/guiyao-tie/), Xu Yongtian, Lixing Chen, [Pan Zhou](https://md.research.elamur.ai/free/en/authors/pan-zhou/), [Neil Zhenqiang Gong](https://md.research.elamur.ai/free/en/authors/neil-zhenqiang-gong/) and [Lichao Sun](https://md.research.elamur.ai/free/en/authors/lichao-sun/) · **Year:** 2026 · **Venue:** [Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)](https://md.research.elamur.ai/free/en/venues/acl/) ([ACL 2026](https://md.research.elamur.ai/free/en/venues/acl/2026/)) · **Publisher:** [Association for Computational Linguistics](https://md.research.elamur.ai/free/en/publishers/association-for-computational-linguistics/) · **Licence:** [CC BY 4.0 (ACL Anthology)](https://creativecommons.org/licenses/by/4.0/)

**Links:** [Publisher's page](https://aclanthology.org/2026.acl-long.1501/) · [PDF](https://aclanthology.org/2026.acl-long.1501.pdf) · [DOI 10.18653/v1/2026.acl-long.1501](https://doi.org/10.18653/v1/2026.acl-long.1501) · [OpenAlex](https://openalex.org/W4416832289)

**Citations:** 0 citations (OpenAlex, 2026-10-14) · 1 in our library, of the 149,439 papers whose bibliographies we read

## Summary
LLM agents that call tools over multiple turns can cause real damage, such as deleted data or leaked private information. Two common causes are vague user requests and malicious content in the environment, and standard alignment methods handle neither well. Most prior work only measures these weaknesses. The few existing defenses tend to be narrow in domain, depend on a human in the loop, or slow down inference. SafeAgent instead builds safety into the model through fine-tuning on fully synthetic data, so no dangerous real-world data has to be collected.

The approach rests on a threat model called OTS, which links risk outcomes, the unsafe actions that trigger them, and the risky scenarios that lead to those actions. The pipeline works in four steps:
- An LLM writes user instructions for given combinations of toolkits and risk outcomes.
- A simulated environment rolls out agent trajectories until an evaluator flags an unsafe step.
- Safe alternative actions are sampled through a trial-and-reflection loop.
- The model is fine-tuned on the resulting data.

Across four open-source models, safety improved by about 45% on average, and the tuned models beat strong closed-source systems. For practitioners, this offers a scalable way to harden agents without extra cost at inference time.

## Key points
- OTS breaks agent risk into Outcomes (O), Triggers/actions (T) and Scenarios (S). Its 10 outcome types come from Yuan et al. (2024a), and user instructions may be normal, underspecified or malicious.
- The data pipeline uses four LLM roles: a Generator, an Agent, an Evaluator and an environment Simulator. Safe responses are then obtained through self-reflection.
- The models were tested on a pair of safety benchmarks plus a terminal task drawn from real-world use. Safety rose by 45.4% on average across four open-source models, with a 28.91% gain on the terminal task, surpassing models such as GPT-4.
- The released dataset contains over 600 risk scenarios with matching safe actions.
- In case studies, the tuned LlaMA3.1-8b-Instruction inspected directories before deleting anything and used virtual environments for package installs. The authors note that the work introduces no new training algorithm such as RLHF.

*Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.*

## Institutions

- [Shanghai Jiao Tong University](https://md.research.elamur.ai/free/en/universities/shanghai-jiao-tong-university/) — University, Shanghai, China · 149 works · 16,161 citations
- [Duke University](https://md.research.elamur.ai/free/en/universities/duke-university/) — University, Durham, United States · 28 works · 15,077 citations
- [Huazhong University of Science and Technology](https://md.research.elamur.ai/free/en/universities/huazhong-university-of-science-and-technology/) — University, Wuhan, China · 45 works · 6,345 citations
- [The Hong Kong University of Science and Technology (Guangzhou)](https://md.research.elamur.ai/free/en/universities/the-hong-kong-university-of-science-and-technology-guangzhou/) — University, Guangzhou, China · 53 works · 1,367 citations
- [Lehigh University](https://md.research.elamur.ai/free/en/universities/lehigh-university/) — University, Bethlehem, United States · 7 works · 1,280 citations

📚 Shelves (6): [🖥️ Computer Science](https://md.research.elamur.ai/free/en/shelves/computer-science/) · 16,667 works · [🤖 Artificial Intelligence](https://md.research.elamur.ai/free/en/shelves/computer-science/artificial-intelligence/) · 16,194 works · [🎭 Arts and Humanities](https://md.research.elamur.ai/free/en/shelves/arts-and-humanities/) · 16,039 works · [🗣️ Language and Linguistics](https://md.research.elamur.ai/free/en/shelves/arts-and-humanities/language-and-linguistics/) · 15,891 works · [🤝 Social Sciences](https://md.research.elamur.ai/free/en/shelves/social-sciences/) · 1,772 works · [🤝 Safety Research](https://md.research.elamur.ai/free/en/shelves/social-sciences/safety-research/) · 543 works

## Cite

Cite as: Xueyang Zhou, Weidong Wang, Lin Lu, Jiawen Shi, Guiyao Tie, Xu Yongtian, Lixing Chen, Pan Zhou, Neil Zhenqiang Gong and Lichao Sun. 2026. SafeAgent: Safeguarding LLM Agents via an Automated Risk Simulator. Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers).

