Research map / Multi-agent systems and games / LLM agents

AgentLAB: Benchmarking LLM Agents against Long-Horizon Attacks

ICML 2026 · Multi-agent systems and games › LLM agents · approach: Agent safety and attack benchmarks · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Introduces AgentLAB, a benchmark of 644 long-horizon attack test cases (five attack types across 28 tool-using agent environments) and finds frontier and open-weight LLM agents highly vulnerable, with single-turn defenses failing to transfer.

Problem

LLM agent security benchmarks evaluate mostly single-turn or static attacks, leaving multi-turn, adaptive attacks that exploit user-agent-environment interactions unmeasured.

Approach

A unified multi-agent attack framework (planner, attacker, judge, optional verifier) that instantiates five long-horizon attack families (intent hijacking, tool chaining, task injection, objective drifting, memory poisoning) across realistic tool-enabled environments, with per-attack ASR and turns-to-success metrics.

Key results

• Average ASR of long-horizon attacks is 81.5% on Qwen-3, 78.1% on GPT-4o, and 69.9% on GPT-5.1 overall.
• Long-horizon task injection raises GPT-4o ASR from 62.5% (one-shot) to 79.9%.
• Claude-4.5 has 27.2% ASR on intent hijacking but 73.3% on tool chaining; Self-Reminder cuts Claude intent hijacking ASR to 6.9% but tool chaining remains at 57.9%.

Surprising findings

• Claude-4.5 resists direct intent hijacking yet remains highly vulnerable to decomposed tool chaining.
• Gemini-3 has near-zero or low ASR on some attacks but high ASR on memory poisoning and tool chaining.

Limitations

• Preliminary evaluation covering a limited set of agents and defenses.
• Attacker and judge rely on proprietary GPT-5.1, so results depend on that model's behavior.
• Benchmark is described as a live benchmark, and its current coverage (28 environments, 644 cases) is limited.

Experimental setup

Datasets: SHADE-Arena AgentDojo WebShop Agent-SafetyBench

Benchmarks: AgentLAB

Metrics: attack success rate turn to success

Baselines: Self-Reminder Llama-Guard Repeated Prompt DeBERTa Detector important message attack

Builds on: TextGrad AgentDojo Agent-SafetyBench WebShop SHADE-Arena

Closest papers by meaning

• Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agents (ICLR 2025 · similarity 0.91)
• Adaptive Adversaries: A Multi-Turn, Multi-LLM Benchmark for LLM Agent Security (NeurIPS 2026 · similarity 0.89)
• SEC-bench: Automated Benchmarking of LLM Agents on Real-World Software Security Tasks (NeurIPS 2025 · similarity 0.89)
• ORBIT: A Framework for Multi-Agent Security Evaluations (NeurIPS 2026 · similarity 0.88)
• AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agents (ICLR 2025 · similarity 0.88)
• Unsafer in Many Turns: Benchmarking and Defending Multi-Turn Safety Risks in Tool-Using Agents (ICML 2026 · similarity 0.88)