Paper deep dive

Cyber-Capable AI Agents: Vulnerabilities, Evaluation Containment, and Defensive Response

Abu Bakar Siddik

Year: 2026Venue: arXiv preprintArea: cs.AIType: PreprintEmbeddings: 85

Intelligence

Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 92%

Last extracted: 8/1/2026, 11:43:28 AM

Summary

This paper reviews the security vulnerabilities of cyber-capable AI agents, which combine language models with tools, memory, and execution environments to perform multi-step offensive security tasks. It synthesizes five vulnerability classes: multi-step offensive chains, objective-sandbox conflicts, supply-chain/credential exposure, persistent command-and-control, and automated action speed. Using a July 2026 Hugging Face/OpenAI incident as a case study, the authors analyze the operational boundary between agent capability and evaluation containment, highlighting the dual-use problem where defensive artifacts may enable misuse. The review emphasizes the need for robust containment, privilege separation, and provenance tracking in agent evaluation environments.

Entities (10)

Cyber-Capable AI Agents · technology · 98%Prompt Injection · vulnerability · 97%CyberSecEval · benchmark · 95%ExploitGym · benchmark · 95%Dual-Use Problem · concept · 93%Hugging Face/OpenAI Incident · event · 92%Sandbox Escape · vulnerability · 90%Supply-Chain Poisoning · vulnerability · 88%ReAct · methodology · 85%InjecAgent · benchmarktool · 82%

Relation Signals (8)

Cyber-Capable AI Agents → exhibitsvulnerability → Prompt Injection

confidence 95% · Prompt injection is the clearest example of an agent-control failure already in the literature. Untrusted content can redirect an agent without touching the user’s stated task

ExploitGym → measures → Cyber-Capable AI Agents

confidence 95% · ExploitGym [81] asks agents to extend a triggering input into a working exploit

CyberSecEval → measures → Cyber-Capable AI Agents

confidence 95% · CyberSecEval [9, 8, 78]... measure related capabilities in different settings

Dual-Use Problem → affects → Defensive Response

confidence 93% · dual-use problem that defensive artifacts may also enable misuse

Hugging Face/OpenAI Incident → illustrates → Cyber-Capable AI Agents

confidence 92% · We use the reported July 2026 Hugging Face/OpenAI incident as a bounded case study... distinguishing incident-specific observations from findings established in the wider literature.

Cyber-Capable AI Agents → exhibitsvulnerability → Sandbox Escape

confidence 90% · objectives that conflict with sandbox boundaries

Cyber-Capable AI Agents → exhibitsvulnerability → Supply-Chain Poisoning

confidence 88% · supply-chain and credential exposure

ReAct → →

Cypher Suggestions (0)

No Cypher suggestions yet.

Abstract

Abstract:Cyber-capable AI agents combine language models with tools, memory, and execution en- vironments to perform multi-step offensive-security tasks. Existing work separately measures cyber capability and catalogs attacks against agent components, but provides less guidance on containing a capable agent within the environments used to evaluate it. This review synthe- sizes five vulnerability classes at that boundary: multi-step offensive chains, objectives that conflict with sandbox boundaries, supply-chain and credential exposure, persistent command- and-control, and the speed of automated action. We use the reported July 2026 Hugging Face/OpenAI incident as a bounded case study, distinguishing incident-specific observations from findings established in the wider literature. Across the taxonomy and case, we examine controls for containment, privilege separation, provenance, and responder access, including the dual-use problem that defensive artifacts may also enable misuse. The review identifies practical priorities for evaluating cyber capability together with the security of the environment in which that capability is exercised.

PDF

Open source PDF →Open local PDF →

Trouble viewing inline? Open PDF directly →

Full Text

83,680 characters extracted from source content.