The paper itself, not this page. BibTeX from the library's record of the work.

```bibtex
@inproceedings{zhou2026safeagent,
  title = {{SafeAgent: Safeguarding LLM Agents via an Automated Risk Simulator}},
  author = {Xueyang Zhou, Weidong Wang, Lin Lu, Jiawen Shi, Guiyao Tie, Xu Yongtian, Lixing Chen, Pan Zhou, Neil Zhenqiang Gong and Lichao Sun},
  booktitle = {Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)},
  year = {2026},
  doi = {10.18653/v1/2026.acl-long.1501},
  url = {https://doi.org/10.18653/v1/2026.acl-long.1501}
}
```

- [← previous SAFARI: A Community-Engaged Approach and Dataset of Stereotype Resources in the Sub-Saharan African Context](https://md.research.elamur.ai/free/en/papers/verma-2026-safari-community-engaged-approach-dataset/)
- [next → SafeConstellations: Mitigating Over-Refusals in LLMs Through Task-Aware Representation Steering](https://md.research.elamur.ai/free/en/papers/maskey-2026-safeconstellations-mitigating-over-refusals-llms/)
- [↑ back to papers of 2026](https://md.research.elamur.ai/free/en/papers/2026/page/17/)

## References

62 references, 14 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

1. Maksym Andriushchenko, Alexandra Souly, Mateusz Dziemian, Derek Duenas, Maxwell Lin, Justin Wang, Dan Hendrycks, Andy Zou, Zico Kolter, Matt Fredrikson, and 1 others. 2024. Agentharm: A benchmark for measuring harmfulness of llm agents. arXiv preprint arXiv:2410.09024. — [arXiv:2410.09024](https://arxiv.org/abs/2410.09024) [find](https://scholar.google.com/scholar?q=Maksym+Andriushchenko%2C+Alexandra+Souly%2C+Mateusz+Dziemian%2C+Derek+Duenas%2C+Maxwell+Lin%2C+Justin+Wang%2C+Dan+Hendrycks%2C+Andy+Zou%2C+Zico+Kolter%2C+Matt+Fredrikson%2C+and+1+others%2E+2024%2E+Agentharm%3A+A+benchmark+for+)
2. Yuntao Bai, Andy Jones, Kamal Ndousse, Amanda Askell, Anna Chen, Nova DasSarma, Dawn Drain, Stanislav Fort, Deep Ganguli, Tom Henighan, and 1 others. 2022. Training a helpful and harmless assistant with reinforcement learning from human feedback. arXiv preprint arXiv:2204.05862. [find](https://scholar.google.com/scholar?q=Yuntao+Bai%2C+Andy+Jones%2C+Kamal+Ndousse%2C+Amanda+Askell%2C+Anna+Chen%2C+Nova+DasSarma%2C+Dawn+Drain%2C+Stanislav+Fort%2C+Deep+Ganguli%2C+Tom+Henighan%2C+and+1+others%2E+2022%2E+Training+a+helpful+and+harmless+assistant+wi)
3. Xiaowen Cai, Daizong Liu, Xiaoye Qu, Xiang Fang, Jianfeng Dong, Keke Tang, Pan Zhou, Lichao Sun, and Wei Hu. 2025. Towards building model/prompt-transferable attackers against large vision-language models. In The Thirty-ninth Annual Conference on Neural Information Processing Systems. [find](https://scholar.google.com/scholar?q=Xiaowen+Cai%2C+Daizong+Liu%2C+Xiaoye+Qu%2C+Xiang+Fang%2C+Jianfeng+Dong%2C+Keke+Tang%2C+Pan+Zhou%2C+Lichao+Sun%2C+and+Wei+Hu%2E+2025%2E+Towards+building+model%2Fprompt%2Dtransferable+attackers+against+large+vision%2Dlanguage+mo)
4. Francisco Maria Calisto, João Fernandes, Margarida Morais, Carlos Santiago, João Maria Abrantes, Nuno Nunes, and Jacinto C Nascimento. 2023. Assertiveness-based agent communication for a personalized medicine on medical imaging diagnosis. In Proceedings of the 2023 CHI conference on human factors in… [find](https://scholar.google.com/scholar?q=Francisco+Maria+Calisto%2C+Jo%C3%A3o+Fernandes%2C+Margarida+Morais%2C+Carlos+Santiago%2C+Jo%C3%A3o+Maria+Abrantes%2C+Nuno+Nunes%2C+and+Jacinto+C+Nascimento%2E+2023%2E+Assertiveness%2Dbased+agent+communication+for+a+personalized+)
5. Bochuan Cao, Yuanpu Cao, Lu Lin, and Jinghui Chen. 2023. [Defending against alignment-breaking attacks via robustly aligned llm](https://md.research.elamur.ai/free/en/papers/cao-2024-defending-against-alignment-breaking-attacks/). arXiv preprint arXiv:2309.14348.
6. Edoardo Debenedetti, Jie Zhang, Mislav Balunović, Luca Beurer-Kellner, Marc Fischer, and Florian Tramèr. 2024. Agentdojo: A dynamic environment to evaluate attacks and defenses for llm agents. arXiv preprint arXiv:2406.13352. — [arXiv:2406.13352](https://arxiv.org/abs/2406.13352) [find](https://scholar.google.com/scholar?q=Edoardo+Debenedetti%2C+Jie+Zhang%2C+Mislav+Balunovic%CC%81%2C+Luca+Beurer%2DKellner%2C+Marc+Fischer%2C+and+Florian+Tram%C3%A8r%2E+2024%2E+Agentdojo%3A+A+dynamic+environment+to+evaluate+attacks+and+defenses+for+llm+agents%2E+arXiv+)
