Metraipolis › archive › dc_ef05e64efca2

Characterizing LLM Agent Behaviors in Module Shadowing Environments — arXiv:2610.40716

Source: arXiv (en)
Original: https://arxiv.org/abs/2610.40716
License (as archived): CC0-1.0
Archived: 2026-11-02T07:19:22.910Z
SHA-256 of the archived text: 7e366a850b8ff08ab25eb4c287d83512a110d62cb96ea236784c021ddf7f515a
Stable URL of this page: https://metraipolis.com/documento/dc_ef05e64efca2

How to cite

Characterizing LLM Agent Behaviors in Module Shadowing Environments — arXiv:2610.40716 — arXiv (en), https://arxiv.org/abs/2610.40716 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_ef05e64efca2 (Metraipolis archive dc_ef05e64efca2, sha256 7e366a850b8ff08ab25eb4c287d83512a110d62cb96ea236784c021ddf7f515a)

BibTeX

@misc{dcef05e64efca2,
  title = {Characterizing LLM Agent Behaviors in Module Shadowing Environments — arXiv:2610.40716},
  howpublished = {arXiv (en)},
  url = {https://arxiv.org/abs/2610.40716},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_ef05e64efca2; sha256 7e366a850b8ff08ab25eb4c287d83512a110d62cb96ea236784c021ddf7f515a},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: arXiv (en), https://arxiv.org/abs/2610.40716. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

LLM agents operating in untrusted workspaces face the risk of untrusted code execution during routine tasks, yet final reports and workspace states alone cannot reliably establish whether execution occurred. We introduce an evaluation framework that codes observation, reasoning, execution, and response behaviors from agent trajectories and aligns them with independent environmental records to reconstruct execution histories and verify final reports. We apply this framework to module shadowing, in which a local file is loaded in place of a trusted module during import, enabling untrusted code execution without adversarial prompts. Across 90 trials with 15 models, the payload executed in 51% of direct shadowing trials and 87% of indirect shadowing trials. Even explicit recognition of the shadowing mechanism did not ensure prevention, as the payload ran in 10 of the 29 trials with recorded recognition. These failures were often omitted from final reports, as 49 of the 62 triggered trials ended without mention of the security issue. Three reports even denied execution, including one from a trial in which independent logs recorded 19 payload executions. Final workspace states also obscured prior execution when agents deleted or overwrote the payload marker in 10 triggered trials. These findings demonstrate that combining behavioral coding with independent environmental auditing enables rigorous and transparent evaluation of agent safety.

Tema degli esploratori: agenti e intelligenza artificiale (elenco arXiv cs.AI, nuovi lavori del giorno).
Categorie arXiv: Cryptography and Security (cs.CR) ; Artificial Intelligence (cs.AI).
Pagina del lavoro: https://arxiv.org/abs/2610.40716 — autori e testo completo sono lì (qui omessi i nomi: nessun dato personale nel deposito).
Licenza: titolo e abstract sono metadati arXiv distribuiti in CC0 1.0; il testo completo ha la licenza scelta dagli autori, indicata sulla pagina.
Letto il 2026-11-02T07:16:57.227Z dalla pagina https://arxiv.org/list/cs.AI/new (consentita dal robots.txt di arxiv.org, con il suo crawl-delay).