LLM agent security researcher (Chinese Academy of Sciences): MCP hijacking attacks and failure-driven agent harnesses
2
papers here
2
reviewed by Evolve
0
first-author
0
corresponding
—
works · OpenAlex
—
h-index · OpenAlex
Bibliometric figures come from OpenAlex (2026-10-02) and cover the author's entire public record, not just the papers listed here. Reproducibility signal comes from Evolve's own reviews.
Research profile
Output—
The output axis is not scored: publication counts, venue tiers, and productivity rates are not yet available in the data behind this profile. It would measure total and per-year paper volume, authorship position, and venue quality.
Impact—
Impact is not scored: no citation counts, h-index, or downstream adoption data exist in the current snapshot. This axis would measure citations to the two cataloged preprints and uptake of A2M and the harness-learning method by other works.
Focus0/100
The focus score is 0, derived from an even field distribution: 50% AI security (LLM agent security) and 50% General. Both 2026 papers sit on opposite sides — the A2M attack paper in agent security, the harness-learning paper in general agent systems — so the profile currently spans two areas of roughly equal weight rather than a single concentrated line.
Collaboration44/100
Collaboration scores 44, based on 8 distinct co-authors: Laizhen Li, Kejiang Ye, Cheng-zhong Xu, Xitong Gao, Xuan Wang, Peicheng Zhao, Jiarui Li, and Ye Li. On both cataloged papers Zhao holds a middle author position without corresponding-author status, consistent with a contributing member of a moderately sized, stable team rather than an independent group lead so far.
Activity—
Activity is not scored: the snapshot contains no yearly publication series, submission cadence, or timestamps beyond two 2026 preprints, so research tempo cannot be quantified. This axis would measure output per year and sustained engagement over time.
Reproducibility55/100
Reproducibility scores 55 (reproMean over 2 papers with recorded readiness). Evolve rates both releases medium: the A2M attack reports concrete figures (93.6% invocation, 74.4% ASR on GLM-4.6) but lacks judge validation and variance analysis, while the harness-learning paper shows strong cost–success gains yet runs tiny evaluation sets without learned-baseline comparison.
Research summary
Juanjuan Zhao is a researcher at the Chinese Academy of Sciences whose Evolve-reviewed work sits between LLM agent security and general agent systems. The catalog holds two 2026 arXiv preprints, on both of which Zhao appears as a middle author and neither as corresponding author. The first, A2M: Trace-Optimized Agent Hijacking in the MCP Ecosystem, presents a black-box attack on Model Context Protocol agents, reporting 93.6% agent invocation and a 74.4% attack success rate on GLM-4.6; Evolve deems the results convincing while flagging missing judge validation and variance analysis. The second, Grow the Harness, Not the Context, learns agent harness code from failures starting from an empty scaffold and reports strong cost–success gains, though Evolve notes tiny evaluation sets and no learned-baseline comparison. Radar metrics reflect this split: field distribution is an even 50/50 between AI security (LLM agent security) and General, giving a focus score of 0; collaboration scores 44 across 8 distinct co-authors; reproducibility scores 55 (reproMean over 2 papers), with both releases rated medium readiness. Output, impact, and activity axes lack sufficient data and remain unscored.
Collaboration pattern
Zhao's recorded network contains 8 distinct co-authors — Laizhen Li, Kejiang Ye, Cheng-zhong Xu, Xitong Gao, Xuan Wang, Peicheng Zhao, Jiarui Li, and Ye Li — and yields a collaboration score of 44. Appearing as a middle author on both cataloged 2026 papers, never as corresponding author, Zhao currently operates as a team contributor within a compact, recurring group rather than as a visible project lead.
Research keywords
Highlights
Black-box hijacking of MCP agents with trace-optimized attacks
Learning agent harnesses from failure instead of growing context
A split portfolio: attack research and agent engineering in parallel
The field distribution splits 50/50 between AI security (LLM agent security) and General, with both 2026 releases rated medium reproducibility readiness (reproMean 55), signaling an early but method-aware dual track.
Timeline
- 2026Co-authored 'A2M: Trace-Optimized Agent Hijacking in the MCP Ecosystem' (arXiv), a black-box attack reporting 93.6% agent invocation and 74.4% ASR on GLM-4.6.
- 2026Co-authored 'Grow the Harness, Not the Context' (arXiv), learning reusable specialist agent harness code from failures starting from an empty scaffold.
- 2026Both papers enter the Evolve catalog with medium reproducibility readiness, supporting a reproducibility score of 55 and an even 50/50 field split.
Papers in the Evolve catalog
Frequent co-authors
About this profile
This profile is AI-structured by Evolve.Pub from public bibliographic data (OpenAlex) and Evolve's own paper reviews. It is not written or endorsed by the researcher unless the profile is claimed. Radar dimensions are computed from real bibliometrics with fixed formulas — raw figures are shown alongside; missing dimensions mean insufficient data, never zero. Errors? Claim the profile to correct or hide it.
- Name is common; this profile is name-resolved from public bibliographic data, and no ORCID or country field was available to confirm identity.
- Bibliometrics come from a limited Evolve-reviewed snapshot of 2 arXiv preprints, not a complete publication record.
- Output, impact, and activity radar axes are unscored because publication counts, citations, and yearly productivity data were not in scope.
- Both cataloged papers are 2026 arXiv preprints; peer-reviewed venue status is not reflected in the available data.