7. Zhibin Gou, Zhihong Shao, Yeyun Gong, yelong shen, Yujiu Yang, Minlie Huang, Nan Duan, and Weizhu Chen. 2024. [ToRA: A tool-integrated reasoning agent for mathematical problem solving](https://md.research.elamur.ai/free/en/papers/gou-2023-tora-tool-integrated-reasoning-agent/). In The Twelfth International Conference on Learning Representations.
8. Wenyue Hua, Xianjun Yang, Mingyu Jin, Zelong Li, Wei Cheng, Ruixiang Tang, and Yongfeng Zhang. 2024. Trustagent: Towards safe and trustworthy llm-based agents. In Findings of the Association for Computational Linguistics: EMNLP 2024, pages 10000–10016. [find](https://scholar.google.com/scholar?q=Wenyue+Hua%2C+Xianjun+Yang%2C+Mingyu+Jin%2C+Zelong+Li%2C+Wei+Cheng%2C+Ruixiang+Tang%2C+and+Yongfeng+Zhang%2E+2024%2E+Trustagent%3A+Towards+safe+and+trustworthy+llm%2Dbased+agents%2E+In+Findings+of+the+Association+for+Compu)
9. Yue Huang, Chujie Gao, Siyuan Wu, Haoran Wang, Xiangqi Wang, Yujun Zhou, Yanbo Wang, Jiayi Ye, Jiawen Shi, Qihui Zhang, and 1 others. 2025a. On the trustworthiness of generative foundation models: Guideline, assessment, and perspective. arXiv preprint arXiv:2502.14296. [find](https://scholar.google.com/scholar?q=Yue+Huang%2C+Chujie+Gao%2C+Siyuan+Wu%2C+Haoran+Wang%2C+Xiangqi+Wang%2C+Yujun+Zhou%2C+Yanbo+Wang%2C+Jiayi+Ye%2C+Jiawen+Shi%2C+Qihui+Zhang%2C+and+1+others%2E+2025a%2E+On+the+trustworthiness+of+generative+foundation+models%3A+Gui)
10. Yue Huang, Lichao Sun, Haoran Wang, Siyuan Wu, Qihui Zhang, Yuan Li, Chujie Gao, Yixin Huang, Wenhan Lyu, Yixuan Zhang, and 1 others. 2024. [Trustllm: Trustworthiness in large language models](https://md.research.elamur.ai/free/en/papers/huang-2024-trustllm-trustworthiness-large-language-models/). arXiv preprint arXiv:2401.05561.
11. Yue Huang, Jingyu Tang, Dongping Chen, Bingda Tang, Yao Wan, Lichao Sun, Philip Yu, and Xiangliang Zhang. 2025b. Jailbreaking llms through alignment vulnerabilities in out-of-distribution settings. In Proceedings of the 34th ACM International Conference on Information and Knowledge Management, pages… [find](https://scholar.google.com/scholar?q=Yue+Huang%2C+Jingyu+Tang%2C+Dongping+Chen%2C+Bingda+Tang%2C+Yao+Wan%2C+Lichao+Sun%2C+Philip+Yu%2C+and+Xiangliang+Zhang%2E+2025b%2E+Jailbreaking+llms+through+alignment+vulnerabilities+in+out%2Dof%2Ddistribution+settings%2E+In)
12. Jiaming Ji, Mickel Liu, Josef Dai, Xuehai Pan, Chi Zhang, Ce Bian, Boyuan Chen, Ruiyang Sun, Yizhou Wang, and Yaodong Yang. 2024. [Beavertails: Towards improved safety alignment of llm via a human-preference dataset](https://md.research.elamur.ai/free/en/papers/ji-2023-beavertails-towards-improved-safety-alignment/). Advances in Neural Information Processing Systems, 36.
13. Huaide Jiang, Yash Chaudhary, Yuping Wang, Zehao Wang, Raghav Sharma, Manan Mehta, Yang Zhou, Lichao Sun, Zhiwen Fan, Zhengzhong Tu, and 1 others. 2026. Navtrust: Benchmarking trustworthiness for embodied navigation. arXiv preprint arXiv:2603.19229. — [arXiv:2603.19229](https://arxiv.org/abs/2603.19229) [find](https://scholar.google.com/scholar?q=Huaide+Jiang%2C+Yash+Chaudhary%2C+Yuping+Wang%2C+Zehao+Wang%2C+Raghav+Sharma%2C+Manan+Mehta%2C+Yang+Zhou%2C+Lichao+Sun%2C+Zhiwen+Fan%2C+Zhengzhong+Tu%2C+and+1+others%2E+2026%2E+Navtrust%3A+Benchmarking+trustworthiness+for+embo)
14. Dawei Li, Zongxia Li, Hongyang Du, Xiyang Wu, Shihang Gui, Yongbei Kuang, and Lichao Sun. 2026. Graph of skills: Dependency-aware structural retrieval for massive agent skills. arXiv preprint arXiv:2604.05333. — [arXiv:2604.05333](https://arxiv.org/abs/2604.05333) [find](https://scholar.google.com/scholar?q=Dawei+Li%2C+Zongxia+Li%2C+Hongyang+Du%2C+Xiyang+Wu%2C+Shihang+Gui%2C+Yongbei+Kuang%2C+and+Lichao+Sun%2E+2026%2E+Graph+of+skills%3A+Dependency%2Daware+structural+retrieval+for+massive+agent+skills%2E+arXiv+preprint+arXiv%3A26)
15. Junkai Li, Siyu Wang, Meng Zhang, Weitao Li, Yunghwei Lai, Xinhui Kang, Weizhi Ma, and Yang Liu. 2024. Agent hospital: A simulacrum of hospital with evolvable medical agents. arXiv preprint arXiv:2405.02957. — [arXiv:2405.02957](https://arxiv.org/abs/2405.02957) [find](https://scholar.google.com/scholar?q=Junkai+Li%2C+Siyu+Wang%2C+Meng+Zhang%2C+Weitao+Li%2C+Yunghwei+Lai%2C+Xinhui+Kang%2C+Weizhi+Ma%2C+and+Yang+Liu%2E+2024%2E+Agent+hospital%3A+A+simulacrum+of+hospital+with+evolvable+medical+agents%2E+arXiv+preprint+arXiv%3A2405)
