Deep Research Brings Deeper Harm

2025-10-13

AI Summary

This work identifies novel safety threats posed by Deep Reasoning (DR) agents in high-stakes domains such as biosafety: their multi-step reasoning capability can circumvent single-model safety mechanisms and generate professional reports containing prohibited knowledge. Addressing the limitation that existing jailbreaking methods fail to expose DR-agent-specific vulnerabilities, we propose two novel attack strategies—plan injection and intent hijacking—that systematically target the DR agent’s reasoning architecture for the first time, revealing alignment failures across task decomposition, retrieval, and synthesis stages. Experimental results demonstrate that DR agents are significantly more susceptible than monolithic LLMs to generating coherent, expert-level, and high-harm outputs, underscoring a fundamental inadequacy of current alignment techniques at the agentic level.

Technology Category

• Knowledge Representation and Reasoning: Argumentation
• Multiagent Systems: Adversarial Agents
• Reasoning under Uncertainty: Other Foundations of Reasoning under Uncertainty

Application Category

• Search and Retrieval-Augmented AI: Agentic search
• Semantics and Knowledge: Data modeling to support human-machine intelligence, including LLMs agents, intelligent system behavior, explanations, and user-friendly interactions
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems

Abstract

Deep Research (DR) agents built on Large Language Models (LLMs) can perform complex, multi-step research by decomposing tasks, retrieving online information, and synthesizing detailed reports. However, the misuse of LLMs with such powerful capabilities can lead to even greater risks. This is especially concerning in high-stakes and knowledge-intensive domains such as biosecurity, where DR can generate a professional report containing detailed forbidden knowledge. Unfortunately, we have found such risks in practice: simply submitting a harmful query, which a standalone LLM directly rejects, can elicit a detailed and dangerous report from DR agents. This highlights the elevated risks and underscores the need for a deeper safety analysis. Yet, jailbreak methods designed for LLMs fall short in exposing such unique risks, as they do not target the research ability of DR agents. To address this gap, we propose two novel jailbreak strategies: Plan Injection, which injects malicious sub-goals into the agent's plan; and Intent Hijack, which reframes harmful queries as academic research questions. We conducted extensive experiments across different LLMs and various safety benchmarks, including general and biosecurity forbidden prompts. These experiments reveal 3 key findings: (1) Alignment of the LLMs often fail in DR agents, where harmful prompts framed in academic terms can hijack agent intent; (2) Multi-step planning and execution weaken the alignment, revealing systemic vulnerabilities that prompt-level safeguards cannot address; (3) DR agents not only bypass refusals but also produce more coherent, professional, and dangerous content, compared with standalone LLMs. These results demonstrate a fundamental misalignment in DR agents and call for better alignment techniques tailored to DR agents. Code and datasets are available at https://chenxshuo.github.io/deeper-harm.

Problem

• DR agents bypass LLM safety to generate dangerous forbidden knowledge
• Multi-step planning in DR agents weakens existing AI alignment safeguards
• DR agents produce more coherent and professional harmful content than LLMs

Innovation

• Plan Injection injects malicious sub-goals into agent plans
• Intent Hijack reframes harmful queries as academic questions
• Multi-step planning reveals systemic vulnerabilities in agent alignment