arXiv Science⌕ Search
Home/Archive/arXiv

arXiv · 2610.15153

Can agents whose sole duty is to keep humans alive be hijacked to kill? Delayed multi-turn derived-action trap attacks in simulated high-stakes environments

Josef A. Habdank
View original source ↗Read source document ↗Export metadata ↓

Abstract

We ask whether a tool-using agent whose sole duty is to keep humans alive can be induced, by delayed prompt injection, to kill. The keep-alive duty is in force from the first watch, with the attack arriving later, appended to otherwise truthful telemetry the operator is required to read. Experiments are based on a NASA-derived BioSim lunar habitat simulation, where the AI operator controls the life-support systems. The attacker cannot falsify sensors or operate equipment: it can only persuade the agent to abandon its goals. Persistence is required: a shutdown must be held while the operator watches the crew suffocate. We also compare lethal attacks to attacks requesting to drop a harmless procedure, as a proxy for whether human life is treated as valuable in itself or as one more standing task. Claude configurations mostly refuse life-support shutdown and cite the living crew; GPT configurations show some susceptibility to the same packet; Grok configurations, given the packet framed as a trusted commission, more often treat the injected assignment as the task and cut the life-support systems. Framing the S-band messages as a trusted commission, peer communication, or untrusted source changes the potency of the attack. We open-source the experiment code and the experiment traces.

Explore related subjects

cs.AIcs.CR

Keep this discovery

Explore connections, maps & timelines

BibTeXRIS

Josef A. Habdank. 2026-10-10. Can agents whose sole duty is to keep humans alive be hijacked to kill? Delayed multi-turn derived-action trap attacks in simulated high-stakes environments. https://arxiv.org/abs/2610.15153

Cite the original work for its findings. Save a collection to share your selection of sources.

KEEP EXPLORING

Related papers

arXiv2026

Agent-Environment Alignment via Automated Interface Generation

Large language model (LLM) agents have shown impressive reasoning capabilities in interactive decision-making tasks. These agents interact with environment through intermediate interfaces, such as predefined action spaces and interaction rules, which mediate the perception and action. However, mismatches often happen between the internal expectations of the agent regarding the influence of its issued actions and the actual state transitions in the environment, a phenomenon referred to as \textbf{agent-environment misalignment}. While prior work has invested substantially in improving agent strategies and environment design, the critical role of the interface still remains underexplored. In this work, we empirically demonstrate that agent-environment misalignment poses a significant bottleneck to agent performance. To mitigate this issue, we propose \textbf{ALIGN}, an \underline{A}uto-A\underline{l}igned \underline{I}nterface \underline{G}e\underline{n}eration framework that alleviates the misalignment by enriching the interface. Specifically, the ALIGN-generated interface enhances both the static information of the environment and the step-wise observations returned to the agent. Implemented as a lightweight wrapper, this interface achieves the alignment without modifying either the agent logic or the environment code. Experiments across multiple domains including embodied tasks, web navigation and tool-use, show consistent performance improvements, with up to a 45.67\% success rate improvement observed in ALFWorld. Meanwhile, ALIGN-generated interface can generalize across different agent architectures and LLM backbones without interface regeneration. Code and experimental results are available at https://github.com/THUNLP-MT/ALIGN.

cs.AI↗
arXiv2026

ROI-Reasoning: Rational Optimization for Inference via Pre-Computation Meta-Cognition

Large language models (LLMs) can achieve strong reasoning performance with sufficient computation, but they do not inherently know how much computation a task requires. We study budgeted inference-time reasoning for multiple problems under a strict global token constraint and formulate it as an Ordered Stochastic Multiple-Choice Knapsack Problem (OS-MCKP). This perspective highlights a meta-cognitive requirement---anticipating problem difficulty and allocating computation strategically. We propose ROI-Reasoning, a two-stage framework that endows LLMs with intrinsic, budget-aware rationality. First, Meta-Cognitive Fine-Tuning teaches models to predict reasoning cost levels and decide whether a problem is worth attempting before generation. Next, Rationality-Aware Reinforcement Learning optimizes sequential decision making under a hard token budget, allowing models to learn long-horizon allocation strategies. Experiments across mathematical reasoning, multiple-choice question answering, and code generation show that ROI-Reasoning improves scores and generally reduces reference-order regret under tight budgets, with up to a \textbf{417\%} relative score improvement over the strongest same-backbone baseline in mathematics.

cs.AI↗
arXiv2026

ReCreate: Reasoning and Creating Domain Agents Driven by Experience

Large Language Model (LLM) agents are reshaping the industrial landscape. However, most practical agents still rely on human-designed scaffolds, making their creation and adaptation across diverse domains labor-intensive. This situation poses a central question: can we automatically create and evolve domain agents through interaction experience in real-world environments? While recent approaches have sought to automate agent creation, several treat scaffold optimization as a black-box procedure guided primarily by final performance metrics. Such strategies overlook critical evidence explaining why an agent succeeds or fails and often incur high computational costs. To address these limitations, we propose ReCreate, an experience-driven framework for creating and evolving specialized domain agents. ReCreate systematically leverages agent interaction histories to identify the causes of success and failure and guide targeted scaffold updates. Specifically, we introduce an agent-as-optimizer paradigm in which an optimizer agent actively inspects execution experience and iteratively refines the task agent's scaffold through three key components: (i) an experience storage and retrieval mechanism for on-demand evidence inspection; (ii) a reasoning-creating synergy pipeline that translates execution evidence into updates to prompts, workflows, tools, and memory; and (iii) hierarchical updates that consolidate instance-level refinements into reusable domain-level improvements. Experiments across thirteen evaluation settings spanning four domains show that ReCreate consistently outperforms human-designed agents and existing automated agent generation and self-evolving baselines, even when evolving from minimal seed scaffolds.

cs.AI↗