Pith. sign in

REVIEW 4 major objections 6 minor 30 references

SHE: Trajectory-driven Safety Harness Evolution for LLM Agents

T0 review · 4 major / 6 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A safety harness can be evolved from its own rollout trajectories, and the paper shows that on Agent-SafetyBench this reduces average attack success from 17.1% to 5.5% while improving utility under attack.

desk verdict SHE's core idea is sound and the held-out results are encouraging, but the headline gains on Agent-SafetyBench are measured by the same model that writes the harness edits, so the numbers need an independent judge before I'd trust them. read the letter →

arxiv 2608.09885 v1 pith:TFCGKIKH submitted 2026-08-10 cs.AI cs.CV

Wanying Qu , Qinghua Mao , Yu Li , Jiyao Liu , Xin Zhang , Dadi Guo , Yanxu Zhu , Qingyu Liu
show 7 more authors
Leitao Yuan Xi Lin Shanfeng Zhu Yanwei Fu Jing Shao Xia Hu Dongrui Liu
This is my paper · ORCID
classification cs.AIcs.CV
keywords LLMagentsafetyharnessevolutiontrajectory-driventool-useagentsattacksuccessraterulebankmemory
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper claims that the safety of a large language model (LLM) agent is shaped as much by the harness around the model—context construction, memory, tool permissions, runtime checks—as by the model weights, and that this harness can improve automatically from its own experience. The proposed framework, SHE, splits the harness into four editable artifacts with explicit safety responsibilities, then runs an attribution-guided loop: failed rollouts are diagnosed into structured risk records, each failure is routed to the artifact that should have caught it, and a candidate edit is kept only if it improves safety without reducing utility. On Agent-SafetyBench, it reports lowering average attack success rate from 8.6% (seed harness) and from 17.1% (static SafeHarness baseline) to 5.5%, while raising average utility under attack from about 31.6% to 47.6%. The evolved harness is also shown to reduce harm on the held-out AgentHarm benchmark and to transfer to other agent models without further evolution. If correct, this means safety guardrails can keep learning after deployment rather than remaining frozen at initial specification.

What carries the argument

The key mechanism is a four-artifact harness tuple $H = (P_{\rm sys}, R_{\rm bank}, M_{\rm safe}, Q_{\rm tool})$ combined with an attribution-guided evolution loop. The four artifacts—System Prompt, Rule Bank, Safety Memory, Tool Policy—each have a single explicit safety responsibility, so a failure can be attributed to one component and edits can stay local. The loop converts each rollout trajectory into a structured diagnosis (harm domain, attack surface, failure mode), routes it to the responsible artifact, proposes a bounded edit, rejects edits that look like surface-level safety gains via a validity check, and accepts the candidate only when safety improves and utility does not drop, as in Eq. (9). This combination of local attribution and global safety–utility selection is what lets the harness learn new boundaries without regressing normal task performance.

What would settle it

Re-run the same 20-round evolution on Agent-SafetyBench with an independent judge—a different model or human annotation—scoring safety and utility, keeping the evolution model and all other settings fixed. If the attack-success reduction from 17.1% to 5.5% largely disappears or the utility gain shrinks, the headline result is an artifact of judge self-scoring rather than a safer harness. A weaker test is to rescore the accepted harness's trajectories with a held-out judge and compare the resulting ASR.

Watch

Extended reading notes

Core claim

The paper's central claim is that trajectory feedback can be converted into localized, verifiable edits to a safety harness. The harness is represented as a tuple of four artifacts—System Prompt (the global behavioral contract), Rule Bank (structured rules with conditions and interventions), Safety Memory (contrastive boundaries from unresolved failures), and Tool Policy (tool-use authority and runtime detectors). Each evolution round rolls out the agent under the current best harness, diagnoses safety-relevant trajectories into harm domain, attack surface, and failure mode, routes the diagnosis to the responsible artifact, and generates a bounded edit. The edit is accepted only when the candidate harness passes a validity check and satisfies the safety–utility selection rule $S_\Omega(\tilde H)>S_\Omega(H_{\rm best})$ and $U_\Omega(\tilde H)\ge U_\Omega(H_{\rm best})$. The accepted run of this loop is what produces the reported 3.1× ASR reduction over the static baseline, the utility gain, and the transferable harness.