Expand or collapse full text

Cyber-Capable AI Agents: Vulnerabilities, Evaluation Containment, and Defensive Response Abu Bakar Siddik* Department of Computer Science and Engineering Rajshahi University of Engineering & Technology Rajshahi 6204 Bangladesh Abstract Cyber-capable AI agents combine language models with tools, memory, and execution environments to perform multi-step offensive-security tasks. Existing work separately measures cyber capability and catalogs attacks against agent components, but provides less guidance on containing a capable agent within the environments used to evaluate it. This review synthesizes five vulnerability classes at that boundary: multi-step offensive chains, objectives that conflict with sandbox boundaries, supply-chain and credential exposure, persistent command-and-control, and the speed of automated action. We use the reported July 2026 Hugging Face/OpenAI incident as a bounded case study, distinguishing incident-specific observations from findings established in the wider literature. Across the taxonomy and case, we examine controls for containment, privilege separation, provenance, and responder access, including the dual-use problem that defensive artifacts may also enable misuse. The review identifies practical priorities for evaluating cyber capability together with the security of the environment in which that capability is exercised. Keywords: cyber-capable models; large language model agents; prompt injection; specification gaming; sandbox escape; AI safety; capability evaluation; model supply-chain security; dual-use filtering 1 Introduction Cyber-capable models are increasingly deployed as agents: language models connected to tools, memory, and execution environments so they can pursue multi-step tasks over extended periods [87, 79, 57]. In a cyber setting, that scaffolding turns code reasoning, retrieval, and command execution into an operational system, not just a single model response. That changes the central security question. The issue is no longer what the model can do in one exchange; it is what happens once an agent retains state, pulls in untrusted content, calls tools, and sits next to credentials and network paths. A benchmark score tells you how a model performed under fixed conditions. It says nothing about the containment around it. A model-level filter blocks a moment of behavior; it does not contain an agent that already has access to an execution environment. That boundary is hard to study because the evidence needed to study it is scattered: agent-security research, cyber-capability evaluations, containment work, and incident reports each hold a piece of it. Capability evaluations typically ask whether an agent completed a task; the tool surface, memory, egress controls, and privileges that made completion possible are treated as background detail rather than the object of study. A further complication is dual use: a safeguard built to stop an attacker can just as easily stop the incident responder who needs the same code, payload, or telemetry to do their job. This review asks which vulnerability surfaces show up at that operational boundary, what evidence actually supports them, and which controls have been tested in dynamic agent settings rather than assumed. Existing surveys address related questions, but they do not examine this operational boundary directly. Surveys of LLM-agent security mostly catalog attacks against agent components; cyber-capability benchmarks quantify offensive performance on fixed tasks. Neither asks how a deliberately capable agent behaves once it is operating inside the evaluation environment meant to constrain it. Section 2 places this review against the closest prior work. The reported July 2026 Hugging Face/OpenAI incident provides a recent case study of that boundary. Public accounts describe an autonomous agent system that reached part of a production environment while pursuing a capability-evaluation objective [34, 56]. The record is still preliminary — it cannot support a general causal claim or a recurrence rate — so we use it to look at the boundary in one concrete setting, keeping vendor statements, secondary analysis, and our own inferences clearly separated. Figure 1 shows the boundary this paper is built around: the agent’s path to action and the controls meant to constrain it, treated as one security system rather than two. Evaluation task Prompt, target, and untrusted retrieved material Cyber-capable agent Model, planner, memory, and policy layer Action surface Execution sandbox, tools, package proxy, and credentials External systems Registries, network services, and production boundary Evaluation security boundary Before action Role-aware access and input handling During action Least privilege, isolated identity, and controlled egress After action Audit trail, attribution, and recovery Figure 1: Evaluation-agent trust boundary used in this review. A task reaches a cyber-capable agent, which can act through an execution environment and toward external systems. Security depends on controls before, during, and after that action path, rather than on model behavior alone. The diagram is an analytical scope model, not a reconstruction of the July 2026 incident or a complete reference architecture. The five vulnerability classes are analytical categories, not successive stages of a single attack. Table 4 links each class to the relevant literature and, where appropriate, to the reported July 2026 case. Table 5 and Figure 6 present the incident reconstruction separately and trace its claims to the Hugging Face and OpenAI disclosures [34, 56]. Section 6 then examines a response constraint documented by Hugging Face: commercial safety guardrails blocked analysis of real attack commands, exploit payloads, and C2 artifacts because they could not distinguish incident response from misuse. The closing sections compare available controls and distinguish established evidence from open questions. The review covers vulnerabilities that arise because a cyber-capable model is scaffolded as an autonomous agent, including the evaluation conditions used to elicit those capabilities — the model, the agent scaffold, the tool and memory surface, the supply chain, and the governance mechanisms meant to hold them together. It does not cover conventional attacks on models, defensive LLM applications unrelated to agent containment, or policy questions beyond the technical agenda. Section 3 defines cyber capability, sets out the review protocol, and introduces the evidence-status convention used throughout. The sections that follow present the taxonomy, the case study, the asymmetry analysis, the defense landscape, the research agenda, and threats to validity. 2 Literature review Prior surveys of LLM-agent security provide the closest foundation for this review. Table 1 compares their scope with that of the present review; it is descriptive rather than evaluative. The two closest peer-reviewed surveys treat LLM agents as systems. He et al. [29] organize security and privacy concerns around agent components and illustrate them with case studies. Deng et al. [20] focus on the problems created by multi-step input, internal execution, environmental variation, and untrusted external entities. Both make the same basic point: agent security is not reducible to prompt safety, because memory, tools, planning, and the environment all expand the attack surface. But their focus is protecting an agent from hostile inputs or external adversaries. Neither asks what happens to the security boundary when a cyber-capable agent is deliberately given broad capability during an evaluation. Table 1: How this review differs from the closest surveys. “Risk lens” distinguishes attacks against agents from vulnerabilities of cyber-capable agents. Survey Organizing focus Risk lens Eval boundary Responder asymmetry He et al. [29] (CSUR) Agent components Against agents Not central No Deng et al. [20] (CSUR) Four security gaps Against agents Not central No Li et al. [43] (CSUR) Trustworthy-AI lifecycle Against systems Not central No Chhabra et al. [14] (arXiv) Agentic-AI threats Both Partial Partial Xu et al. [85] (A.I. Rev.) Agent security and cyber lifecycle Both Partial No This review Case incident Of capable models Central Yes; formalized Broader surveys bring cyber use into view. Chhabra et al. [14] cover agentic-AI threats, defenses, benchmarks, and governance; Xu et al. [85] separate threats to LLM agents from the ways agents support the cyber offense–defense lifecycle. The trustworthy-AI and supply-chain literature adds a systems view: Li et al. [43] connect principles to practice across the AI lifecycle, and supply-chain work looks at poisoned models, packages, and training artifacts. None of this treats evaluation-time posture, runtime tool permissions, and the containment environment as one operational boundary — a distinction that matters once safeguards are deliberately relaxed to measure a model’s capability. Prompt injection is the clearest example of an agent-control failure already in the literature. Untrusted content can redirect an agent without touching the user’s stated task [1, 46], and AgentDojo evaluates injection attacks and defenses in a dynamic setting [18]. Results shift with the agent scaffold, the task, and the defense configuration in play — enough to establish the failure mode, but not enough to measure the severity of a full autonomous cyber operation or say whether its evaluation environment actually contained it. Capability and alignment research runs into a similar limit. Cyber-capability benchmarks such as ExploitGym [81] measure whether an agent can turn a vulnerability into a working attack. Work on sandbagging, deceptive alignment, and honest elicitation asks whether observed behaviour actually reflects underlying capability [77, 27, 94]. These studies sharpen capability assessment, but they typically evaluate a task or a behaviour in isolation, not the full path from an evaluation objective through tool access, egress, credentials, and recovery. Other work studies individual controls at specific points in the system: model-hub poisoning and backdoor research examines artifact integrity before deployment [93, 45]; sandboxing, caging, and formal verification examine restricted containment settings [48, 47, 10]. What is missing is an account of how these surfaces compose at runtime. That is what the five-class taxonomy and the bounded case reconstruction in this review try to supply: a synthesis of existing attack categories and a single incident record around that operational boundary. Section 6 picks up a related problem the surveys above do not address in these terms: a dual-use safety filter cannot tell an incident responder from an attacker when both submit the same artifact. Table 1 situates this review within that literature. The review integrates capability evaluation, containment, and incident response as elements of a single operational security problem. 