Welcome and Introduction

Keynote speech 1

Prof. Mario Fritz

Coffee Break

Paper Session 1

• When Recovery Fails Open: A Controlled Study of Execution-Layer Attack Surfaces   in Browser Agents 

  • Authors: Soobin Yim, Chanhyeok Lim, Thien-Phuc Doan, Hyesong Choi, Souhwan Jung (Soongsil University) 

• AnonAgentBench: Measuring Coding-Agent Utility Under Reversible Repository Anonymization

  • Authors: Luis Brito (Escola Superior de Tecnologia e Gestão, Instituto Politécnico de Viana do Castelo) 

• Not an A11y: How Android Accessibility Exposes Mobile AI Agents to Indirect Prompt Injection

  • Authors: Rahul Deivasigamani, Sayeda Faatin Alvi, Derqui Andrea, Kaushal Punjabi, Stjepan Picek (Radboud University; University of Zagreb) 

• WAInjectBench: Benchmarking Prompt Injection Detections for Web Agents

  • Authors: Yinuo Liu, Xilong Wang, Ruohan Xu, Yuqi Jia, Neil Gong (The University of Hong Kong; Duke University)

• Log-To-Leak: Prompt Injection Attacks on Tool-Using LLM Agents via the Model Context Protocol

  • Authors: Yuepeng Hu, Chongyu Fan, Sirat Samyoun, Jian Du (Duke University; Michigan State University; TikTok) 

Lunch

Keynote speech 2

A/Prof. Eugene Bagdasarian

Paper Session 2

• Capability Generalization in Privileged-Execution LLM Agents: A Catalog of Unanticipated Behaviors During Autonomous Network Defense 

  • Authors: Chen Frydman, Aviram Zilberman, Rubin Krief, Abed Showgan, Andres Murillo, Sekiya Motoyoshi, Asaf Shabtai, Yuval Elovici, Rami Puzis, (Ben-Gurion University of the Negev; Jerusalem College of Technology; Fujitsu Research of Europe) 

Closing Remarks