Load-bearing premise

The load-bearing premise is that the model scoring safety and utility on Agent-SafetyBench is a faithful judge, because the same model also proposes the harness edits and diagnoses failures; a biased or gameable judge would mean the reported attack-success reduction could reflect optimization to the judge rather than genuine safety improvement.

Editorial extensions

If this is right

  • Safety harnesses can keep improving after deployment: new failure trajectories from production or red-teaming can be fed into the same loop to tighten boundaries without rewriting the whole harness.
  • The four-artifact decomposition gives a reusable unit for failure attribution, so a single unsafe behavior can be traced to a specific editable component instead of triggering a global change.
  • Because the evolved harness transfers across agent models, one evolution run on a strong base agent may supply safety boundaries for several downstream models, reducing per-model safety engineering.
  • The safety–utility selection rule blocks edits that trade capability for safety, which means the loop can be run repeatedly without degrading normal task performance.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Extending beyond the paper, the attribution-guided loop is not specific to safety: any trajectory-level objective that can be scored (task success, cost, latency, compliance) could drive the same artifact edits, so the architecture may generalize to general harness optimization.
  • Because the held-out AgentHarm evaluation uses a different judge than the evolution loop, it already provides a partial check against judge-overfitting; a stronger variant would hold out entire risk categories, not just tasks, and confirm the evolved rules still transfer.
  • The component-replacement ablations show each artifact contributes, but they do not reveal which artifact transfers best across models; porting only the Rule Bank or Tool Policy to a new agent and measuring retained safety would make cross-model transfer cheaper and better understood.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper proposes Safety Harness Evolution (SHE), a framework that evolves an LLM agent's safety harness from rollout trajectories. SHE decomposes the harness into four artifacts (System Prompt, Rule Bank, Safety Memory, Tool Policy) and runs an attribution-guided loop that diagnoses trajectory failures, routes them to responsible artifacts, generates bounded edits, validates them, and accepts edits only when they improve the safety score SΩ without reducing the utility score UΩ. On Agent-SafetyBench, the evolved harness is reported to reduce average ASR from 8.6% to 5.5% over the seed harness and from 17.1% to 5.5% over static SafeHarness, while improving average UA from 33.5% to 47.6%. The evolved harness is also reported to generalize to held-out AgentHarm and to transfer across agent models. The central claim is that harnesses can be evolved automatically from trajectories without sacrificing utility.

Significance. If the evaluation concerns are resolved, the paper makes a useful contribution: the artifact-level decomposition is clean and well motivated, the evolution loop is clearly specified, and the held-out AgentHarm evaluation with a different judge (GPT-4o) plus the cross-model transfer experiments provide partial independent validation. The paper also gives concrete evolution history and artifact-structure details in the appendices, which helps reproducibility. However, the primary Agent-SafetyBench metric is judged by the same model that generates and validates the edits, and the paper reports no error bars; these issues directly affect the strength of the central claim.