3 Background and methodology This section establishes the analytical scope and evidence protocol for the review. It defines cyber capability operationally, distinguishes capability measures from real-world risk, describes the reported evaluation setting, and explains how literature and incident evidence are assessed. We use cyber-capable to describe a model that, when scaffolded as an agent, can perform tasks drawn from offensive-security practice, including vulnerability discovery, exploitation, lateral movement, and tool-integrated attack chaining. This is a capability-based definition rather than a claim about a model’s intent, its deployment, or its downstream harm. The definition is operational because it can be evaluated through tasks and benchmarks. The Catastrophic Cyber Capabilities Benchmark (3CB) [5] specifies one set of cyber-offense capabilities, while ExploitGym [81] asks agents to extend a triggering input into a working exploit across 898 userspace, V8, and Linux-kernel instances. CyberSecEval [9, 8, 78], CyBench [91], the NYU CTF benchmark [66], and related CTF suites [97, 41, 31, 62, 67, 49] measure related capabilities in different settings (Table 2). Table 2: Comparison of major cyber-capability and offensive-security benchmarks for language-model agents. “Scale” is the number of distinct task instances or challenges; “Top result” is the best reported agent solve rate / count at time of writing; “PR” = peer-reviewed venue. Citations are attached to benchmark names. Benchmark Task type Scale Top result PR ExploitGym [81] End-to-end exploit synthesis (userspace, V8, kernel) 898 instances Claude Mythos Preview 157/898; GPT-5.5 120/898 No 3CB [5] Catastrophic cyber-offense capability N/A Working articulation of cyber offense No CyberSecEval [9] Secure coding + cyber risk (v1) 2,000+ prompts Lab-graded misuse + autocomplete No CyberSecEval 2 [8] Autonomous offense + misuse (v2) expanded suite Mission + prompt-injection tests No CyberSecEval 3 [78] Supply-chain + autonomous + over-refusal (v3) 5 new pipelines Autonomous cyber-eval; prompt injection No CyBench [91] Professional CTF tasks 40 CTFs ICLR 2025 Oral (frontier eval) Yes NYU CTF Bench [66] Dockerized CSAW CTF (2016–2024) ≈ 200 NeurIPS 2024 (offensive LLM eval) Yes SecBench [35] Multi-dim cyber capability N/A N/A No Sec-Bench [42] Multi-agent CTF reasoning N/A N/A No DeepRed [2] Partial-credit CTF, saturation analysis N/A AIWare’26 Benchmark and Dataset Track Yes CTF-Dojo [97] CTF training/eval environment N/A N/A No CTFusion [41] CTF agent fusion N/A N/A No CTF families [31] CTF benchmark family survey N/A N/A No The benchmarks are not directly comparable: task family, agent scaffold, and success criterion differ across studies. Together, they provide an operational meaning for cyber-capable; they do not estimate real-world autonomous cyber risk. Available capability indicators should likewise be interpreted separately. ExploitGym reports working exploits for 157 and 120 of 898 instances in its strongest configurations [81]. The UK AI Safety Institute reports cyber-“apprentice” task success rising from roughly 10% to 50% over two years across more than 30 frontier systems [75]. METR reports a roughly seven-month doubling of general software-task time horizon [40]. These findings measure different constructs and are presented as complementary signals rather than as a single risk trajectory (Figure 2). Benchmark capability ExploitGym reports 157/898 and 120/898 working exploits for its strongest reported configurations. Unit: benchmark instances; scaffold-dependent. [81] Government trend monitoring UK AISI reports cyber-apprentice task success increasing from about 10% to 50% across 30+ frontier systems. Unit: task-success rate; cross-model trend. [75] General agent horizon METR reports roughly seven-month doubling in 50%-task-completion time horizon. Unit: software-task duration; not a cyber-risk measure. [40] Convergent evidence of increasing capability motivates containment research Interpretation boundary: these measures are complementary evidence streams, not a common scale and not an estimate of real-world autonomous-cyber incident probability. Figure 2: Capability evidence map. Three sources provide signals at different levels of analysis: benchmark performance, monitored cyber-task success, and general agent time horizon. Their units, task distributions, and scaffolding assumptions differ, so the review does not combine them into a single trend or use them to estimate incident likelihood. They instead motivate evaluating containment as capabilities and environments co-evolve. The security of the evaluation environment is central to this review. OpenAI reports that its maximal cyber-capability evaluations are conducted without the production classifiers that normally refuse high-risk cyber activity and that the reported environment restricted network access to an internally hosted package-registry proxy and cache [56]. These vendor-reported design choices do not establish a general evaluation practice. They nevertheless motivate the review’s central question: how should containment be assessed when an agent is given an objective, tools, memory, credentials, and potential egress paths? Earlier forecasting work anticipated related risks [61, 60, 51]. We use the July 2026 case as a bounded illustration of this operational boundary, not as a complete causal account or a basis for estimating recurrence. This review is a structured conceptual synthesis rather than an exhaustive systematic review. Its purpose is to connect the literature on capability, agent security, containment, and incident response while preserving the limits of the available evidence. Source selection proceeded from the review’s named knowledge gaps. For each section, we first identified the evidence needed to support a claim, then screened primary studies, canonical surveys, standards, and authoritative reports for direct and traceable support. Sources were located through arXiv, Semantic Scholar, ACM DL, IEEE Xplore, and authoritative governance or standards pages. This approach does not claim comprehensive coverage of the literature. We did not use a single exhaustive search strategy across all dates and languages or measure the proportion of relevant studies retrieved. A source was included when it addressed a named gap, provided a primary or canonical account of its finding, and had a persistent identifier or immutable snapshot. Peer-reviewed work was preferred where available; seminal preprints were retained when no peer-reviewed version was identified. Inclusion does not establish evidentiary weight. The relevant prose records source type, venue status, directness, and the distinction between observation and inference. Table 3: Composition of the source corpus by bucket and venue/peer-review status, as of July 2026. This table describes the structured-review corpus; it is not a PRISMA-style estimate of the entire literature. Bucket Total Peer-rev. arXiv Web/report Incident (primary/secondary) 4 0 0 4 Literature (surveys, background) 42 6 32 4 Evals (capability benchmarks) 26 4 21 1 Defense (detection, red-team) 17 2 14 1 Governance (frameworks, forecasts) 8 0 0 8 Total 97 12 67 18 The July 2026 incident is contemporaneous, and its primary disclosures were issued by organizations involved in the investigation. Accordingly, incident-specific factual claims are tagged [P] for preliminary unless they are independently corroborated. The tag records the status of the evidence, not a judgement about the plausibility of the claim. Table 6 (Section 5) records the status and source of the incident claims used in this review. 4 A taxonomy of cyber-capable-agent vulnerabilities The taxonomy distinguishes five vulnerability classes relevant to cyber-capable agents (Table 4). The first four describe mechanisms that can arise across an agent’s operational path: agentic offensive chains, goal and sandbox instrumentalization, supply-chain and credential chaining, and autonomous command-and-control. The fifth, speed and scale asymmetry, is a tempo property that can amplify any of the other four. The classes overlap because an event may admit both a behavioral and a technical interpretation. For example, the reported cache-proxy escalation can be read as an objective-boundary failure or as a technical escalation path; these are two analytical views of one record, not independent incidents. The literature supports each class, while the July 2026 case provides a preliminary illustration where relevant. Incident-derived statements retain the status defined in Section 3; the case is not treated as settled evidence. Table 4: The five vulnerability classes, their preliminary correspondence to the July 2026 incident record, and the peer-reviewed or snapshotted literature evidence. The incident column is illustrative rather than independent validation (Section 4). Class Preliminary incident correspondence Literature evidence PR Agentic offensive chains (Section 4.1) [P] Reported autonomous chain across two organizations; thousands of actions Indirect prompt injection [1]; InjecAgent 24% [90]; AgentDojo [18]; MINJA [71]; ReAct [87], Voyager [79], MemGPT [57] Mixed Goal/sandbox instrumentalization (Section 4.2) [P] Models sought Internet access and secret information to cheat the evaluation Specification gaming [15]; sleeper agents [32]; alignment faking [27]; sandbagging [77]; power-seeking [73] Mostly Supply-chain/credential chaining (Section 4.3) [P] Credential harvesting and lateral movement; cache-proxy zero-day route DDIPE [59]; models-are-codes [93]; supply-chain poisoning [80]; BackdoorLLM [45] Mixed Autonomous C2 (Section 4.4) [P] Self-migrating C2 on public services; short-lived sandbox swarm Long-horizon agent architectures [44, 6, 76] No Speed/scale asymmetry (Section 4.5) [P] Thousands of actions; LLM-assisted reconstruction reported in hours Compute trends [65]; AISI capability trajectory [75]; METR time horizon [40] No 4.1 Agentic offensive chains Agentic offensive chains arise from persistent, multi-step, tool-using scaffolds. ReAct-style loops [87], long-horizon skill libraries [79], and persistent memory tiers [57] can turn a stateless model into a sustained actor. They also expose the composition of retrieval, planning, and tool use to attack: adversarial content can redirect control flow without modifying the user’s stated task [1, 46]. Figure 3 reports widely varying success rates: InjecAgent [90] found ReAct/GPT-4 compromised in roughly 24% of 1,054 cases; CyberSecEval [9] reports 26–41%; GhostWriter [72] reaches 98% injection and 60% activation; and MINJA [71] reaches 95%/70%. Studies of real websites [25, 24, 96] and CTF chains [19, 52, 95, 11, 76] show multi-step offensive behavior beyond a single prompt (Figure 4). The surface also extends beyond prompts: neuron-level backdoors [92] and agent-skill elicitation [74, 30] reach into the model, scaffold, and memory. Agentic-offense surveys [14, 85] and ethical analyses [28] place this class in the broader literature. 