As LLM-based agents operate over sequential multi-step reasoning, hallucinations arising at intermediate steps risk propagating along the trajectory, thus degrading overall reliability. Unlike hallucination detection in single-turn responses, diagnosing hallucinations in multi-step workflows requires identifying which step causes the initial divergence. To fill this gap, we propose a new research task, automated hallucination attribution of LLM-based agents, aiming to identify the step responsible for the hallucination and explain why. To support this task, we introduce AgentHallu, a comprehensive benchmark with: (1) 693 high-quality trajectories spanning 7 agent frameworks and 5 domains, (2) a hallucination taxonomy organized into 5 categories (Planning, Retrieval, Reasoning, Human-Interaction, and Tool-Use) and 14 sub-categories, and (3) multi-level annotations curated by humans, covering binary labels, hallucination-responsible steps, and causal explanations. We evaluate 13 leading models, and results show the task is challenging even for top-tier models (like GPT-5, Gemini-2.5-Pro). The best-performing model achieves only 41.1% step localization accuracy, where tool-use hallucinations are the most challenging at just 11.6%. We believe AgentHallu will catalyze future research into developing robust, transparent, and reliable agentic systems.

Large vision-language models (LVLMs) are increasingly deployed as autonomous mobile agents that execute tasks through GUI interaction. However, their security under realistic deployment constraints remains insufficiently understood. Existing attacks typically rely on persistent visual manipulations, privileged system access, or iterative jailbreak interactions, limiting their practicality. In this work, we identify a previously overlooked discrepancy between human and agent interactions: automated mobile agents generate near-zero touch-contact signals that systematically differ from human touches. Based on this observation, we introduce agent-only perceptual injection, a new attack paradigm that exposes malicious prompts only during agent interactions while keeping them unexposed during normal user operation. To realize this attack, we propose a low-privilege framework that combines in-app prompt embedding, interaction-triggered activation, and HG-IDA*, an efficient one-shot jailbreak optimization method tailored to mobile UI constraints. Experiments on multiple Android applications and LVLM backends, such as GPT-4o, show that our attacks reliably hijack both agent planning and execution. Our method achieves up to 95.0% planning attack success rate and 82.5% execution attack success rate on commercial LVLM backends. These findings reveal a new interaction-level attack surface and highlight the need for provenance-aware defenses in mobile agent systems.

Recent studies show that large language models (LLMs) are vulnerable to jailbreak attacks, which can bypass their defense mechanisms. However, existing jailbreak research often exhibits limitations in universality, validity, and efficiency. Therefore, we rethink jailbreaking LLMs and define three key properties to guide the design of effective jailbreak methods. We introduce AutoBreach, a novel black-box approach that uses wordplay-guided mapping rule sampling to create universal adversarial prompts. By leveraging LLMs’ summarization and reasoning abilities, AutoBreach minimizes manual effort. To boost jailbreak success rates, we further suggest sentence compression and chain-of-thought-based mapping rules to correct errors and wordplay misinterpretations in target LLMs. Also, we propose a two-stage mapping rule optimization that initially optimizes mapping rules before querying target LLMs to enhance efficiency. Experimental results indicate AutoBreach efficiently identifies security vulnerabilities across various LLMs (Claude-3, GPT-4, etc.), achieving an average success rate of over 80% with fewer than 10 queries. Notably, the adversarial prompts generated by AutoBreach for GPT-4 can directly bypass the defenses of the advanced commercial LLM GPT o1-preview, demonstrating strong transferability and universality.