major comments (4)
  1. [§3.4, Eq. (9); §4.1; Appendix A] The central claim in §4.2 rests on Agent-SafetyBench safety and utility scores SΩ and UΩ computed by GPT-5.5, which is also the model that performs structured diagnoses, generates the bounded edits Δ^(k) in Eq. (6), and runs the validity check in Eq. (7). The acceptance rule in Eq. (9) therefore selects harnesses against the same model's judgments that generated and validated the edits; the validity check cannot independently certify that a gain is not a judge-specific shortcut because the same system checks its own edits against its own judgments. The held-out AgentHarm evaluation with GPT-4o is a useful partial check, but it evaluates only the final fixed harness, not the candidate-selection process, and it uses a different benchmark, so it does not establish that the Agent-SafetyBench ASR/UA numbers are free of optimization to the judge. Please re-evaluate at least the final harness, and ideally all accepted candidate harnesses, on Agent-SafetyBench with an independent judge (e.g., GPT-4o, a different model, or human annotation with agreement statistics), and report those numbers alongside the current ones.
  2. [§4.1; Tables 1–3] The paper reports average ASR, Clean UBR, and UA values without error bars, confidence intervals, or hypothesis tests. The headline ASR reduction from 8.6% to 5.5% is only 3.1 percentage points, and with two rollout replications per evolution task and a single evaluation pass on the 185 held-out tasks, the reported differences may be within run-to-run noise. The statement that temperature 0 ensures deterministic evaluation is not sufficient to remove all sampling variance, and no seeds are reported. Please provide variance estimates across repeated evaluation runs, or bootstrap over tasks, and state the number of independent trajectories behind each cell in Tables 1–3.
  3. [§4.3, Figure 3] The cross-model transfer claim is presented only through a figure without numeric values, error bars, or task-level breakdowns, and it is unclear how many rollouts were collected for each target model. Please report Table-1-style numbers for each target model, including the number of trajectories and evaluation conditions, so the transfer claim can be assessed independently.
  4. [Table 3] The evolution-model ablation in Table 3 does not address the same-judge concern because the evaluation protocol is kept unchanged, so GPT-5.5 remains the judge for all variants. This ablation shows robustness to the editing model, but it cannot distinguish genuine safety improvement from optimization to GPT-5.5's judgments. Please also vary the judge independently of the editing model, or report the AgentHarm (GPT-4o) numbers for each evolution-model variant.
minor comments (6)
  1. [§3.1] The problem setup says SHE improves SΩ(H) 'subject to a utility constraint on UΩ(H)', but no formal constraint is defined before Eq. (9); Eq. (9) later imposes non-decreasing utility. Please state the constraint explicitly at the problem-setup stage.
  2. [§4.1] The phrase 'temperature set to 0 to ensure deterministic evaluation' is imprecise; temperature-0 sampling is not guaranteed deterministic across all inference stacks. Please report decoding parameters, random seeds, and any observed nondeterminism.
  3. [Table 3] The column header 'Best round' is ambiguous; please specify whether R03, R05, R17 refer to evolution rounds and what 'best' means under the Eq. (9) selection rule.
  4. [Appendix B] The evolution-history plots would benefit from explicit y-axis ranges, labeled units for the metric traces, and clearer markers for the accepted rounds; currently the claimed plateau from R05 to R16 is difficult to verify visually.
  5. [Abstract and §4.2] The phrase '3.1× ASR reduction' is ambiguous; please state explicitly that it is the ratio 17.1/5.5 and not a 3.1-percentage-point reduction, and clarify whether this is relative to the SafeHarness baseline only.
  6. [Reproducibility] Please release the exact seed and evolved artifact texts, the diagnosis and edit prompts, and the full edit history in addition to the GitHub link, since the appendix currently shows only templates and field schemas.

Circularity Check

2 steps flagged · score 4.0 of 10

Agent-SafetyBench safety and utility scores are produced by GPT-5.5, the same model that generates and validates harness edits; the reported improvement is partly a self-judged selection objective, though held-out AgentHarm and cross-model transfer provide independent grounding.

  1. fitted input called prediction [Section 3.4, Eq. (9); Appendix A (Models and evolution setup)]
    "The candidate harness eH(k) replaces Hbest only when it improves safety while preserving normal task utility: SΩ(eH(k)) > SΩ(Hbest), UΩ(eH(k)) ≥ UΩ(Hbest). ... We use DeepSeek-V3.2 as the base tool-using agent and GPT-5.5 for structured diagnosis and artifact-edit generation. GPT-5.5 is also the full-trajectory judge for Agent-SafetyBench."

    The final harness is selected by Eq. (9) on the basis of SΩ and UΩ, and those same SΩ/UΩ judgments are the headline Agent-SafetyBench results (e.g., ASR 8.6%→5.5%, UA 33.5%→47.6%). Because GPT-5.5 both generates the candidate edits (Eq. (6)) and computes the scores used to accept or reject them, the evolved harness is, on the evolution subset, chosen to maximize GPT-5.5's own safety/utility judgment. Reporting that same judgment as evidence of safety improvement is therefore partly reporting the selection objective rather than an independent measurement. The held-out 185-task split and AgentHarm/GPT-4o evaluation prevent this from being a complete identity, so the circularity is partial.