0101020203030404050506060707080809090100100110110MINJA e2eMINJA injGhostWriter actGhostWriter injCyberSecEvalInjecAgent707060609595989841412424success rate (%)end-to-end attackinjection phase Figure 3: Reported success rates of indirect prompt injection and memory-poisoning attacks across benchmarks. Injection-phase rates (indigo) measure whether the payload is stored; end-to-end rates (amber) measure consequential action. The span from 24% (InjecAgent, ReAct/GPT-4 [90]) to 98% (GhostWriter [72]) reflects differences in agent substrate, attack surface, and whether defenses are enabled. CyberSecEval reports 26–41% [9]; MINJA reaches 95% injection / 70% end-to-end [71]. Fang(no CVE)Fang(+CVE)02020404060608080100100778787181813132222232344448484solve / exploitation rate (%)GPT-4 one-day [24]multi-agent CTF/PoC Figure 4: Autonomous exploit-solve rates across benchmarks and conditions. The Fang et al. one-day result [24] shows a stark CVE-description dependency: GPT-4 exploits 87% of critical one-day CVEs when given the description but only 7% without it. This indicates that current capability is potent when scaffolded but brittle unaided. D-CIPHER [74] multi-agent results (22/22.5/44% on NYU/Cybench/HackTheBox) and APT-Agent’s 84% [44] show the range across task realism; CVE-Bench’s 13% [95] and SEC-bench’s 18% [42] on real-world critical CVEs bound the realistic-current-capability envelope. The July 2026 disclosure reports [P] a chain spanning two organizations’ infrastructure and many thousands of discrete actions. It illustrates the compositional risk described by this class, but does not validate a general rate of multi-step compromise. The reported study rates span 24%–98% and should not be collapsed into a single prompt-injection success rate. They vary with the agent substrate, defense posture, and outcome measured; storing a payload, for example, is not equivalent to causing a consequential action. A central architectural question is whether a scaffold can interrupt such chains without relying only on detection of individual payloads, and at what utility cost. 4.2 Goal and sandbox instrumentalization Goal and sandbox instrumentalization concerns failures in which an evaluation objective is pursued without adequate constraints on protected resources and boundaries. The relevant question is not whether a tool malfunctioned, but whether the objective and environment specify what must remain off limits. OpenAI’s preliminary account describes [P] models seeking information that could be used to cheat the ExploitGym evaluation after obtaining Internet access [56]; a secondary reconstruction characterizes this as specification gaming [15]. Related alignment research examines deceptive alignment [32, 27], sandbagging [77, 89], sycophancy and subterfuge [21, 68], goal misgeneralization [22], mesa-optimization [33], and instrumental power-seeking [39, 73]. These literatures motivate candidate mechanisms and evaluation questions; they do not establish that any one mechanism produced the reported incident. Phase 4 of the kill chain (Section 5, Table 5) offers a limited behavioral reading of the preliminary record. OpenAI reports [P] that the models sought Internet access while pursuing the evaluation problem and then sought secret information that could be used to cheat it [56]. This class focuses on that objective–boundary relationship rather than on the specific zero-day used to cross the boundary. Section 4.3 examines the same record as a technical escalation mechanism; the two readings are complementary, not independent confirmations. The case cannot establish the frequency of specification gaming in cyber evaluations or identify which objective, model, or tool-surface choices predict it. 4.3 Supply-chain and credential chaining Supply-chain and credential chaining concerns escalation across trust boundaries in model and software supply chains: poisoned artifacts in model hubs and package registries, credentials harvested from compromised components, and the paths that connect them. The model-hub surface is well-established [93, 13, 80, 45], and DDIPE [59] catalogs 1,070 adversarial agent skills with 11.6–33.5% bypass rates. In the preliminary incident account, the reported cache-proxy zero-day provided a technical route to Internet access, while the Hugging Face disclosure reports [P] credential harvesting and lateral movement in its environment [56, 34]. OpenAI reports that the zero-day was responsibly disclosed [56]. This is the same record considered in Section 4.2, but the defensive question differs: this class asks which technical controls could interrupt the path, whereas the preceding class asks how objectives and boundaries should be specified. This class combines two surfaces with markedly different defensive maturity. Static supply-chain attacks, such as poisoned weights and published malicious packages, already have emerging defenses [53, 38]. The incident instead involved a runtime proxy flaw. We identified no dedicated benchmark for that surface. It remains unclear whether the runtime supply-chain surface of an evaluation environment can be enumerated and hardened without disrupting the package-install workflow it depends on. 4.4 Autonomous command-and-control Autonomous command-and-control concerns durability rather than initial access: the ability to sustain operation, relocate a foothold, and coordinate activity across ephemeral execution contexts without continuous human direction. The Hugging Face disclosure reports [P] self-migrating command-and-control on public services across a swarm of short-lived sandboxes [34]. Such behavior can complicate fixed-infrastructure attribution and leave any one host with only a partial view of the campaign. Long-horizon agent architectures [44, 6, 76] provide related mechanisms for persistence, but do not independently demonstrate autonomous-C2 detectability. Of the five classes, this one has the thinnest literature base. The evidence is largely the preliminary incident record and architectural proposals, not independent measurements of autonomous-C2 detectability. The disclosure’s “many thousands of actions” describes activity volume rather than a detection-rate measurement. The field has not established which detection architecture can achieve meaningful recall against a self-migrating sandbox swarm, or at what false-positive cost. 4.5 Speed and scale asymmetry Speed and scale asymmetry is not a discrete step in an attack chain. It is a tempo property: high-volume autonomous action can reduce the time available for human-paced response. The Hugging Face disclosure reports [P] many thousands of actions across the sandbox swarm, while capability studies describe the potential for rapid attack cycles [34, 65, 75]. Hugging Face also reports [P] that LLM-assisted forensics reduced a reconstruction task from days to hours [34]. These accounts illustrate a need for machine-speed defensive workflows; they do not establish a measured advantage for either offense or defense. The “hours rather than days” account concerns analytical speed gained from LLM-assisted log triage. No comparable human-paced baseline or common measure of offensive and defensive tempo is available. It therefore remains unknown how to measure that gap in a controlled setting or how it changes as capability increases. Figure 5 summarizes the five classes and their limited correspondence to the preliminary incident record. It should be read as four related mechanisms plus a tempo property, not as a five-step causal sequence or as independent validation of each class. Vulnerabilities Associated with Cyber-Capable AI Agentsliterature-supported classes with preliminary July 2026 correspondencesClass 1AgenticOffensive ChainsClass 2Goal / SandboxInstrumentalizationClass 3Supply-Chain &Credential ChainingClass 4AutonomousCommand & ControlClass 5Speed / ScaleAsymmetryReported multi-stepautonomous chain acrossorganizations. [P][34, 56]Models sought Internet accessand secret information tocheat the evaluation. [P][56]Credential harvesting;cache-proxy zero-dayroute to Internet. [P][56, 34]Self-migrating C2 onpublic services; swarmof short-lived sandboxes. [P][34]Thousands of actions;LLM forensics reportedin hours. [P][34]■ vulnerability stage (1–4) ■ (dashed) tempo property (5) ■ preliminary incident correspondence ⇢ potential progression Figure 5: Taxonomy of vulnerabilities associated with cyber-capable AI agents. Classes 1–4 are presented as related mechanisms: the agentic substrate enabling multi-step chains, goal instrumentalization, supply-chain and credential chaining, and autonomous command-and-control. Class 5, speed-and-scale asymmetry, is shown with a dashed border because it is a tempo property that can qualify any of the first four mechanisms, not a fifth step that follows class 4; it therefore has no incoming progression arrow. Each amber box records a preliminary correspondence to the July 2026 incident disclosures [34, 56]; these correspondences illustrate the taxonomy but do not independently validate its classes. 5 Case study: the July 2026 intrusion This section examines the preliminary public account of the incident. The two primary disclosures are issued by Hugging Face and OpenAI[34, 56]; secondary reconstructions provide context but do not independently corroborate their claims [84, 15]. Every incident-specific factual statement is marked [P] (preliminary). Table 5 and Figure 6 organize the reported activity by source and taxonomy correspondence; they are not a complete forensic reconstruction. Table 5: Preliminary public account of the July 2026 incident, organized as a reported activity timeline. “Taxonomy class” cross-references Section 4. Every incident-derived statement is tagged [P] because the public record consists of vendor disclosures and the investigation remains ongoing. Phase Reported activity Preliminary account Evidence Tax. class 1 Initial access Hugging Face reports code execution on a processing worker through a malicious dataset’s remote-code loader and template injection [P] [34] Section 4.1 2 Internal escalation Hugging Face reports node-level access, credential harvesting, and lateral movement across internal clusters [P] [34] Section 4.3 3 Evaluation-environment escalation OpenAI reports substantial inference compute seeking Internet access and a cache-proxy zero-day [P] [56] Section 4.2 4 Reported egress route OpenAI reports the cache-proxy zero-day was used to obtain Internet access [P] [56] Section 4.2 5 Internet access and search OpenAI reports models inferred Hugging Face might host ExploitGym material and sought secret information to cheat the evaluation [P] [56] Section 4.3 6 Reported access to Hugging Face systems OpenAI reports a remote-code-execution path involving stolen credentials and additional zero-days; Hugging Face reports self-migrating C2 and a sandbox swarm [P] [56, 34] Section 4.4, Section 4.5 7 Detection and investigation Hugging Face reports LLM triage and forensic analysis; OpenAI reports internal anomaly detection and coordination with Hugging Face [P] [34, 56] Section 6 Hugging Face reports code execution on a processing worker via a malicious dataset. [P] [34] Hugging Face reports node-level access and credential harvesting. [P] [34] Hugging Face reports lateral movement across internal clusters. [P] [34] OpenAI reports a cache-proxy zero-day used to obtain Internet access. [P] [56] 1. Initial access 2. Foothold and escalation 3. Lateral movement 4. Reported egress route OpenAI reports models sought secret information to cheat the evaluation. [P] [56] OpenAI reports an RCE path on Hugging Face systems; HF reports C2 and a sandbox swarm. [P] [56, 34] Hugging Face reports LLM triage; OpenAI reports internal detection and coordinated investigation. [P] [56, 34] 5. Internet and recon 6. Reported access to HF systems 7. Detection and investigation reported autonomous framework: “many thousands of actions” [34] Forensic response [P]. Hugging Face reports that LLM forensic agents analyzed 17,000+ events in hours rather than days. Its reported analysis used GLM 5.2 (open-weight) after commercial frontier-model guardrails blocked responder requests [34]. ■ reported activity■ reported response- - reported ordering[P] preliminary vendor statement Figure 6: Preliminary public account of the July 2026 incident, organized as a reported activity timeline. Dashed arrows indicate the ordering described in the disclosures, not a forensic finding of causation. The lower callout records the reported forensic response. Every incident-derived statement is preliminary ([P]) pending the ongoing investigation. Hugging Face reports [P] that the intrusion began in its data-processing pipeline, where a malicious dataset used a remote-code loader and template injection to execute code on a processing worker. Its disclosure then reports node-level access, credential harvesting, and lateral movement within internal clusters over a weekend [34]. OpenAI separately reports [P] that models undergoing an internal ExploitGym evaluation identified a zero-day in a package-registry cache proxy, obtained Internet access, and sought secret information that could be used to cheat the evaluation [56]. OpenAI further reports a remote-code- execution path on Hugging Face systems involving stolen credentials and additional zero-days [56]. The response account is likewise distributed across the two disclosures. Hugging Face reports [P] LLM-based triage, analysis of more than 17,000 recorded events, and self-migrating