16. Yuan Li, Lichao Sun, and Yixuan Zhang. 2025a. Metaagents: large language model based agents for decision-making on teaming. Proceedings of the ACM on Human-Computer Interaction, 9(2):1–27. [find](https://scholar.google.com/scholar?q=Yuan+Li%2C+Lichao+Sun%2C+and+Yixuan+Zhang%2E+2025a%2E+Metaagents%3A+large+language+model+based+agents+for+decision%2Dmaking+on+teaming%2E+Proceedings+of+the+ACM+on+Human%2DComputer+Interaction%2C+9%282%29%3A1%E2%80%9327%2E)
17. Zelin Li, Kehai Chen, Lemao Liu, Xuefeng Bai, Mingming Yang, Yang Xiang, and Min Zhang. 2025b. Tf-attack: Transferable and fast adversarial attacks on large language models. Knowledge-Based Systems, 312:113117. [find](https://scholar.google.com/scholar?q=Zelin+Li%2C+Kehai+Chen%2C+Lemao+Liu%2C+Xuefeng+Bai%2C+Mingming+Yang%2C+Yang+Xiang%2C+and+Min+Zhang%2E+2025b%2E+Tf%2Dattack%3A+Transferable+and+fast+adversarial+attacks+on+large+language+models%2E+Knowledge%2DBased+Systems%2C+3)
18. Zeyi Liao, Lingbo Mo, Chejian Xu, Mintong Kang, Jiawei Zhang, Chaowei Xiao, Yuan Tian, Bo Li, and Huan Sun. 2024. Eia: Environmental injection attack on generalist web agents for privacy leakage. arXiv preprint arXiv:2409.11295. — [arXiv:2409.11295](https://arxiv.org/abs/2409.11295) [find](https://scholar.google.com/scholar?q=Zeyi+Liao%2C+Lingbo+Mo%2C+Chejian+Xu%2C+Mintong+Kang%2C+Jiawei+Zhang%2C+Chaowei+Xiao%2C+Yuan+Tian%2C+Bo+Li%2C+and+Huan+Sun%2E+2024%2E+Eia%3A+Environmental+injection+attack+on+generalist+web+agents+for+privacy+leakage%2E+arXi)
19. Daizong Liu, Mingyu Yang, Xiaoye Qu, Pan Zhou, Xiang Fang, Keke Tang, Yao Wan, and Lichao Sun. 2024. Pandora’s box: Towards building universal attackers against real-world large vision-language models. Advances in Neural Information Processing Systems, 37:52127–52158. [find](https://scholar.google.com/scholar?q=Daizong+Liu%2C+Mingyu+Yang%2C+Xiaoye+Qu%2C+Pan+Zhou%2C+Xiang+Fang%2C+Keke+Tang%2C+Yao+Wan%2C+and+Lichao+Sun%2E+2024%2E+Pandora%E2%80%99s+box%3A+Towards+building+universal+attackers+against+real%2Dworld+large+vision%2Dlanguage+models)
20. Yinuo Liu, Zenghui Yuan, Guiyao Tie, Jiawen Shi, Pan Zhou, Lichao Sun, and Neil Zhenqiang Gong. 2025. Poisoned-mrag: Knowledge poisoning attacks to multimodal retrieval augmented generation. arXiv preprint arXiv:2503.06254. — [arXiv:2503.06254](https://arxiv.org/abs/2503.06254) [find](https://scholar.google.com/scholar?q=Yinuo+Liu%2C+Zenghui+Yuan%2C+Guiyao+Tie%2C+Jiawen+Shi%2C+Pan+Zhou%2C+Lichao+Sun%2C+and+Neil+Zhenqiang+Gong%2E+2025%2E+Poisoned%2Dmrag%3A+Knowledge+poisoning+attacks+to+multimodal+retrieval+augmented+generation%2E+arXiv+pre)
21. Yue Huang, Qihui Zhang, Lichao Sun, and 1 others. 2023. Trustgpt: A benchmark for trustworthy and responsible large language models. arXiv preprint arXiv:2306.11507. — [arXiv:2306.11507](https://arxiv.org/abs/2306.11507) [find](https://scholar.google.com/scholar?q=Yue+Huang%2C+Qihui+Zhang%2C+Lichao+Sun%2C+and+1+others%2E+2023%2E+Trustgpt%3A+A+benchmark+for+trustworthy+and+responsible+large+language+models%2E+arXiv+preprint+arXiv%3A2306%2E11507%2E+%E2%80%94+%5BarXiv%3A2306%2E11507%5D%28https%3A%2F%2Farxiv)
22. Natalia Madrueño, Alberto Fernández-Isabel, Rubén R. Fernández, and Isaac Martín De Diego. 2025. Advancing text adversarial example generation using large language models. Knowledge-Based Systems, page 114361. [find](https://scholar.google.com/scholar?q=Natalia+Madrue%C3%B1o%2C+Alberto+Fern%C3%A1ndez%2DIsabel%2C+Rub%C3%A9n+R%2E+Fern%C3%A1ndez%2C+and+Isaac+Mart%C3%ADn+De+Diego%2E+2025%2E+Advancing+text+adversarial+example+generation+using+large+language+models%2E+Knowledge%2DBased+Systems%2C+pag)
23. Aaron Hurst, Adam Lerer, Adam P Goucher, Adam Perelman, Aditya Ramesh, Aidan Clark, AJ Ostrow, Akila Welihinda, Alan Hayes, Alec Radford, and 1 others. 2024. [Gpt-4o system card](https://md.research.elamur.ai/free/en/papers/openai-2024-gpt-4o-system-card/). arXiv preprint arXiv:2410.21276.
24. Michael Moor, Oishi Banerjee, Zahra Shakeri Hossein Abad, Harlan M Krumholz, Jure Leskovec, Eric J Topol, and Pranav Rajpurkar. 2023. Foundation models for generalist medical artificial intelligence. Nature, 616(7956):259–265. [find](https://scholar.google.com/scholar?q=Michael+Moor%2C+Oishi+Banerjee%2C+Zahra+Shakeri+Hossein+Abad%2C+Harlan+M+Krumholz%2C+Jure+Leskovec%2C+Eric+J+Topol%2C+and+Pranav+Rajpurkar%2E+2023%2E+Foundation+models+for+generalist+medical+artificial+intelligence%2E+)