  2. self definitional [Section 3.4, Eq. (7); Appendix A]
    "SHE performs a validity check to verify whether a proposed boundary refinement represents a valid safety improvement rather than a reward-hacking or evaluator-specific shortcut. ... GPT-5.5 is also the full-trajectory judge for Agent-SafetyBench."

    The validity check is the paper's explicit safeguard against 'reward-hacking or evaluator-specific shortcut[s]', but the check is performed by GPT-5.5, the same model that generates the edits and that supplies the evaluator-specific SΩ/UΩ scores used in Eq. (9). A model checking its own edits against its own judgments cannot independently certify that an accepted edit is not exploiting the evaluator's blind spots; the anti-circularity mechanism is therefore self-referential on the main benchmark.

full rationale

The central derivation is not formally circular in the sense of an equation reducing to itself: the 185-task held-out split means Eq. (9) does not by construction determine the reported held-out ASR/UA, and the AgentHarm evaluation uses a different judge (GPT-4o), while the cross-model transfer experiments do not re-train on target models. However, on Agent-SafetyBench the same GPT-5.5 model is simultaneously the edit proposer (Eq. (6)), the validity checker (Eq. (7)), and the full-trajectory judge whose SΩ/UΩ values drive the acceptance rule (Eq. (9)) and constitute the main result. This is a partial evaluation circularity: the improvement is in part optimization to GPT-5.5's own judgments. The validity check explicitly aims to block evaluator-specific shortcuts but is executed by the same evaluator, so it cannot independently rule out judge overfitting. These issues are methodologically serious but not a complete reduction by construction, because the held-out split and the independent AgentHarm judge provide genuine external checks. No load-bearing self-citation or imported uniqueness theorem was found.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The framework introduces no new physical or unobserved entities; the four artifacts are editable software components whose content is inspected and ablated. The central claims rest on LLM-judge reliability, a fixed failure taxonomy, an LLM validity check, and the representativeness of the evolution subset.

free parameters (3)
  • Evolution rounds K = 20
    Hand-chosen stopping criterion; the paper reports results at round 17, so the exact number of rounds could affect the final harness.
  • Safety-memory retention threshold = unresolved after two rounds or recurs
    Appendix A states that Safety Memory stores a boundary only when it remains unresolved after two rounds or recurs after artifact updates; this hand-chosen rule affects what enters memory.
  • Evolution subset size = 15 tasks, 90 task-condition instances
    Section 4.1 selects a 15-task stratified subset for evolution; generalization to the remaining 185 tasks and to AgentHarm assumes this subset is representative.
assumptions (4)
  • domain assumption The LLM judge's safety and completion labels are reliable proxies for true safety and utility.
    Section 3.1 defines Ω as the scoring protocol and Appendix A uses GPT-5.5 as the full-trajectory judge for Agent-SafetyBench; no validation against human labels is provided.
  • domain assumption Failures can be fully described by the three risk dimensions (harm domain, attack surface, failure mode) and routed to one of the four harness artifacts.
    Section 3.4 structured diagnosis and artifact routing assume this taxonomy covers all safety-relevant failures; if a failure class is outside it, the loop cannot attribute or edit it.
  • domain assumption The ValidEdit check can distinguish genuine safety improvements from reward hacking or capability-removing edits.
    Section 3.4 Eq. (7) relies on an LLM-based validity check to filter edits; the paper provides no independent verification of this discriminator.
  • domain assumption The 15-task evolution subset is representative of the safety-risk distribution of the remaining benchmark tasks and of AgentHarm.
    Section 4.1 evolution setting selects 15 tasks for evolution; the generalization claims depend on this representativeness.

how reviews work

0 comments
Cite this review

Pith. "Pith review of SHE: Trajectory-driven Safety Harness Evolution for LLM Agents." pith.science (2026). https://pith.science/paper/TFCGKIKH

@misc{pith2026260809885,
  author       = {Pith},
  title        = {Pith review of: SHE: Trajectory-driven Safety Harness Evolution for LLM Agents},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/TFCGKIKH}},
  note         = {Machine review of arXiv:2608.09885}
}
read the original abstract