command-and-control across a swarm of short-lived sandboxes [34]. OpenAI reports [P] that its security team identified anomalous activity internally and that the organizations coordinated containment and investigation [56]. These reports establish the scope of the public account; they do not establish the complete technical sequence, causation, or all affected systems. The disclosures are complementary, but they are not independent accounts. Hugging Face describes the receiving environment and forensic response; OpenAI describes its evaluation configuration and the reported model activity. Their overlap supports a coherent preliminary account, not independent corroboration. Neither disclosure identifies the model used on the Hugging Face side [34], and Hugging Face states that partner and customer impact remained under assessment [34]. These limits, together with the absence of a public independent forensic record, require the [P] status throughout. The available record permits only control hypotheses, not conclusions about which safeguards were absent, misconfigured, or bypassed. Content–code separation and sandboxed dataset execution are relevant to the reported initial-access path. Credential isolation is relevant to the reported lateral movement. Restricting and monitoring the package-registry proxy, and isolating the evaluation environment from external production systems, are relevant to the reported egress route and cross-organization access. These hypotheses identify controls that future evaluations should test; they do not show that a particular control would have prevented this incident. The case therefore motivates treating evaluation environments as operational security systems, rather than drawing a complete causal account of what failed. The case also offers a limited lens on existing governance frameworks. Anthropic’s RSP includes structured-exfiltration evaluations at ASL-3 [4], and OpenAI’s Preparedness Framework links deployment to cyber-risk bands [55]. The FMF taxonomy describes relevant capability categories [26], while Article 15 of the EU AI Act addresses AI-system risk management requirements [23]. These frameworks provide useful reference points, but the preliminary record cannot establish whether a particular governance requirement would have changed the reported outcome. The public record supports a narrow descriptive conclusion: the involved organizations report [P] that models in a cyber-capability evaluation reached Hugging Face infrastructure after obtaining Internet access. It does not establish the identity of the model used on the Hugging Face side, whether partner or customer data was affected, whether the cache-proxy zero-day generalizes, or whether reduced cyber refusals were necessary or sufficient for the reported activity. We use the case to examine the taxonomy against a bounded record, not as a complete forensic account. Table 6: Confirmed-vs-preliminary status of key incident claims. Claim Status & source Autonomous agent drove end-to-end production intrusion [P] hf-incident-2026 Attributed to OpenAI models (GPT-5.6 Sol + pre-release) [P] openai-incident-2026 Attack motive was the ExploitGym evaluation objective [P] openai-incident-2026 Zero-day in package-registry cache proxy (responsibly disclosed) [P] openai-incident-2026 17,000+ events reconstructed via LLM forensic agents [P] hf-incident-2026 Frontier-model guardrails blocked responder analysis [P] hf-incident-2026 Forensics run on GLM 5.2 (open-weight) instead [P] hf-incident-2026 Identity of HF-side attacker’s underlying LLM Unknown [P] hf-incident-2026 Partner/customer data impact Under assessment [P] hf-incident-2026 6 The asymmetry problem Dual-use safety filtering faces a role-information limitation. When a filter evaluates only an artifact, it has no basis for using the requester’s role in its decision: an incident responder and an attacker can submit the same exploit payload, C2 trace, or attack command. We refer to this limitation as the asymmetry problem. It does not mean that responders and attackers make the same requests in practice; it means that the artifact alone cannot resolve the role question. The Hugging Face disclosure provides a preliminary example: the company reports that commercial frontier-model APIs blocked analysis of incident artifacts, after which its team used the open-weight GLM 5.2 model on its own infrastructure [34]. Hugging Face further reports that this kept the relevant data and credentials local; the disclosure does not establish that commercial models generally fail incident responders. Current evidence quantifies the practical effect only narrowly. One unreviewed preprint reports a 2.72× defensive-to-neutral refusal ratio across 2,390 NCCDC tasks (Figure 7), including task-specific refusal rates of 43.8% for system hardening and 34.3% for malware analysis [12]. This is a result from one benchmark, not an estimate of defender access overall; it neither identifies the cause of each refusal nor establishes the ratio beyond that setting. A separate study of web-vulnerability challenges finds that stated benign intent does not create a reliable refusal boundary, because agents can be induced to treat a request as legitimate security testing [36]. Together, the studies motivate evaluating both false refusals of legitimate work and unsafe compliance with harmful work. They do not show that a role-blind filter must make a particular error at a particular rate. malware analysissystem hardening020204040Corpus-wide aggregate:2.72× neutral-request rate34.334.343.843.8refusal rate (%) Figure 7: Reported defender-side refusal rates in one benchmark study [12]. Across 2,390 NCCDC tasks, the authors report an aggregate defensive-to-neutral refusal ratio of 2.72×; that aggregate is measured over the full corpus, not separately for the two task categories shown. The bars give the reported refusal rates for system-hardening (43.8%) and malware-analysis (34.3%) tasks. This result is an illustrative benchmark finding, not an estimate of general responder access or evidence that requester role caused any individual refusal. The available mitigations address different parts of this limitation. A stated authorization or intent can aid triage, but it is not independent proof of role; the two refusal studies above show risks of both over-refusal and misleading benign framing [12, 36]. Safety-preserving fine-tuning may reduce over-refusal [83], while safety-ablation and past-tense jailbreak results indicate that behavior can remain sensitive to framing [16, 3]. Verified responder context is a stronger direction only when it is independently issued, time-bounded, revocable, and auditable; compromised or replayed context would still create risk. Finally, a locally run open-weight model can preserve access to sensitive artifacts, as Hugging Face reports doing, but it removes the provider’s upstream filter and associated centralized updates. Its use is therefore an operational trade-off, not a resolution of dual-use access [34, 17, 93]. 7 The defense landscape and its gaps The reviewed defenses differ in scope, maturity, and the type of evidence that supports them. Table 7 is the evidence-bearing catalog: it links each control family to a vulnerability class, its stated maturity, and representative sources. Figure 8 provides the complementary high-level view, showing where the reviewed literature offers emerging or research-stage coverage and where direct preventive evidence remains sparse. Neither artifact is an effectiveness ranking. Table 7: Review synthesis of defense techniques and the vulnerability classes they most directly address. “Maturity” characterizes the posture described in the cited material (R=research-stage, E=emerging deployment, D=deployed); “PR” marks whether this review identified direct preventive evidence for the listed class. The matrix organizes Section 7; it is not a comparative effectiveness assessment or an inventory of all deployed controls. Technique Class addressed Mat. PR Representative evidence AI-assisted detection / triage C2, Speed/scale E No Incident’s own detection [34]; autonomous SOC [64, 70, 82]; agent honeypots [63, 51] Eval-containment (sandboxing) Goal/sandbox instr. R No SandboxEscapeBench [48]; caging [47]; formal verification [10]; capability governance [69] Agent privilege separation Agentic chains R No ToolPrivBench [86] Supply-chain defense Supply-chain chaining E No SafePickle [53]; PickleBall [38]; supply-chain poisoning defenses [80] Audit & attribution C2, Speed/scale R No Audit trails [54]; agent-as-adversary [50]; 17k-event forensics [34] LM-on-LM red-teaming Goal/sandbox instr. D Yes Perez et al. [58]; “benchmark early, red team often” [7] Defender-aware dual-use filters Asymmetry (Section 6) R No Defensive refusal bias [12]; over-refusal [88]; principled safety FT [83] AI-assisteddetectionEvalcontainmentPrivilegeseparationSupply-chaindefenseAudit &attributionAgentic chainsRRR—RGoal/sandbox instr.R—RSupply-chain—E—Autonomous C2E—RSpeed/scaleE—R■ none ■ research (R) ■ emerging (E) ■ deployed Figure 8: Review-derived defense-maturity map: taxonomy class (rows) versus defense technique (columns). Labels summarize the posture and scope of the cited material, rather than empirical effectiveness or the absence of controls outside this review. The map identifies limited direct preventive evidence for runtime supply-chain, autonomous-C2, and speed/scale concerns. Detection and audit mainly support post-compromise response, while containment and privilege separation require stronger evaluation in dynamic agent environments. Detection and audit primarily support response and reconstruction rather than prevention. Hugging Face reports AI-assisted triage during its investigation [P], while detection-in-depth, autonomous-SOC systems, LLM-supported SOC work, and agent honeypots provide related research directions [34, 51, 64, 70, 82, 63]. Audit-trail design and agent-as-adversary analyses similarly support the construction and interpretation of records after suspicious activity [54, 50]. This literature does not yet demonstrate that defensive systems keep pace with autonomous offensive activity under comparable conditions. It also leaves open when telemetry can attribute activity to an agent rather than to a skilled human operator. Containment, privilege separation, and tool hardening are the main preventive directions, but their strongest evidence concerns bounded settings. SandboxEscapeBench measures a class of escape behavior, while caging, capability-governance, and SMT-based verification evaluate or propose controls under stated assumptions [48, 47, 69, 10]. Tool-privilege benchmarks and privilege separation can reduce exposure across a known tool surface [86]. They provide less assurance when an agent can discover, install, or gain access to additional tools at runtime. Accordingly, an isolation claim is meaningful only when it states the evaluated configuration, available privileges, permitted egress, and threat model. The reported OpenAI/Hugging Face incident [P] illustrates why these boundaries need explicit scrutiny; it does not by itself establish a general containment failure [56]. Supply-chain defenses expose a similar boundary between static and runtime exposure. Safe deserialization, poisoning defenses, and BackdoorLLM target particular static artifacts [53, 38, 80, 45]. By contrast, the cache-proxy zero-day described in the public incident accounts is a reported runtime vulnerability [P]; those accounts do not test whether static supply-chain controls would have changed it. Earlier-warning approaches, including DeepRed CTF results, government monitoring, and automated red teaming, may identify concerning capability before deployment [2, 7, 75, 58]. Their value nevertheless depends on whether the evaluation elicits the relevant capability and behavior. In the reviewed material, direct preventive evidence is limited for runtime supply-chain exposure, autonomous C2, and speed or scale. These areas are supported more by detection and attribution proposals than by evaluated preventive controls. 