25. Silen Naihin, David Atkinson, Marc Green, Mer-wane Hamadi, Craig Swift, Douglas Schonholtz, Adam Tauman Kalai, and David Bau. 2023. Testing language model agents safely in the wild. In Socially Responsible Language Modelling Research. [find](https://scholar.google.com/scholar?q=Silen+Naihin%2C+David+Atkinson%2C+Marc+Green%2C+Mer%2Dwane+Hamadi%2C+Craig+Swift%2C+Douglas+Schonholtz%2C+Adam+Tauman+Kalai%2C+and+David+Bau%2E+2023%2E+Testing+language+model+agents+safely+in+the+wild%2E+In+Socially+Respon)
26. Rafael Rafailov, Archit Sharma, Eric Mitchell, Christopher D Manning, Stefano Ermon, and Chelsea Finn. 2024. [Direct preference optimization: Your language model is secretly a reward model](https://md.research.elamur.ai/free/en/papers/rafailov-2023-direct-preference-optimization-language-model/). Advances in Neural Information Processing Systems, 36.
27. Yangjun Ruan, Honghua Dong, Andrew Wang, Silviu Pitis, Yongchao Zhou, Jimmy Ba, Yann Dubois, Chris J. Maddison, and Tatsunori Hashimoto. 2024. Identifying the risks of LM agents with an LM-emulated sandbox. In The Twelfth International Conference on Learning Representations. [find](https://scholar.google.com/scholar?q=Yangjun+Ruan%2C+Honghua+Dong%2C+Andrew+Wang%2C+Silviu+Pitis%2C+Yongchao+Zhou%2C+Jimmy+Ba%2C+Yann+Dubois%2C+Chris+J%2E+Maddison%2C+and+Tatsunori+Hashimoto%2E+2024%2E+Identifying+the+risks+of+LM+agents+with+an+LM%2Demulated+sa)
28. Timo Schick, Jane Dwivedi-Yu, Roberto Dessì, Roberta Raileanu, Maria Lomeli, Eric Hambro, Luke Zettlemoyer, Nicola Cancedda, and Thomas Scialom. 2023. [Toolformer: Language models can teach themselves to use tools](https://md.research.elamur.ai/free/en/papers/schick-2023-toolformer-language-models-can-teach/). Advances in Neural Information Processing Systems, 36:68539–68551.
29. Zeyang Sha and 1 others. 2025. Agent safety alignment via reinforcement learning. arXiv preprint arXiv:2507.08270. — [arXiv:2507.08270](https://arxiv.org/abs/2507.08270) [find](https://scholar.google.com/scholar?q=Zeyang+Sha+and+1+others%2E+2025%2E+Agent+safety+alignment+via+reinforcement+learning%2E+arXiv+preprint+arXiv%3A2507%2E08270%2E+%E2%80%94+%5BarXiv%3A2507%2E08270%5D%28https%3A%2F%2Farxiv%2Eorg%2Fabs%2F2507%2E08270%29)
30. Jiawen Shi, Yixin Liu, Pan Zhou, and Lichao Sun. 2023. Badgpt: Exploring security vulnerabilities of chatgpt via backdoor attacks to instructgpt. arXiv preprint arXiv:2304.12298. — [arXiv:2304.12298](https://arxiv.org/abs/2304.12298) [find](https://scholar.google.com/scholar?q=Jiawen+Shi%2C+Yixin+Liu%2C+Pan+Zhou%2C+and+Lichao+Sun%2E+2023%2E+Badgpt%3A+Exploring+security+vulnerabilities+of+chatgpt+via+backdoor+attacks+to+instructgpt%2E+arXiv+preprint+arXiv%3A2304%2E12298%2E+%E2%80%94+%5BarXiv%3A2304%2E12298%5D%28)
31. Jiawen Shi, Zenghui Yuan, Guiyao Tie, Pan Zhou, Neil Zhenqiang Gong, and Lichao Sun. 2025a. Prompt injection attack to tool selection in llm agents. arXiv preprint arXiv:2504.19793. — [arXiv:2504.19793](https://arxiv.org/abs/2504.19793) [find](https://scholar.google.com/scholar?q=Jiawen+Shi%2C+Zenghui+Yuan%2C+Guiyao+Tie%2C+Pan+Zhou%2C+Neil+Zhenqiang+Gong%2C+and+Lichao+Sun%2E+2025a%2E+Prompt+injection+attack+to+tool+selection+in+llm+agents%2E+arXiv+preprint+arXiv%3A2504%2E19793%2E+%E2%80%94+%5BarXiv%3A2504%2E1979)
32. Tianneng Shi and 1 others. 2025b. Progent: Programmable privilege control for llm agents. arXiv preprint arXiv:2504.11703. [find](https://scholar.google.com/scholar?q=Tianneng+Shi+and+1+others%2E+2025b%2E+Progent%3A+Programmable+privilege+control+for+llm+agents%2E+arXiv+preprint+arXiv%3A2504%2E11703%2E)
33. Noah Shinn, Federico Cassano, Ashwin Gopinath, Karthik Narasimhan, and Shunyu Yao. 2023. [Reflexion: language agents with verbal reinforcement learning](https://md.research.elamur.ai/free/en/papers/shinn-2023-reflexion-language-agents-verbal-reinforcement/). In Advances in Neural Information Processing Systems, volume 36, pages 8634–8652. Curran Associates, Inc.
34. Xiangru Tang, Qiao Jin, Kunlun Zhu, Tongxin Yuan, Yichi Zhang, Wangchunshu Zhou, Meng Qu, Yilun Zhao, Jian Tang, Zhuosheng Zhang, Arman Cohan, Zhiyong Lu, and Mark Gerstein. 2024. Prioritizing safeguarding over autonomy: Risks of LLM agents for science. In ICLR 2024 Workshop on Large Language Model… [find](https://scholar.google.com/scholar?q=Xiangru+Tang%2C+Qiao+Jin%2C+Kunlun+Zhu%2C+Tongxin+Yuan%2C+Yichi+Zhang%2C+Wangchunshu+Zhou%2C+Meng+Qu%2C+Yilun+Zhao%2C+Jian+Tang%2C+Zhuosheng+Zhang%2C+Arman+Cohan%2C+Zhiyong+Lu%2C+and+Mark+Gerstein%2E+2024%2E+Prioritizing+safegua)