The safety of large language model (LLM) agents depends not only on model weights but also on the agent harness that manages context, memory, tools, permissions, and runtime control. Existing safety mechanisms often treat the harness as a fixed deployment artifact, limiting their ability to evolve with emerging risks. Moreover, coupled functions across harness components obscure safety responsibility attribution, making localized evolution difficult. We propose Safety Harness Evolution (SHE), a framework that learns evolving safe boundaries from rollout trajectories. SHE decomposes the harness into four artifacts with explicit safety responsibilities, including the System Prompt, Rule Bank, Safety Memory, and Tool Policy, defining clear functional boundaries for localized evolution. Based on this decomposition, SHE introduces an attribution-guided evolution loop that converts trajectory failures into structured diagnoses, learns artifact-specific boundary refinements, and selects evolved harnesses through safety-utility validation. Experiments on Agent-SafetyBench demonstrate that SHE effectively enhances safety through harness evolution, achieving a 3.1x ASR reduction compared with static SafeHarness, while also improving benign utility. The evolved harness further generalizes to unseen risks on the held-out AgentHarm benchmark and transfers across agent models without additional evolution.

Figures

Figures reproduced from arXiv: 2608.09885 by the authors.

Figure 1
Figure 1. Motivation of Safety Harness Evolution (SHE). SHE decouples the safety harness into editable [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Overview of Safety Harness Evolution (SHE). SHE decomposes the safety harness into four [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Transfer of evolved harness updates across different agent models. The harness evolved on [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figures from the paper (5 more)
Figure 4
Figure 4. Figure 4: Framework-evolution ablation on Agent-SafetyBench. SHE benefits from evolution more consis [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]
Figure 5
Figure 5. Figure 5: A concrete safety case illustrating how SHE transforms an app-acquisition failure into learned [PITH_FULL_IMAGE:figures/full_fig_p009_5.png]
Figure 6
Figure 6. Figure 6: Agent-SafetyBench full-trajectory judge template. [PITH_FULL_IMAGE:figures/full_fig_p013_6.png]
Figure 7
Figure 7. Figure 7: Evolution history under best-so-far selection. Top: accepted and rejected candidate scores, with the [PITH_FULL_IMAGE:figures/full_fig_p014_7.png]
Figure 8
Figure 8. Figure 8: Internal representations of the four SHE artifacts. The System Prompt panel shows a representative [PITH_FULL_IMAGE:figures/full_fig_p014_8.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

30 extracted references · 5 canonical work pages

  1. [1]

    Agrawal, Shangyin Tan, Dilara Soylu, Noah Ziems, Rishi Khare, Krista Opsahl-Ong, Arnav Singhvi, Herumb Shandilya, Michael J

    Lakshya A. Agrawal, Shangyin Tan, Dilara Soylu, Noah Ziems, Rishi Khare, Krista Opsahl-Ong, Arnav Singhvi, Herumb Shandilya, Michael J. Ryan, Meng Jiang, Christopher Potts, Koushik Sen, Alexandros G. Dimakis, Ion Stoica, Dan Klein, Matei Zaharia, and Omar Khattab. GEPA: Reflective prompt evolution can outperform reinforcement learning.arXiv preprint arXiv...

    arXiv

  2. [3]

    Bowman, Zac Hatfield-Dodds, Ben Mann, Dario Amodei, Nicholas Joseph, Sam McCandlish, Tom Brown, and Jared Kaplan

    Yuntao Bai, Saurav Kadavath, Sandipan Kundu, Amanda Askell, Jackson Kernion, Andy Jones, Anna Chen, Anna Goldie, Azalia Mirhoseini, Cameron McKinnon, Carol Chen, Catherine Olsson, Christopher Olah, Danny Hernandez, Dawn Drain, Deep Ganguli, Dustin Li, Eli Tran-Johnson, Ethan Perez, Jamie Kerr, Jared Mueller, Jeffrey Ladish, Joshua Landau, Kamal Ndousse, K...

    arXiv

  3. [7]

    Risk taxonomy, mitigation, and assessment benchmarks of large language model systems.arXiv preprint arXiv:2401.05778,

    Tianyu Cui, Yanling Wang, Chuanpu Fu, Yong Xiao, Sijia Li, Xinhao Deng, Yunpeng Liu, Qinglin Zhang, Ziyi Qiu, Peiyang Li, et al. Risk taxonomy, mitigation, and assessment benchmarks of large language model systems.arXiv preprint arXiv:2401.05778,

    arXiv

  4. [9]

