LLM Agents Under Threat in Cyberspace

About

A focused forum for understanding how autonomous language-model agents fail under adversarial pressure—and how to build systems that remain reliable when inputs, tools, and collaborators cannot be trusted.

LLM agents increasingly observe, remember, plan, coordinate, and act through external tools. These capabilities create attack surfaces across input channels, tool use, memory, identity, and multi-agent communication.

This workshop brings together researchers and practitioners working on realistic attacks, evaluations, secure agent architectures, and responsible defenses for agents operating in adversarial environments.

Call for Papers

LLM Agents Under Threat in Cyberspace invites submissions from researchers and practitioners studying how autonomous LLM agents behave when their observations, memories, tools, identities, and collaborators may be adversarial or compromised. As agents gain the ability to browse the web, execute code, call APIs, use credentials, access external services, and coordinate with other agents, traditional language-model vulnerabilities can become concrete security failures with consequences beyond the model interface.

The workshop connects research on attacks, defenses, evaluation, and secure system design. We welcome empirical studies, new benchmarks, red-teaming methods, secure architectures, position papers, datasets, and lessons from deployed systems. We are especially interested in work that develops realistic threat models, evaluates end-to-end agent behavior, and proposes defenses that remain effective against adaptive attackers.

Topics include, but are not limited to:

• Direct and indirect prompt injection. Attacks that use user inputs, retrieved content, web pages, documents, messages, or other untrusted context to redirect agent behavior.
• Adversarial observations and context manipulation. Deceptive environmental feedback, context corruption, instruction conflicts, and attacks on an agent’s perception of its state or goals.
• Memory and retrieval poisoning. Persistent compromise through long-term memory, retrieval systems, knowledge bases, cached interactions, and cross-session state.
• Multimodal attacks against agents. Manipulation delivered through images, audio, video, interfaces, documents, and mixed-modality observations.
• Tool and privilege misuse. Exploitation of browsers, code execution, APIs, credentials, permissions, external services, and action-planning pipelines.
• Multi-agent security. Compromised agents, trust and identity, adversarial coordination, collusion, delegation failures, and cascading failures in agent ecosystems.
• Secure agent architectures. Isolation, sandboxing, least privilege, safe tool interfaces, policy enforcement, capability control, and secure-by-design orchestration.
• Monitoring, provenance, and recovery. Runtime detection, audit trails, provenance tracking, incident response, rollback, recovery, and effective human oversight.
• Evaluation and benchmarking. Realistic threat models, red-teaming methods, environments, metrics, datasets, reproducible benchmarks, and end-to-end evaluations.
• Responsible deployment and disclosure. Operational lessons, deployment safeguards, defense limitations, vulnerability coordination, and responsible disclosure practices.

Important Dates

• Submission deadline:November 20, 2026Anywhere on Earth
• Acceptance notification:December 2, 2026Author notification
• Workshop:February 22 or 23, 2027In person · Montréal

Submission Guidelines

Status: Submission instructions will be announced soon.

• Length: Full papers up to 7 pages, excluding references. Shorter papers are welcome.
• Format: AAAI two-column format.
• Review: Single-blind, with at least two reviews and a third review for borderline submissions.
• Publication: Non-archival. Authors retain the ability to submit expanded work elsewhere.
• Responsible disclosure: Responsible disclosure is expected for work involving real systems or vulnerabilities.

Schedule

All times are local.