35. Xuemeng Tian, Yikai Guo, Bin Ge, Xiaoguang Yuan, Hang Zhang, Yuting Yang, Wenjun Ke, and Guozheng Li. 2024. Agent-da: Enhancing low-resource event extraction with collaborative multi-agent data augmentation. Knowledge-Based Systems, 305:112625. [find](https://scholar.google.com/scholar?q=Xuemeng+Tian%2C+Yikai+Guo%2C+Bin+Ge%2C+Xiaoguang+Yuan%2C+Hang+Zhang%2C+Yuting+Yang%2C+Wenjun+Ke%2C+and+Guozheng+Li%2E+2024%2E+Agent%2Dda%3A+Enhancing+low%2Dresource+event+extraction+with+collaborative+multi%2Dagent+data+augmen)
36. Yu Tian, Xiao Yang, Jingyuan Zhang, Yinpeng Dong, and Hang Su. 2023. Evil geniuses: Delving into the safety of llm-based agents. arXiv preprint arXiv:2311.11855. — [arXiv:2311.11855](https://arxiv.org/abs/2311.11855) [find](https://scholar.google.com/scholar?q=Yu+Tian%2C+Xiao+Yang%2C+Jingyuan+Zhang%2C+Yinpeng+Dong%2C+and+Hang+Su%2E+2023%2E+Evil+geniuses%3A+Delving+into+the+safety+of+llm%2Dbased+agents%2E+arXiv+preprint+arXiv%3A2311%2E11855%2E+%E2%80%94+%5BarXiv%3A2311%2E11855%5D%28https%3A%2F%2Farxiv%2Eorg)
37. Guiyao Tie, Jiawen Shi, Pan Zhou, and Lichao Sun. 2026. Badskill: Backdoor attacks on agent skills via model-in-skill poisoning. arXiv preprint arXiv:2604.09378. — [arXiv:2604.09378](https://arxiv.org/abs/2604.09378) [find](https://scholar.google.com/scholar?q=Guiyao+Tie%2C+Jiawen+Shi%2C+Pan+Zhou%2C+and+Lichao+Sun%2E+2026%2E+Badskill%3A+Backdoor+attacks+on+agent+skills+via+model%2Din%2Dskill+poisoning%2E+arXiv+preprint+arXiv%3A2604%2E09378%2E+%E2%80%94+%5BarXiv%3A2604%2E09378%5D%28https%3A%2F%2Farxiv%2Eorg)
38. Guiyao Tie, Pan Zhou, and Lichao Sun. 2025. A survey of ai scientists. arXiv preprint arXiv:2510.23045. [find](https://scholar.google.com/scholar?q=Guiyao+Tie%2C+Pan+Zhou%2C+and+Lichao+Sun%2E+2025%2E+A+survey+of+ai+scientists%2E+arXiv+preprint+arXiv%3A2510%2E23045%2E)
39. Prashant Trivedi, Souradip Chakraborty, Avinash Reddy, Vaneet Aggarwal, Amrit Singh Bedi, and George K Atia. 2025. Align-pro: A principled approach to prompt optimization for llm alignment. arXiv preprint arXiv:2501.03486. — [arXiv:2501.03486](https://arxiv.org/abs/2501.03486) [find](https://scholar.google.com/scholar?q=Prashant+Trivedi%2C+Souradip+Chakraborty%2C+Avinash+Reddy%2C+Vaneet+Aggarwal%2C+Amrit+Singh+Bedi%2C+and+George+K+Atia%2E+2025%2E+Align%2Dpro%3A+A+principled+approach+to+prompt+optimization+for+llm+alignment%2E+arXiv+prep)
40. Alexander Wei, Nika Haghtalab, and Jacob Steinhardt. 2024. [Jailbroken: How does llm safety training fail?](https://md.research.elamur.ai/free/en/papers/wei-2023-jailbroken-llm-safety-training-fail/) Advances in Neural Information Processing Systems, 36.
41. Yuanwei Wu, Xiang Li, Yixin Liu, Pan Zhou, and Lichao Sun. 2023. Jailbreaking gpt-4v via self-adversarial attacks with system prompts. arXiv preprint arXiv:2311.09127. — [arXiv:2311.09127](https://arxiv.org/abs/2311.09127) [find](https://scholar.google.com/scholar?q=Yuanwei+Wu%2C+Xiang+Li%2C+Yixin+Liu%2C+Pan+Zhou%2C+and+Lichao+Sun%2E+2023%2E+Jailbreaking+gpt%2D4v+via+self%2Dadversarial+attacks+with+system+prompts%2E+arXiv+preprint+arXiv%3A2311%2E09127%2E+%E2%80%94+%5BarXiv%3A2311%2E09127%5D%28https%3A%2F%2Farx)
42. Zhen Xiang, Linzhi Zheng, Yanjie Li, Junyuan Hong, Qinbin Li, Han Xie, Jiawei Zhang, Zidi Xiong, Chulin Xie, Carl Yang, and 1 others. 2024. Guarda-gent: Safeguard llm agents by a guard agent via knowledge-enabled reasoning. arXiv preprint arXiv:2406.09187. — [arXiv:2406.09187](https://arxiv.org/abs/2406.09187) [find](https://scholar.google.com/scholar?q=Zhen+Xiang%2C+Linzhi+Zheng%2C+Yanjie+Li%2C+Junyuan+Hong%2C+Qinbin+Li%2C+Han+Xie%2C+Jiawei+Zhang%2C+Zidi+Xiong%2C+Chulin+Xie%2C+Carl+Yang%2C+and+1+others%2E+2024%2E+Guarda%2Dgent%3A+Safeguard+llm+agents+by+a+guard+agent+via+knowl)
43. Qwen An Yang, Baosong Yang, Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chengyuan Li, Dayiheng Liu, Fei Huang, Haoran Wei, Huan Lin, Jian Yang, Jianhong Tu, Jianwei Zhang, Jianxin Yang, Jiaxin Yang, Jingren Zhou, Junyang Lin, Kai Dang, and 23 others. 2024a. Qwen2.5 technical report. [find](https://scholar.google.com/scholar?q=Qwen+An+Yang%2C+Baosong+Yang%2C+Beichen+Zhang%2C+Binyuan+Hui%2C+Bo+Zheng%2C+Bowen+Yu%2C+Chengyuan+Li%2C+Dayiheng+Liu%2C+Fei+Huang%2C+Haoran+Wei%2C+Huan+Lin%2C+Jian+Yang%2C+Jianhong+Tu%2C+Jianwei+Zhang%2C+Jianxin+Yang%2C+Jiaxin+Yan)