    Evotest: Evolutionary test-time learning for self-improving agentic systems.arXiv preprint arXiv:2510.13220,

    Yufei He, Juncheng Liu, Yue Liu, Yibo Li, Tri Cao, Zhiyuan Hu, Xinxing Xu, and Bryan Hooi. Evotest: Evolutionary test-time learning for self-improving agentic systems.arXiv preprint arXiv:2510.13220,

    arXiv

  5. [10]

    Defending against indirect prompt injection attacks with spotlighting.arXiv preprint arXiv:2403.14720,

    Keegan Hines, Gary Lopez, Matthew Hall, Federico Zarfati, Yonatan Zunger, and Emre Kiciman. Defending against indirect prompt injection attacks with spotlighting.arXiv preprint arXiv:2403.14720,

    arXiv

  6. [11]

    Llama guard: LLM-based input-output safeguard for human-AI conversations.arXiv preprint arXiv:2312.06674,

    Hakan Inan, Kartikeya Upasani, Jianfeng Chi, Rashi Rungta, Krithika Iyer, Yuning Mao, Michael Tontchev, Qing Hu, Brian Fuller, Davide Testuggine, and Madian Khabsa. Llama guard: LLM-based input-output safeguard for human-AI conversations.arXiv preprint arXiv:2312.06674,

    arXiv

  7. [12]

    ATBench: A diverse and realistic agent trajectory benchmark for safety evaluation and diagnosis.arXiv preprint arXiv:2604.02022,

    Yu Li, Haoyu Luo, Yuejin Xie, Yuqian Fu, Zhonghao Yang, Shuai Shao, Qihan Ren, Wanying Qu, Yanwei Fu, Yujiu Yang, Jing Shao, Xia Hu, and Dongrui Liu. ATBench: A diverse and realistic agent trajectory benchmark for safety evaluation and diagnosis.arXiv preprint arXiv:2604.02022,

    arXiv

  8. [13]

    Agentic harness engineering: Observability-driven automatic evolution of coding-agent harnesses.arXiv preprint arXiv:2604.25850, 2026a

    Jiahang Lin, Shichun Liu, Chengjun Pan, Lizhi Lin, Shihan Dou, Zhiheng Xi, Xuanjing Huang, Hang Yan, Zhenhua Han, Tao Gui, and Yu-Gang Jiang. Agentic harness engineering: Observability-driven automatic evolution of coding-agent harnesses.arXiv preprint arXiv:2604.25850, 2026a. Xixun Lin, Yang Liu, Yancheng Chen, Yongxuan Wu, Yucheng Ning, Yilong Liu, Nan ...

    arXiv

Show all 30 references
  1. [14]

    AgentDoG: A diagnostic guardrail framework for AI agent safety and security.arXiv preprint arXiv:2601.18491, 2026a

    Dongrui Liu, Qihan Ren, Chen Qian, Shuai Shao, Yuejin Xie, Yu Li, Zhonghao Yang, Haoyu Luo, Peng Wang, Qingyu Liu, et al. AgentDoG: A diagnostic guardrail framework for AI agent safety and security.arXiv preprint arXiv:2601.18491, 2026a. Xiaogeng Liu, Nan Xu, Muhao Chen, and C...

    arXiv

  2. [15]

    SafeHarbor: Hierarchical memory-augmented guardrail for LLM agent safety.arXiv preprint arXiv:2605.05704, 2026b

    Zhe Liu, Zonghao Ying, Wenxin Zhang, Quanchen Zou, Deyue Zhang, Dongdong Yang, Xiangzheng Zhang, and Hao Peng. SafeHarbor: Hierarchical memory-augmented guardrail for LLM agent safety.arXiv preprint arXiv:2605.05704, 2026b. Jiaqi Luo, Songyang Peng, Jiarun Dai, Zhile Chen, Zhu...

    arXiv

  3. [16]

    Benchmarking safety risks of knowledge-intensive reasoning under malicious knowledge editing.arXiv preprint arXiv:2605.10146,