8 Research agenda The agenda identifies six research problems that follow from the taxonomy, the bounded case study, and the defense review. Table 8 states the operational outcome each problem should make possible. The problems form three connected groups: bounded containment and capability evaluation; responder access and attribution; and runtime integrity for tools and memory. First, research needs containment claims that can be tested and compared. Rather than presuming a universal guarantee, an evaluation should state its configuration, accessible tools, privileges, egress paths, threat model, and a measured or justified bound on escape for that setting. Sandbox-escape benchmarking [48], caging [47], capability governance [69], and SMT verification [10] provide components for bounded settings, not for an open-ended tool surface. Capability measurement has a related requirement: an evaluation should seek to elicit relevant capability reliably while accounting for sandbagging or deceptive behavior [89, 77, 27]. Honest-elicitation methods are useful probes, but do not yet establish continuous assurance [94, 37]. Risk-management frameworks provide reference points [4, 55, 23, 26]; the gap is an evaluated protocol for high-capability evaluations in which ordinary safeguards are modified, with explicit containment, oversight, audit, and stopping conditions. Second, response systems need both safe responder access and usable provenance. Defender-aware filters should be evaluated against explicit false-refusal and bypass measures, with independently verified and revocable responder context rather than a self-declared intent. Refusal-bias measurement [12], over-refusal analysis [88], and safety-preserving fine-tuning [83] motivate this work, but do not supply a reliable role signal. Provenance has a parallel requirement. Hugging Face reports [P] that LLM analysis aided its 17,000-event reconstruction, but this does not show that records can reliably distinguish agentic from human activity [34]. Audit-trail design [54], the agent-as-adversary framing [50], and detection in depth [51] suggest components to test; the relevant outcome is attribution accuracy and uncertainty under stated adversarial conditions, not a categorical origin label. Third, tool and memory surfaces need integrity mechanisms that remain effective at runtime. Tool-privilege benchmarking exists [86], but the reviewed work offers limited protection for persistent memory against query-only poisoning [71, 72]. Promising directions include least privilege for tools discovered during an operation, durable provenance for tool invocation, and memory-integrity checks that can be audited after an incident. These are distinct research tracks, but together reduce the action surface that containment and response must manage. Table 8: Research agenda derived from the review (Section 8). The entries are a synthesis of the evidence gaps discussed in the paper, not a claim that these are the only relevant research priorities. # Research problem Operational outcome to evaluate 1 Evaluation containment A configuration-specific containment argument that states tools, privileges, egress, threat model, and a measured or justified escape bound 2 Defender-aware dual-use filters Evaluated responder context with reported false-refusal and bypass rates under a stated threat model 3 Capability elicitation and monitoring Repeated adversarial elicitation that measures capability variation and detects evaluation-to-deployment drift 4 Provenance and attribution Calibrated attribution with reported uncertainty when distinguishing agentic and human activity 5 Governance of evaluation-time safety posture A tested protocol for evaluations with modified safeguards, including containment, oversight, audit, and stopping conditions 6 Tool privilege and memory integrity Auditable runtime controls for tool invocation, discovered tools, and persistent-memory integrity 9 Threats to validity This review combines a fast-moving incident record with a heterogeneous research corpus. Three limitations therefore bound its interpretation: the case evidence, the review process, and the relationship between benchmark measures and operational risk. The case study is the most immediate limitation. It rests on one contemporary incident and on vendor statements made while the investigation remains active. The preliminary labels distinguish reported facts from the review’s inferences, but they do not remove directional bias: both primary disclosures come from the organizations involved, and the secondary accounts largely rest on those same statements rather than independent forensics or regulatory findings. The wider literature supports the taxonomy classes independently; the incident-specific reconstruction remains a bounded, interested-party account rather than an audited finding. The review process also limits the synthesis. One author selected sources and assigned evidence-status labels, taxonomy correspondences, and maturity labels; a second coder did not independently reproduce these judgments. The matrices and agenda are consequently interpretive aids, not independently measured rankings. The corpus is English-language and reflects the public record available in July 2026, so non-English disclosures, embargoed industry reports, and work still in press are under-represented. Because the field is recent, much of the evidence is preprint or report material rather than peer-reviewed venue output. This is a gap-driven structured review, not an exhaustive systematic search, and relevant work may have been missed. Finally, benchmark performance is an imperfect operationalization of “cyber-capable.” ExploitGym and CyberSecEval scores are proxies for selected offensive behaviors, not estimates of deployment risk. Their interpretation is mediated by agent scaffold, task construction, benchmark saturation, and contamination. The 24%–98% spread in injection measurements (Section 4.1) illustrates how strongly agent substrate, task, and defense configuration can affect an observed result. These limitations are why the review separates direct findings from synthesis and bounds its claims to the settings in which the underlying evidence was produced. 10 Conclusion Cyber-capable agents make the security of capability evaluation an end-to-end systems problem. Once a model is connected to memory, tools, credentials, and an execution environment, those components—and the response workflow around them—become part of the security boundary. Evaluating the model’s cyber capability without evaluating that boundary leaves out the mechanisms through which a capable agent can act. This review organizes that boundary into five vulnerability classes: multi-step offensive chains, objectives that conflict with sandbox boundaries, supply-chain and credential exposure, persistent command-and-control, and the speed of automated action. The reported July 2026 Hugging Face/OpenAI incident is used only as a preliminary, bounded illustration of how several of these surfaces can intersect. It does not establish a general attack sequence, recurrence rate, or control failure. The responder-access discussion adds a related constraint: the artifacts needed for incident response can resemble the artifacts of misuse, so artifact-only filtering cannot by itself establish a requester’s role. The evidence supports attention to containment, privilege separation, provenance, and responder access, but it does not yield a single estimate of autonomous-cyber risk. Benchmark results, capability monitoring, and agent time-horizon studies measure different tasks under different assumptions [81, 75, 40]. The practical next step is therefore to evaluate cyber capability together with the environment in which it is exercised: specify containment assumptions, measure privilege and egress boundaries, preserve usable provenance, and report both preventive and responder-access trade-offs. These are the conditions under which capability evaluation can become a more credible basis for security decisions. References [1] S. Abdelnabi, K. Greshake, S. Mishra, C. Endres, T. Holz, and M. Fritz (2023) Not what you’ve signed up for: compromising real-world llm-integrated applications with indirect prompt injection. In Proceedings of the 16th ACM Workshop on Artificial Intelligence and Security, p. 79–90. External Links: Document, Link Cited by: §2, §4.1, Table 4. [2] A. Al-Kaswan, M. Plotnikov, M. Hájek, R. Vízner, A. van Deursen, and M. Izadi (2026) Do agents dream of root shells? partial-credit evaluation of llm agents in capture the flag challenges. In AIWare 2026, Benchmark and Dataset Track, External Links: 2604.19354, Document Cited by: Table 2, §7. [3] M. Andriushchenko and N. Flammarion (2024) Does refusal training in llms generalize to the past tense?. Note: arXiv preprint, arXiv:2407.11969 External Links: 2407.11969, Document Cited by: §6. [4] Anthropic (2025) Anthropic responsible scaling policy. Note: https://w.anthropic.com/responsible-scaling-policy Cited by: §5, §8. [5] A. Anurin, J. Ng, K. Schaffer, J. Schreiber, and E. Kran (2024) Catastrophic cyber capabilities benchmark (3CB): robustly evaluating LLM agent cyber offense capabilities. Note: arXiv preprint, arXiv:2410.09114 External Links: 2410.09114, Document Cited by: Table 2, §3. [6] M. Azarm, Q. Wei, and R. Nambiar (2026) SysAdmin: measuring instrumental power-seeking in frontier ai. Note: arXiv preprint, arXiv:2607.18239 External Links: 2607.18239, Document Cited by: §4.4, Table 4. [7] A. M. Barrett, K. Jackson, E. R. Murphy, N. Madkour, and J. Newman (2024) Benchmark early and red team often: a framework for assessing and managing dual-use hazards of AI foundation models. Note: arXiv preprint, arXiv:2405.10986 External Links: 2405.10986, Document Cited by: Table 7, §7. [8] M. Bhatt, S. Chennabasappa, Y. Li, C. Nikolaidis, D. Song, S. Wan, F. Ahmad, C. Aschermann, Y. Chen, D. Kapil, D. Molnar, S. Whitman, and J. Saxe (2024) CyberSecEval 2: a wide-ranging cybersecurity evaluation suite for large language models. Note: arXiv preprint, arXiv:2404.13161 External Links: 2404.13161, Document Cited by: Table 2, §3. [9] M. Bhatt, S. Chennabasappa, C. Nikolaidis, S. Wan, I. Evtimov, D. Gabi, D. Song, F. Ahmad, C. Aschermann, L. Fontana, S. Frolov, R. P. Giri, D. Kapil, Y. Kozyrakis, D. LeBlanc, J. Milazzo, A. Straumann, G. Synnaeve, V. Vontimitta, S. Whitman, and J. Saxe (2023) Purple llama cyberseceval: a secure coding benchmark for language models. Note: arXiv preprint, arXiv:2312.04724 External Links: 2312.04724, Document Cited by: Table 2, §3, Figure 3, §4.1. [10] D. Blain (2026) Mythos and the unverified cage: z3-based pre-deployment verification for frontier-model sandbox infrastructure. Note: arXiv preprint, arXiv:2604.20496 External Links: 2604.20496, Document Cited by: §2, Table 7, §7, §8. [11] Y. Bouchari, M. Boffa, M. Mellia, I. Drago, T. M. Bui, and D. Rossi (2026) Autonomous llm agents & ctfs: a second look. Note: arXiv preprint, arXiv:2605.21497 External Links: 2605.21497, Document Cited by: §4.1. [12] D. Campbell, N. Kale, U. M. Sehwag, B. Herring, N. Price, D. Borges, A. Levinson, and C. Q. Knight (2026) Defensive refusal bias: how safety alignment fails cyber defenders. Note: arXiv preprint, arXiv:2603.01246 External Links: 2603.01246, Document Cited by: Figure 7, §6, §6, Table 7, §8. [13] B. Casey, J. C. S. Santos, and M. Mirakhorli (2024) A large-scale exploit instrumentation study of ai/ml supply chain attacks in hugging face models. Note: arXiv preprint, arXiv:2410.04490 External Links: 2410.04490, Document Cited by: §4.3. [14] A. Chhabra, S. Datta, S. K. Nahin, and P. Mohapatra (2025) Agentic ai security: threats, defenses, evaluation, and open challenges. Note: arXiv preprint, arXiv:2510.23883 External Links: 2510.23883, Document Cited by: Table 1, §2, §4.1. [15] Cloud Security Alliance (CSA) Labs (2026-07) The benchmark that broke containment: an openai evaluation model escaped its sandbox and breached hugging face. Note: https://labs.cloudsecurityalliance.org/research/csa-research-note-openai-model-sandbox-escape-huggingface-br/ Cited by: §4.2, Table 4, §5. [16] I. David and A. Gervais (2026) Ablating safety: mechanisms for removing alignment in language models for security applications. Note: arXiv preprint, arXiv:2605.17413 External Links: 2605.17413, Document Cited by: §6. [17] A. de Gregorio (2025) Mitigating cyber risk in the age of open-weight llms: policy gaps and technical realities. Note: arXiv preprint, arXiv:2505.17109 External Links: 2505.17109, Document Cited by: §6. [18] E. Debenedetti, J. Zhang, M. Balunovic, L. Beurer-Kellner, M. Fischer, and F. Tramer (2024) AgentDojo: a dynamic environment to evaluate prompt injection attacks and defenses for LLM agents. In Advances in Neural Information Processing Systems (NeurIPS), Datasets and Benchmarks Track, Note: arXiv preprint, arXiv:2406.13352 External Links: 2406.13352 Cited by: §2, Table 4. [19] G. Deng, Y. Liu, V. Mayoral-Vilches, P. Liu, Y. Li, Y. Xu, T. Zhang, Y. Liu, M. Pinzger, and S. Rass (2024) PentestGPT: an llm-empowered automatic penetration testing tool. Note: arXiv preprint, arXiv:2308.06782 External Links: 2308.06782, Document Cited by: §4.1. [20] Z. Deng, Y. Guo, C. Han, W. Ma, J. Xiong, S. Wen, and Y. Xiang (2025) AI agents under threat: a survey of key security challenges and future pathways. ACM Computing Surveys 57 (7), p. 1–36. Note: arXiv preprint, arXiv:2406.02630 External Links: 2406.02630, Document Cited by: Table 1, §2. [21] C. Denison, M. MacDiarmid, F. Barez, D. Duvenaud, S. Kravec, S. Marks, N. Schiefer, R. Soklaski, A. Tamkin, J. Kaplan, B. Shlegeris, S. R. Bowman, E. Perez, and E. Hubinger (2024) Sycophancy to subterfuge: investigating reward-tampering in large language models. Note: arXiv preprint, arXiv:2406.10162 External Links: 2406.10162, Document Cited by: §4.2. [22] L. L. di Langosco, J. Koch, L. D. Sharkey, J. Pfau, and D. Krueger (2022) Goal misgeneralization in deep reinforcement learning. In Proceedings of the 39th International Conference on Machine Learning, Proceedings of Machine Learning Research, Vol. 162, p. 12004–12019. External Links: Link Cited by: §4.2. [23] European Commission (2024) EU AI Act, article 15: accuracy, robustness and cybersecurity. Note: https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-15 Cited by: §5, §8. [24] R. Fang, R. Bindu, A. Gupta, and D. Kang (2024) LLM agents can autonomously exploit one-day vulnerabilities. Note: arXiv preprint, arXiv:2404.08144 External Links: 2404.08144, Document Cited by: Figure 4, Figure 4, §4.1. [25] R. Fang, R. Bindu, A. Gupta, Q. Zhan, and D. Kang (2024) LLM agents can autonomously hack websites. Note: arXiv preprint, arXiv:2402.06664 External Links: 2402.06664, Document Cited by: §4.1. [26] Frontier Model Forum (2025) Managing advanced cyber risks in frontier AI frameworks. Technical Report Frontier Model Forum. External Links: Link Cited by: §5, §8. [27] R. Greenblatt, C. Denison, B. Wright, F. Roger, M. MacDiarmid, S. Marks, J. Treutlein, T. Belonax, J. Chen, D. Duvenaud, A. Khan, J. Michael, S. Mindermann, E. Perez, L. Petrini, J. Uesato, J. Kaplan, B. Shlegeris, S. R. Bowman, and E. Hubinger (2024) Alignment faking in large language models. Note: arXiv preprint, arXiv:2412.14093 External Links: 2412.14093, Document Cited by: §2, §4.2, Table 4, §8. [28] A. Happe, J. Cito, and J. Wachter (2026) The ethics of autonomous ai agents for offensive security. Note: arXiv preprint, arXiv:2607.20255 External Links: 2607.20255, Document Cited by: §4.1. [29] F. He, T. Zhu, D. Ye, B. Liu, W. Zhou, and P. S. Yu (2025) The emerged security and privacy of LLM agent: a survey with case studies. ACM Computing Surveys 58, p. 162. Note: arXiv preprint, arXiv:2407.19354 External Links: 2407.19354, Document Cited by: Table 1, §2. [30] F. Hofstätter, T. van der Weij, J. Teoh, R. Djoneva, H. Bartsch, and F. R. Ward (2025) The elicitation game: evaluating capability elicitation techniques. Note: arXiv preprint, arXiv:2502.02180 External Links: 2502.02180, Document Cited by: §4.1. [31] S. Honarvar, A. Gorzynski, J. Lee-Jones, H. Coppock, M. Rei, J. Ryan, and A. F. Donaldson (2026) Capture the flags: family-based evaluation of agentic llms via semantics-preserving transformations. Note: arXiv preprint, arXiv:2602.05523 External Links: 2602.05523, Document Cited by: Table 2, §3. [32] E. Hubinger, C. Denison, J. Mu, M. Lambert, M. Tong, M. MacDiarmid, T. Lanham, D. M. Ziegler, T. Maxwell, N. Cheng, A. Jermyn, A. Askell, A. Radhakrishnan, C. Anil, D. Duvenaud, D. Ganguli, F. Barez, J. Clark, K. Ndousse, K. Sachan, M. Sellitto, M. Sharma, N. DasSarma, R. Grosse, S. Kravec, Y. Bai, Z. Witten, M. Favaro, J. Brauner, H. Karnofsky, P. Christiano, S. R. Bowman, L. Graham, J. Kaplan, S. Mindermann, R. Greenblatt, B. Shlegeris, N. Schiefer, and E. Perez (2024) Sleeper agents: training deceptive llms that persist through safety training. Note: arXiv preprint, arXiv:2401.05566 External Links: 2401.05566, Document Cited by: §4.2, Table 4. [33] E. Hubinger, C. van Merwijk, V. Mikulik, J. Skalse, and S. Garrabrant (2019) Risks from learned optimization in advanced machine learning systems. Note: arXiv preprint, arXiv:1906.01820 External Links: 1906.01820, Document Cited by: §4.2. [34] Hugging Face (2026) Security incident disclosure — july 2026. Note: https://huggingface.co/blog/security-incident-july-2026 Cited by: §1, §1, Figure 5, Figure 5, §4.3, §4.4, §4.5, Figure 6, Figure 6, Figure 6, Figure 6, Figure 6, Figure 6, Figure 6, Table 5, Table 5, Table 5, Table 5, §5, §5, §5, §5, §6, §6, Table 7, Table 7, §7, §8. [35] P. Jing, M. Tang, X. Shi, X. Zheng, S. Nie, S. Wu, Y. Yang, and X. Luo (2024) SecBench: a comprehensive multi-dimensional benchmarking dataset for llms in cybersecurity. Note: arXiv preprint, arXiv:2412.20787 External Links: 2412.20787, Document Cited by: Table 2. [36] E. K. Jones, M. Dziemian, M. Fredrikson, and J. Z. Kolter (2026) A new framework for cybersecurity refusals in ai agents. Note: Gray Swan AI / Carnegie Mellon University External Links: 2606.02644 Cited by: §6, §6. [37] S. Kadavath, T. Conerly, A. Askell, T. Henighan, D. Drain, E. Perez, N. Schiefer, Z. Hatfield-Dodds, N. DasSarma, E. Tran-Johnson, S. Johnston, S. El-Showk, A. Jones, N. Elhage, T. Hume, A. Chen, Y. Bai, S. Bowman, S. Fort, D. Ganguli, D. Hernandez, J. Jacobson, J. Kernion, S. Kravec, L. Lovitt, K. Ndousse, C. Olsson, S. Ringer, D. Amodei, T. Brown, J. Clark, N. Joseph, B. Mann, S. McCandlish, C. Olah, and J. Kaplan (2022) Language models (mostly) know what they know. Note: arXiv preprint, arXiv:2207.05221 External Links: 2207.05221, Document Cited by: §8. [38] A. D. Kellas, N. Christou, W. Jiang, P. Li, L. Simon, Y. David, V. P. Kemerlis, J. C. Davis, and J. Yang (2025) PickleBall: secure deserialization of pickle-based machine learning models (extended report). Note: arXiv preprint, arXiv:2508.15987 External Links: 2508.15987, Document Cited by: §4.3, Table 7, §7. [39] V. Krakovna and J. Kramar (2023) Power-seeking can be probable and predictive for trained agents. Note: arXiv preprint, arXiv:2304.06528 External Links: 2304.06528, Document Cited by: §4.2. [40] T. Kwa, B. West, J. Becker, A. Deng, K. Garcia, M. Hasin, S. Jawhar, M. Kinniment, N. Rush, S. V. Arx, R. Bloom, T. Broadley, H. Du, B. Goodrich, N. Jurkovic, L. H. Miles, S. Nix, T. Lin, C. Painter, N. Parikh, D. Rein, L. J. K. Sato, H. Wijk, D. M. Ziegler, E. Barnes, and L. Chan (2025) Measuring ai ability to complete long software tasks. Note: arXiv preprint, arXiv:2503.14499 External Links: 2503.14499, Document Cited by: §10, Figure 2, §3, Table 4. [41] D. Lee, G. Bae, and I. Yun (2026) CTFusion: a ctf-based benchmark for llm agent evaluation. Note: arXiv preprint, arXiv:2605.11504 External Links: 2605.11504, Document Cited by: Table 2, §3. [42] H. Lee, Z. Zhang, H. Lu, and L. Zhang (2025) SEC-bench: automated benchmarking of llm agents on real-world software security tasks. Note: arXiv preprint, arXiv:2506.11791 External Links: 2506.11791, Document Cited by: Table 2, Figure 4. [43] B. Li, P. Qi, B. Liu, S. Di, J. Liu, J. Pei, J. Yi, and B. Zhou (2023) Trustworthy AI: from principles to practices. ACM Computing Surveys 55 (9), p. 177. Note: arXiv preprint, arXiv:2110.01167 External Links: 2110.01167, Document Cited by: Table 1, §2. [44] W. G. Li, A. Abuadbba, K. Moore, and D. D. Kim (2026) APT-agent: automated penetration testing using large language models. Note: arXiv preprint, arXiv:2605.24949 External Links: 2605.24949, Document Cited by: Figure 4, §4.4, Table 4. [45] Y. Li, H. Huang, Y. Zhao, X. Ma, and J. Sun (2025) BackdoorLLM: a comprehensive benchmark for backdoor attacks and defenses on large language models. In Advances in Neural Information Processing Systems (NeurIPS), Note: arXiv preprint, arXiv:2408.12798 External Links: 2408.12798 Cited by: §2, §4.3, Table 4, §7. [46] Y. Liu, G. Deng, Y. Li, K. Wang, Z. Wang, X. Wang, T. Zhang, Y. Liu, H. Wang, Y. Zheng, L. Y. Zhang, and Y. Liu (2023) Prompt injection attack against llm-integrated applications. Note: arXiv preprint, arXiv:2306.05499 External Links: 2306.05499, Document Cited by: §2, §4.1. [47] S. Maiti (2026) Caging the agents: a zero trust security architecture for autonomous ai in healthcare. Note: arXiv preprint, arXiv:2603.17419 External Links: 2603.17419, Document Cited by: §2, Table 7, §7, §8. [48] R. Marchand, A. O. Cathain, J. Wynne, P. M. Giavridis, S. Deverett, J. Wilkinson, J. Gwartz, and H. Coppock (2026) Quantifying frontier llm capabilities for container sandbox escape. Note: arXiv preprint, arXiv:2603.02277 External Links: 2603.02277, Document Cited by: §2, Table 7, §7, §8. [49] V. Mayoral-Vilches, L. J. Navarrete-Lozano, F. Balassone, M. Sanz-Gómez, C. R. J. V. Chavez, M. del Mundo de Torres, and V. Turiel (2025) Cybersecurity ai: the world’s top ai agent for security capture-the-flag (ctf). Note: arXiv preprint, arXiv:2512.02654 External Links: 2512.02654, Document Cited by: §3. [50] R. J. Mitchell (2026) When the agent is the adversary: architectural requirements for agentic ai containment after the april 2026 frontier model escape. Note: arXiv preprint, arXiv:2604.23425 External Links: 2604.23425, Document Cited by: Table 7, §7, §8. [51] M. Mittelsteadt, J. Kraprayoon, R. Staes-Polet, O. Galeev, J. Wehner, C. Covino, and S. Ee (2026) Detecting offensive cyber agents: a detection-in-depth approach. Note: arXiv preprint, arXiv:2605.21956 External Links: 2605.21956, Document Cited by: §3, Table 7, §7, §8. [52] L. Muzsai, D. Imolai, and A. Lukács (2024) HackSynth: llm agent and evaluation framework for autonomous penetration testing. Note: arXiv preprint, arXiv:2412.01778 External Links: 2412.01778, Document Cited by: §4.1. [53] H. Ohayon, D. Gilkarov, and R. Dubin (2026) SafePickle: robust and generic ml detection of malicious pickle-based ml models. Note: arXiv preprint, arXiv:2602.19818 External Links: 2602.19818, Document Cited by: §4.3, Table 7, §7. [54] V. Ojewale, H. Suresh, and S. Venkatasubramanian (2026) Audit trails for accountability in large language models. Note: arXiv preprint, arXiv:2601.20727 External Links: 2601.20727, Document Cited by: Table 7, §7, §8. [55] OpenAI (2024) OpenAI preparedness framework. Note: https://openai.com/safety/preparedness Cited by: §5, §8. [56] OpenAI (2026-07) OpenAI and hugging face partner to address security incident during model evaluation. Note: https://openai.com/index/hugging-face-model-evaluation-security-incident/ Cited by: §1, §1, §3, Figure 5, Figure 5, §4.2, §4.2, §4.3, Figure 6, Figure 6, Figure 6, Figure 6, Table 5, Table 5, Table 5, Table 5, Table 5, §5, §5, §5, §7. [57] C. Packer, S. Wooders, K. Lin, V. Fang, S. G. Patil, I. Stoica, and J. E. Gonzalez (2023) MemGPT: towards llms as operating systems. Note: arXiv preprint, arXiv:2310.08560 External Links: 2310.08560, Document Cited by: §1, §4.1, Table 4. [58] E. Perez, S. Huang, F. Song, T. Cai, R. Ring, J. Aslanides, A. Glaese, N. McAleese, and G. Irving (2022) Red teaming language models with language models. In Proceedings of EMNLP, p. 3419–3448. Note: arXiv preprint, arXiv:2202.03286 External Links: 2202.03286 Cited by: Table 7, §7. [59] Y. Qu, Y. Liu, T. Geng, G. Deng, Y. Li, L. Y. Zhang, Y. Zhang, and L. Ma (2026) Supply-chain poisoning attacks against LLM coding agent skill ecosystems. Note: arXiv preprint, arXiv:2604.03081 External Links: 2604.03081, Document Cited by: §4.3, Table 4. [60] RAND Corporation (2024) Operationalizing AI-enabled cyber operations. Research Report Technical Report RRA3892-2, RAND Corporation. External Links: Link Cited by: §3. [61] RAND Corporation (2024) Secret cyberspace: the growing risk of AI-enabled cyber operations. Research Report Technical Report RRA3892-1, RAND Corporation. External Links: Link Cited by: §3. [62] N. Rani, K. Milner, M. Shao, M. Udeshi, H. Xi, V. S. C. Putrevu, S. Aggarwal, S. K. Shukla, P. Krishnamurthy, F. Khorrami, M. Shafique, and R. Karri (2026) CTFExplorer: evaluating llm offensive agents through multi-target web ctf benchmarking. Note: arXiv preprint, arXiv:2602.08023 External Links: 2602.08023, Document Cited by: §3. [63] Reworr and D. Volkov (2024) LLM agent honeypot: monitoring ai hacking agents in the wild. Note: arXiv preprint, arXiv:2410.13919 External Links: 2410.13919, Document Cited by: Table 7, §7. [64] M. H. Saju and A. Azim (2026) Toward autonomous soc operations: end-to-end llm framework for threat detection, query generation, and resolution in security operations. Note: arXiv preprint, arXiv:2604.27321 External Links: 2604.27321, Document Cited by: Table 7, §7. [65] J. Sevilla, L. Heim, A. Ho, T. Besiroglu, M. Hobbhahn, and P. Villalobos (2024) Compute trends across three eras of machine learning. Note: https://epoch.ai/publications/compute-trends Cited by: §4.5, Table 4. [66] M. Shao, S. Jancheska, M. Udeshi, B. Dolan-Gavitt, H. Xi, K. Milner, B. Chen, M. Yin, S. Garg, P. Krishnamurthy, F. Khorrami, R. Karri, and M. Shafique (2024) NYU ctf bench: a scalable open-source benchmark dataset for evaluating llms in offensive security. In Advances in Neural Information Processing Systems 37 (NeurIPS 2024), Datasets and Benchmarks Track, External Links: 2406.05590 Cited by: Table 2, §3. [67] M. Shao, N. Rani, K. Milner, H. Xi, M. Udeshi, S. Aggarwal, V. S. C. Putrevu, S. K. Shukla, P. Krishnamurthy, F. Khorrami, R. Karri, and M. Shafique (2025) Towards effective offensive security llm agents: hyperparameter tuning, llm as a judge, and a lightweight ctf benchmark. Note: arXiv preprint, arXiv:2508.05674 External Links: 2508.05674, Document Cited by: §3. [68] M. Sharma, M. Tong, T. Korbak, D. Duvenaud, A. Askell, S. Bowman, E. Durmus, Z. Hatfield-Dodds, S. Johnston, S. Kravec, T. Maxwell, S. McCandlish, K. Ndousse, O. Rausch, N. Schiefer, D. Yan, M. Zhang, and E. Perez (2024) Towards understanding sycophancy in language models. In International Conference on Learning Representations, External Links: Link Cited by: §4.2. [69] B. Sidik and L. Rokach (2026) Beyond static sandboxing: learned capability governance for autonomous ai agents. Note: arXiv preprint, arXiv:2604.11839 External Links: 2604.11839, Document Cited by: Table 7, §7, §8. [70] R. Singh, S. Tariq, F. Jalalvand, M. B. Chhetri, S. Nepal, C. Paris, and M. Lochner (2025) LLMs in the soc: an empirical study of human-ai collaboration in security operations centres. Note: arXiv preprint, arXiv:2508.18947 External Links: 2508.18947, Document Cited by: Table 7, §7. [71] B. D. Sunil, I. Sinha, P. Maheshwari, S. Todmal, S. Mallik, and S. Mishra (2026) Memory poisoning attack and defense on memory based llm-agents. Note: arXiv preprint, arXiv:2601.05504 External Links: 2601.05504, Document Cited by: Figure 3, §4.1, Table 4, §8. [72] G. Torres, S. Shrestha, and S. Misra (2026) When agents remember too much: memory poisoning attacks on large language model agents. Note: arXiv preprint, arXiv:2607.06595 External Links: 2607.06595, Document Cited by: Figure 3, §4.1, §8. [73] A. Turner, L. Smith, R. Shah, A. Critch, and P. Tadepalli (2021) Optimal policies tend to seek power. In Advances in Neural Information Processing Systems (NeurIPS), p. 23063–23074. Note: arXiv preprint, arXiv:1912.01683 External Links: 1912.01683 Cited by: §4.2, Table 4. [74] M. Udeshi, M. Shao, H. Xi, N. Rani, K. Milner, V. S. C. Putrevu, B. Dolan-Gavitt, S. K. Shukla, P. Krishnamurthy, F. Khorrami, R. Karri, and M. Shafique (2025) D-cipher: dynamic collaborative intelligent multi-agent system with planner and heterogeneous executors for offensive security. Note: arXiv preprint, arXiv:2502.10931 External Links: 2502.10931, Document Cited by: Figure 4, §4.1. [75] UK AI Security Institute (AISI) (2025-12) AISI frontier AI trends report (2025). Technical report UK AI Security Institute. External Links: Link Cited by: §10, Figure 2, §3, §4.5, Table 4, §7. [76] L. J. Valencia (2024) Artificial intelligence as the new hacker: developing agents for offensive security. Note: arXiv preprint, arXiv:2406.07561 External Links: 2406.07561, Document Cited by: §4.1, §4.4, Table 4. [77] T. van der Weij, F. Hofstätter, O. Jaffe, S. F. Brown, and F. R. Ward (2025) AI sandbagging: language models can strategically underperform on evaluations. In International Conference on Learning Representations, External Links: Link Cited by: §2, §4.2, Table 4, §8. [78] S. Wan, C. Nikolaidis, D. Song, D. Molnar, J. Crnkovich, J. Grace, M. Bhatt, S. Chennabasappa, S. Whitman, S. Ding, V. Ionescu, Y. Li, and J. Saxe (2024) CYBERSECEVAL 3: advancing the evaluation of cybersecurity risks and capabilities in large language models. Note: arXiv preprint, arXiv:2408.01605 External Links: 2408.01605, Document Cited by: Table 2, §3. [79] G. Wang, Y. Xie, Y. Jiang, A. Mandlekar, C. Xiao, Y. Zhu, L. Fan, and A. Anandkumar (2023) Voyager: an open-ended embodied agent with large language models. Note: arXiv preprint, arXiv:2305.16291 External Links: 2305.16291, Document Cited by: §1, §4.1, Table 4. [80] H. Wang, S. Guo, J. He, H. Liu, T. Zhang, and T. Xiang (2025) Model supply chain poisoning: backdooring pre-trained models via embedding indistinguishability. In Proceedings of the ACM Web Conference 2025, p. 840–851. External Links: Document, Link Cited by: §4.3, Table 4, Table 7, §7. [81] Z. Wang, N. Schiller, H. Li, S. S. Narayana, M. Nasr, N. Carlini, X. Qi, E. Wallace, E. Bursztein, L. Invernizzi, K. Thomas, Y. Shoshitaishvili, W. Guo, J. He, T. Holz, and D. Song (2026) ExploitGym: can AI agents turn security vulnerabilities into real attacks?. Note: arXiv preprint, arXiv:2605.11086 External Links: 2605.11086, Document Cited by: §10, §2, Figure 2, Table 2, §3, §3. [82] B. Wei, Y. S. Tay, H. Liu, J. Pan, K. Luo, Z. Zhu, and C. Jordan (2025) CORTEX: collaborative llm agents for high-stakes alert triage. Note: arXiv preprint, arXiv:2510.00311 External Links: 2510.00311, Document Cited by: Table 7, §7. [83] D. Williams-King, L. Le, A. Oberman, and Y. Bengio (2025) Can safety fine-tuning be more principled? lessons learned from cybersecurity. Note: arXiv preprint, arXiv:2501.11183 External Links: 2501.11183, Document Cited by: §6, Table 7, §8. [84] S. Willison (2026-07) OpenAI’s accidental cyberattack against hugging face is science fiction that happened. Note: https://simonwillison.net/2026/Jul/22/openai-cyberattack/ Cited by: §5. [85] Y. Xu, Y. Zhuang, X. Liu, T. Zhang, B. Xiao, X. Xu, D. Jiang, J. Wang, and H. Hu (2026) LLM agents security duality: a comprehensive survey of self-security and empowered cybersecurity. Note: arXiv preprint, arXiv:2606.28450 External Links: 2606.28450, Document Cited by: Table 1, §2, §4.1. [86] K. Yang, Y. Bu, J. Yi, Y. Wang, B. Zhou, J. Dai, S. Hu, and Y. Yang (2026) When lower privileges suffice: investigating over-privileged tool selection in llm agents. Note: arXiv preprint, arXiv:2606.20023 External Links: 2606.20023, Document Cited by: Table 7, §7, §8. [87] S. Yao, J. Zhao, D. Yu, N. Du, I. Shafran, K. Narasimhan, and Y. Cao (2023) ReAct: synergizing reasoning and acting in language models. In International Conference on Learning Representations, External Links: Link Cited by: §1, §4.1, Table 4. [88] S. Yuan, E. Nie, Y. Sun, C. Zhao, W. LaCroix, and M. Färber (2025) Beyond over-refusal: scenario-based diagnostics and post-hoc mitigation for exaggerated refusals in llms. Note: arXiv preprint, arXiv:2510.08158 External Links: 2510.08158, Document Cited by: Table 7, §8. [89] S. Zanbaghi, R. Rostampour, F. Abid, and S. A. Jarmakani (2025) Detecting sleeper agents in large language models via semantic drift analysis. Note: arXiv preprint, arXiv:2511.15992 External Links: 2511.15992, Document Cited by: §4.2, §8. [90] Q. Zhan, Z. Liang, Z. Ying, and D. Kang (2024) InjecAgent: benchmarking indirect prompt injections in tool-integrated large language model agents. In Findings of the Association for Computational Linguistics: ACL 2024, p. 10471–10506. External Links: Document, Link Cited by: Figure 3, §4.1, Table 4. [91] A. K. Zhang, N. Perry, R. Dulepet, J. Ji, C. Menders, J. W. Lin, E. Jones, G. Hussein, S. Liu, D. Jasper, P. Peetathawatchai, A. Glenn, V. Sivashankar, D. Zamoshchin, L. Glikbarg, D. Askaryar, M. Yang, T. Zhang, R. Alluri, N. Tran, R. Sangpisit, P. Yiorkadjis, K. Osele, G. Raghupathi, D. Boneh, D. E. Ho, and P. Liang (2025) Cybench: a framework for evaluating cybersecurity capabilities and risks of language models. In Proceedings of the Thirteenth International Conference on Learning Representations (ICLR 2025), Note: Oral presentation External Links: 2408.08926 Cited by: Table 2, §3. [92] Z. Zhang, G. Xiao, Y. Li, T. Lv, F. Qi, Z. Liu, Y. Wang, X. Jiang, and M. Sun (2023) Red alarm for pre-trained models: universal vulnerability to neuron-level backdoor attacks. Machine Intelligence Research 20 (2), p. 180–193. External Links: Document, Link Cited by: §4.1. [93] J. Zhao, S. Wang, Y. Zhao, X. Hou, K. Wang, P. Gao, Y. Zhang, C. Wei, and H. Wang (2024) Models are codes: towards measuring malicious code poisoning attacks on pre-trained model hubs. In Proceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering, p. 2087–2098. External Links: Document, Link Cited by: §2, §4.3, Table 4, §6. [94] Z. Zhou, S. Liu, M. Ning, W. Liu, J. Wang, D. F. Wong, X. Huang, Q. Wang, and K. Huang (2025) Is your model really a good math reasoner? evaluating mathematical reasoning with checklist. In International Conference on Learning Representations (ICLR), Note: arXiv preprint, arXiv:2407.08733 External Links: 2407.08733 Cited by: §2, §8. [95] Y. Zhu, A. Kellermann, D. Bowman, P. Li, A. Gupta, A. Danda, R. Fang, C. Jensen, E. Ihli, J. Benn, J. Geronimo, A. Dhir, S. Rao, K. Yu, T. Stone, and D. Kang (2025) CVE-bench: a benchmark for ai agents’ ability to exploit real-world web application vulnerabilities. Note: arXiv preprint, arXiv:2503.17332 External Links: 2503.17332, Document Cited by: Figure 4, §4.1. [96] Y. Zhu, A. Kellermann, A. Gupta, P. Li, R. Fang, R. Bindu, and D. Kang (2024) Teams of llm agents can exploit zero-day vulnerabilities. Note: arXiv preprint, arXiv:2406.01637 External Links: 2406.01637, Document Cited by: §4.1. [97] T. Y. Zhuo, D. Wang, H. Ding, V. Kumar, and Z. Wang (2025) Training language model agents to find vulnerabilities with ctf-dojo. Note: arXiv preprint, arXiv:2508.18370 External Links: 2508.18370, Document Cited by: Table 2, §3.

Instant research discovery