44. Wenkai Yang, Xiaohan Bi, Yankai Lin, Sishuo Chen, Jie Zhou, and Xu Sun. 2024b. Watch out for your agents! investigating backdoor threats to llm-based agents. arXiv preprint arXiv:2402.11208. — [arXiv:2402.11208](https://arxiv.org/abs/2402.11208) [find](https://scholar.google.com/scholar?q=Wenkai+Yang%2C+Xiaohan+Bi%2C+Yankai+Lin%2C+Sishuo+Chen%2C+Jie+Zhou%2C+and+Xu+Sun%2E+2024b%2E+Watch+out+for+your+agents%21+investigating+backdoor+threats+to+llm%2Dbased+agents%2E+arXiv+preprint+arXiv%3A2402%2E11208%2E+%E2%80%94+%5BarXiv%3A)
45. Zhejian Yang, Yongchao Chen, Xueyang Zhou, Jiangyue Yan, Dingjie Song, Yinuo Liu, Yuting Li, Yu Zhang, Pan Zhou, Hechang Chen, and 1 others. 2025. Agentic robot: A brain-inspired framework for vision-language-action models in embodied agents. arXiv preprint arXiv:2505.23450. — [arXiv:2505.23450](https://arxiv.org/abs/2505.23450) [find](https://scholar.google.com/scholar?q=Zhejian+Yang%2C+Yongchao+Chen%2C+Xueyang+Zhou%2C+Jiangyue+Yan%2C+Dingjie+Song%2C+Yinuo+Liu%2C+Yuting+Li%2C+Yu+Zhang%2C+Pan+Zhou%2C+Hechang+Chen%2C+and+1+others%2E+2025%2E+Agentic+robot%3A+A+brain%2Dinspired+framework+for+vision%2D)
46. Ziyi Yang, Shreyas S Raman, Ankit Shah, and Stefanie Tellex. 2024c. Plug in the safety chip: Enforcing constraints for llm-driven robot agents. In 2024 IEEE International Conference on Robotics and Automation (ICRA), pages 14435–14442. IEEE. [find](https://scholar.google.com/scholar?q=Ziyi+Yang%2C+Shreyas+S+Raman%2C+Ankit+Shah%2C+and+Stefanie+Tellex%2E+2024c%2E+Plug+in+the+safety+chip%3A+Enforcing+constraints+for+llm%2Ddriven+robot+agents%2E+In+2024+IEEE+International+Conference+on+Robotics+and+Au)
47. Shunyu Yao, Jeffrey Zhao, Dian Yu, Nan Du, Izhak Shafran, Karthik R Narasimhan, and Yuan Cao. 2023. [React: Synergizing reasoning and acting in language models](https://md.research.elamur.ai/free/en/papers/yao-2022-react-synergizing-reasoning-acting-language/). In The Eleventh International Conference on Learning Representations.
48. Yifan Yao, Jinhao Duan, Kaidi Xu, Yuanfang Cai, Zhibo Sun, and Yue Zhang. 2024. [A survey on large language model (llm) security and privacy: The good, the bad, and the ugly](https://md.research.elamur.ai/free/en/papers/yao-2023-survey-large-language-model-llm/). High-Confidence Computing, page 100211.
49. Wuchang Zhong, Jinglin Huang, Maoqiang Wu, Weinan Luo, and Rong Yu. 2025. Large language model based system with causal inference and chain-of-thoughts reasoning for traffic scene risk assessment. Knowledge-Based Systems, 319:113630. [find](https://scholar.google.com/scholar?q=Wuchang+Zhong%2C+Jinglin+Huang%2C+Maoqiang+Wu%2C+Weinan+Luo%2C+and+Rong+Yu%2E+2025%2E+Large+language+model+based+system+with+causal+inference+and+chain%2Dof%2Dthoughts+reasoning+for+traffic+scene+risk+assessment%2E+Kno)
50. Sheng Yin, Xianghe Pang, Yuanzhuo Ding, Menglan Chen, Yutong Bi, Yichen Xiong, Wenhao Huang, Zhen Xiang, Jing Shao, and Siheng Chen. 2024. Safeagentbench: A benchmark for safe task planning of embodied llm agents. arXiv preprint arXiv:2412.13178. — [arXiv:2412.13178](https://arxiv.org/abs/2412.13178) [find](https://scholar.google.com/scholar?q=Sheng+Yin%2C+Xianghe+Pang%2C+Yuanzhuo+Ding%2C+Menglan+Chen%2C+Yutong+Bi%2C+Yichen+Xiong%2C+Wenhao+Huang%2C+Zhen+Xiang%2C+Jing+Shao%2C+and+Siheng+Chen%2E+2024%2E+Safeagentbench%3A+A+benchmark+for+safe+task+planning+of+embodie)
51. Rong Zhou, Dongping Chen, Zihan Jia, Yao Su, Yixin Liu, Yiwen Lu, Dongwei Shi, Yue Huang, Tianyang Xu, Yi Pan, and 1 others. 2026. Digital twin ai: Opportunities and challenges from large language models to world models. arXiv preprint arXiv:2601.01321. — [arXiv:2601.01321](https://arxiv.org/abs/2601.01321) [find](https://scholar.google.com/scholar?q=Rong+Zhou%2C+Dongping+Chen%2C+Zihan+Jia%2C+Yao+Su%2C+Yixin+Liu%2C+Yiwen+Lu%2C+Dongwei+Shi%2C+Yue+Huang%2C+Tianyang+Xu%2C+Yi+Pan%2C+and+1+others%2E+2026%2E+Digital+twin+ai%3A+Opportunities+and+challenges+from+large+language+mod)
52. Tongxin Yuan, Zhiwei He, Lingzhong Dong, Yiming Wang, Ruijie Zhao, Tian Xia, Lizhen Xu, Binglin Zhou, Li Fangqi, Zhuosheng Zhang, Rui Wang, and Gongshen Liu. 2024a. [R-judge: Benchmarking safety risk awareness for LLM agents](https://md.research.elamur.ai/free/en/papers/yuan-2024-r-judge-benchmarking-safety-risk/). In ICLR 2024 Workshop on Large Language Model (LLM) Agents.
53. Xueyang Zhou and et al. 2025. Large reasoning models in agent scenarios: Exploring the necessity of reasoning capabilities. arXiv preprint arXiv:2503. [find](https://scholar.google.com/scholar?q=Xueyang+Zhou+and+et+al%2E+2025%2E+Large+reasoning+models+in+agent+scenarios%3A+Exploring+the+necessity+of+reasoning+capabilities%2E+arXiv+preprint+arXiv%3A2503%2E)