    Qinghua Mao, Xi Lin, Jinze Gu, Jun Wu, Siyuan Li, and Yuliang Chen. Benchmarking safety risks of knowledge-intensive reasoning under malicious knowledge editing.arXiv preprint arXiv:2605.10146,

    arXiv

  4. [17]

    Tree of attacks: Jailbreaking black-box LLMs automatically.arXiv preprint arXiv:2312.02119,

    Anay Mehrotra, Manolis Zampetakis, Paul Kassianik, Blaine Nelson, Hyrum Anderson, Yaron Singer, and Amin Karbasi. Tree of attacks: Jailbreaking black-box LLMs automatically.arXiv preprint arXiv:2312.02119,

    arXiv

  5. [18]

    Accessed: 2026-07-26

    URL https://www.kimi.com/blog/ kimi-k2-6. Accessed: 2026-07-26. Yutao Mou, Zhangchi Xue, Lijun Li, Peiyang Liu, Shikun Zhang, Wei Ye, and Jing Shao. ToolSafe: Enhancing tool invocation safety of LLM-based agents via proactive step-level guardrail and feedback.arXiv preprint ar...

    2026

  6. [19]

    Accessed: 2026-07-26

    URL https://openai.com/index/introducing-gpt-5-5/ . Accessed: 2026-07-26. Traian Rebedea, Razvan Dinu, Makesh Narsimhan Sreedhar, Christopher Parisien, and Jonathan Cohen. NeMo guardrails: A toolkit for controllable and safe LLM applications with programmable rails. In Proceed...

    2026

  7. [20]

    Progent: Securing AI agents with privilege control.arXiv preprint arXiv:2504.11703,

    Tianneng Shi, Jingxuan He, Zhun Wang, Hongwei Li, Linyu Wu, Wenbo Guo, and Dawn Song. Progent: Securing AI agents with privilege control.arXiv preprint arXiv:2504.11703,

    arXiv

  8. [21]

    The ai risk repository: A comprehensive meta-review, database, and taxonomy of risks from artificial intelligence.arXiv preprint arXiv:2408.12622,

    Peter Slattery, Alexander K Saeri, Emily AC Grundy, Jess Graham, Michael Noetel, Risto Uuk, James Dao, Soroush Pour, Stephen Casper, and Neil Thompson. The ai risk repository: A comprehensive meta-review, database, and taxonomy of risks from artificial intelligence.arXiv prepr...

    arXiv

  9. [22]

    ABSTRAL: Automatic design of multi-agent systems through iterative refinement and topology optimization.arXiv preprint arXiv:2603.22791,

    Weijia Song, Jiashu Yue, and Zhe Pang. ABSTRAL: Automatic design of multi-agent systems through iterative refinement and topology optimization.arXiv preprint arXiv:2603.22791,

  10. [23]

    github.io/posts/2026-07-04-harness/

    URL https://lilianweng. github.io/posts/2026-07-04-harness/. Yifan Yang, Ziyang Gong, Weiquan Huang, Qihao Yang, Ziwei Zhou, Zisu Huang, Yan Li, Xuemei Gao, Qi Dai, Bei Liu, Kai Qiu, Yuqing Yang, Dongdong Chen, Xue Yang, and Chong Luo. Skillopt: Executive strategy for self-evo...

    2026 arXiv

  11. [24]

    GPTFUZZER: Red teaming large language models with auto-generated jailbreak prompts.arXiv preprint arXiv:2309.10253,

    Jiahao Yu, Xingwei Lin, Zheng Yu, and Xinyu Xing. GPTFUZZER: Red teaming large language models with auto-generated jailbreak prompts.arXiv preprint arXiv:2309.10253,

    arXiv

  12. [25]

    R-Judge: Benchmarking safety risk awareness for LLM agents

    Tongxin Yuan, Zhiwei He, Lingzhong Dong, Yiming Wang, Ruijie Zhao, Tian Xia, Lizhen Xu, Binglin Zhou, Fangqi Li, Zhuosheng Zhang, Rui Wang, and Gongshen Liu. R-Judge: Benchmarking safety risk awareness for LLM agents. InFindings of the Association for Computational Linguistics...

    2024

  13. [26]

    URLhttps://aclanthology.org/2024.findings-emnlp.79/. Z.ai. GLM-5.2: Built for long-horizon tasks, June

    2024

  14. [27]

    Accessed: 2026- 07-26

    URL https://z.ai/blog/glm-5.2. Accessed: 2026- 07-26. Wenjun Zeng, Yuchi Liu, Ryan Mullins, Ludovic Peran, Joe Fernandez, Hamza Harkous, Karthik Narasimhan, Drew Proud, Piyush Kumar, Bhaktipriya Radharapu, Olivia Sturman, and Oscar Wahltinez. Shieldgemma: Generative AI content...

    2026 arXiv

  15. [28]

    Self-harness: Harnesses that improve themselves.arXiv preprint arXiv:2606.09498,

    Hangfan Zhang, Shao Zhang, Kangcong Li, Chen Zhang, Yang Chen, Yiqun Zhang, Lei Bai, and Shuyue Hu. Self-harness: Harnesses that improve themselves.arXiv preprint arXiv:2606.09498,

    arXiv

  16. [29]

    Agent-safetybench: Evaluating the safety of LLM agents.arXiv preprint arXiv:2412.14470,

    Zhexin Zhang, Shiyao Cui, Yida Lu, Jingzhuo Zhou, Junxiao Yang, Hongning Wang, and Minlie Huang. Agent-safetybench: Evaluating the safety of LLM agents.arXiv preprint arXiv:2412.14470,

    arXiv

  17. [30]

    ClawGuard: A runtime security framework for tool-augmented LLM agents against indirect prompt injection.arXiv preprint arXiv:2604.11790,

    Wei Zhao, Zhe Li, Peixin Zhang, and Jun Sun. ClawGuard: A runtime security framework for tool-augmented LLM agents against indirect prompt injection.arXiv preprint arXiv:2604.11790,

    arXiv

  18. [2022]

    Pappas, and Eric Wong

    Patrick Chao, Alexander Robey, Edgar Dobriban, Hamed Hassani, George J. Pappas, and Eric Wong. Jailbreaking black box large language models in twenty queries.arXiv preprint arXiv:2310.08419,

    arXiv

  19. [2023]

    The MiniMax-M2 series: Mini activations unleashing max real-world intelligence.arXiv preprint arXiv:2605.26494,

    Aili Chen, Aonian Li, Baichuan Zhou, Bangwei Gong, Binyang Jiang, Boji Dan, Changqing Yu, Chao Wang, Cheng Ma, Cheng Zhong, et al. The MiniMax-M2 series: Mini activations unleashing max real-world intelligence.arXiv preprint arXiv:2605.26494,

    arXiv

  20. [2024]

    10 Suyu Ge, Chunting Zhou, Rui Hou, Madian Khabsa, Yi-Chia Wang, Qifan Wang, Jiawei Han, and Yuning Mao

    URLhttps://openreview.net/forum?id=m1YYAQjO3w. 10 Suyu Ge, Chunting Zhou, Rui Hou, Madian Khabsa, Yi-Chia Wang, Qifan Wang, Jiawei Han, and Yuning Mao. MART: Improving LLM safety with multi-round automatic red-teaming. InProceedings of the 2024 Conference of the North American...

    2024

  21. [2025]

    Zico Kolter, Matt Fredrikson, Eric Winsor, Jerome Wynne, Yarin Gal, and Xander Davies

    Maksym Andriushchenko, Alexandra Souly, Mateusz Dziemian, Derek Duenas, Maxwell Lin, Justin Wang, Dan Hendrycks, Andy Zou, J. Zico Kolter, Matt Fredrikson, Eric Winsor, Jerome Wynne, Yarin Gal, and Xander Davies. AgentHarm: A benchmark for measuring harmfulness of LLM agents.a...

    arXiv

  22. [2026]

    LlamaFirewall: An open source guardrail system for building secure AI agents.arXiv preprint arXiv:2505.03574,

    Sahana Chennabasappa, Cyrus Nikolaidis, Daniel Song, David Molnar, Stephanie Ding, Shengye Wan, Spencer Whitman, Lauren Deason, Nicholas Doucette, Abraham Montilla, Alekhya Gampa, Beto de Paola, Dominik Gabi, James Crnkovich, Jean-Christophe Testud, Kat He, Rashnil Chaturvedi,...

    arXiv

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.