54. Zenghui Yuan, Yixin Liu, Kai Zhang, Pan Zhou, and Lichao Sun. 2023. Backdoor attacks to pre-trained unified foundation models. arXiv preprint arXiv:2302.09360. — [arXiv:2302.09360](https://arxiv.org/abs/2302.09360) [find](https://scholar.google.com/scholar?q=Zenghui+Yuan%2C+Yixin+Liu%2C+Kai+Zhang%2C+Pan+Zhou%2C+and+Lichao+Sun%2E+2023%2E+Backdoor+attacks+to+pre%2Dtrained+unified+foundation+models%2E+arXiv+preprint+arXiv%3A2302%2E09360%2E+%E2%80%94+%5BarXiv%3A2302%2E09360%5D%28https%3A%2F%2Farxiv%2Eorg%2Fa)
55. Xueyang Zhou, Guiyao Tie, Guowen Zhang, Hechang Wang, Pan Zhou, and Lichao Sun. 2025. Badvla: Towards backdoor attacks on vision-language-action models via objective-decoupled optimization. arXiv preprint arXiv:2505.16640. — [arXiv:2505.16640](https://arxiv.org/abs/2505.16640) [find](https://scholar.google.com/scholar?q=Xueyang+Zhou%2C+Guiyao+Tie%2C+Guowen+Zhang%2C+Hechang+Wang%2C+Pan+Zhou%2C+and+Lichao+Sun%2E+2025%2E+Badvla%3A+Towards+backdoor+attacks+on+vision%2Dlanguage%2Daction+models+via+objective%2Ddecoupled+optimization%2E+arXiv+prep)
56. Zenghui Yuan, Jiawen Shi, Pan Zhou, Neil Zhenqiang Gong, and Lichao Sun. 2025. Badtoken: Token-level backdoor attacks to multi-modal large language models. In Proceedings of the Computer Vision and Pattern Recognition Conference, pages 29927–29936. [find](https://scholar.google.com/scholar?q=Zenghui+Yuan%2C+Jiawen+Shi%2C+Pan+Zhou%2C+Neil+Zhenqiang+Gong%2C+and+Lichao+Sun%2E+2025%2E+Badtoken%3A+Token%2Dlevel+backdoor+attacks+to+multi%2Dmodal+large+language+models%2E+In+Proceedings+of+the+Computer+Vision+and+Pa)
57. Zhengqing Yuan, Yixin Liu, Yihan Cao, Weixiang Sun, Haolong Jia, Ruoxi Chen, Zhaoxu Li, Bin Lin, Li Yuan, Lifang He, and 1 others. 2024b. Mora: Enabling generalist video generation via a multi-agent framework. arXiv preprint arXiv:2403.13248. — [arXiv:2403.13248](https://arxiv.org/abs/2403.13248) [find](https://scholar.google.com/scholar?q=Zhengqing+Yuan%2C+Yixin+Liu%2C+Yihan+Cao%2C+Weixiang+Sun%2C+Haolong+Jia%2C+Ruoxi+Chen%2C+Zhaoxu+Li%2C+Bin+Lin%2C+Li+Yuan%2C+Lifang+He%2C+and+1+others%2E+2024b%2E+Mora%3A+Enabling+generalist+video+generation+via+a+multi%2Dagent+f)
58. Chen Z, Xiang Z, Xiao C, Song D, and Li B. 2024. Agentpoison: Red-teaming llm agents via poisoning memory or knowledge bases. In Advances in Neural Information Processing Systems, pages 130185– 130213. [find](https://scholar.google.com/scholar?q=Chen+Z%2C+Xiang+Z%2C+Xiao+C%2C+Song+D%2C+and+Li+B%2E+2024%2E+Agentpoison%3A+Red%2Dteaming+llm+agents+via+poisoning+memory+or+knowledge+bases%2E+In+Advances+in+Neural+Information+Processing+Systems%2C+pages+130185%E2%80%93+130213)
59. Qiusi Zhan, Zhixiang Liang, Zifan Ying, and Daniel Kang. 2024. [Injecagent: Benchmarking indirect prompt injections in tool-integrated large language model agents](https://md.research.elamur.ai/free/en/papers/zhan-2024-injecagent-benchmarking-indirect-prompt-injections/). arXiv preprint arXiv:2403.02691.
60. Jinchuan Zhang and 1 others. 2025. Agentalign: Navigating safety alignment in the shift from informative to agentic large language models. arXiv preprint arXiv:2505.23020. — [arXiv:2505.23020](https://arxiv.org/abs/2505.23020) [find](https://scholar.google.com/scholar?q=Jinchuan+Zhang+and+1+others%2E+2025%2E+Agentalign%3A+Navigating+safety+alignment+in+the+shift+from+informative+to+agentic+large+language+models%2E+arXiv+preprint+arXiv%3A2505%2E23020%2E+%E2%80%94+%5BarXiv%3A2505%2E23020%5D%28https%3A%2F)
61. Kai Zhang, Rong Zhou, Eashan Adhikarla, Zhiling Yan, Yixin Liu, Jun Yu, Zhengliang Liu, Xun Chen, Brian D Davison, Hui Ren, and 1 others. 2024a. A generalist vision–language foundation model for diverse biomedical tasks. Nature medicine, 30(11):3129–3141. [find](https://scholar.google.com/scholar?q=Kai+Zhang%2C+Rong+Zhou%2C+Eashan+Adhikarla%2C+Zhiling+Yan%2C+Yixin+Liu%2C+Jun+Yu%2C+Zhengliang+Liu%2C+Xun+Chen%2C+Brian+D+Davison%2C+Hui+Ren%2C+and+1+others%2E+2024a%2E+A+generalist+vision%E2%80%93language+foundation+model+for+diver)
62. Yanzhe Zhang, Tao Yu, and Diyi Yang. 2024b. [Attacking vision-language computer agents via pop-ups](https://md.research.elamur.ai/free/en/papers/zhang-2025-attacking-vision-language-computer-agents/). arXiv preprint arXiv:2411.02391.

*Updated 1 November 2026*