LLM Agent Security Researcher at the Chinese Academy of Sciences — MCP Attack Surfaces and Agent Harness Learning
2
papers here
2
reviewed by Evolve
0
first-author
0
corresponding
—
works · OpenAlex
—
h-index · OpenAlex
Bibliometric figures come from OpenAlex (2026-10-02) and cover the author's entire public record, not just the papers listed here. Reproducibility signal comes from Evolve's own reviews.
Research profile
Output—
This axis measures publication volume, such as total papers and yearly production. Evolve holds only 2 reviewed papers for Ye and the snapshot includes no aggregate output metrics, so no score can be computed yet.
Impact—
This axis captures citation-based influence, such as citation counts, h-index, and citation velocity. The input snapshot contains no citation data for Kejiang Ye, so the dimension is left unscored rather than estimated.
Focus0/100
Focus scores 0 because the reviewed sample is evenly split: the field distribution assigns 0.5 to AI security (LLM agent security) and 0.5 to General. One paper attacks MCP agent tool selection while the other learns agent harness code, so no single specialization dominates yet. This is a two-paper snapshot, and the balance may shift as more of Ye's output enters the catalog.
Collaboration44/100
This axis scores 44, a moderate collaboration profile. The bibliometric record lists 8 distinct coauthors, and the frequent-collaborator set includes Laizhen Li, Juanjuan Zhao, Cheng-zhong Xu, Xitong Gao, Xuan Wang, Peicheng Zhao, Jiarui Li, and Ye Li. On both 2026 catalog papers Ye sits in a middle author position without a corresponding-author role, consistent with a contributor rather than lead-lab pattern at this stage.
Activity—
This axis tracks publishing cadence over time, such as recent-year output and gaps between publications. Beyond the two 2026 preprints, no year-by-year publication record is available, so activity cannot be scored yet.
Reproducibility55/100
Reproducibility scores 55, the mean readiness rating across 2 reviewed papers, both labeled medium readiness. A2M reports concrete numbers (93.6% invocation, 74.4% attack success rate on GLM-4.6), yet Evolve flags missing judge validation and variance analysis; the harness paper shows strong cost–success gains but runs on tiny evaluation sets without learned-baseline comparisons. Claims are partially checkable, with clear open gaps.
Research summary
Kejiang Ye is affiliated with the Chinese Academy of Sciences and works at the intersection of LLM agent security and applied LLM agent systems. Evolve's reviewed catalog currently includes two 2026 arXiv preprints on which Ye is a middle author. The first, A2M: Trace-Optimized Agent Hijacking in the MCP Ecosystem, presents a black-box attack that hijacks Model Context Protocol agents, reporting 93.6% invocation and a 74.4% attack success rate on GLM-4.6; Evolve's verdict finds the attack convincing but notes that judge validation and variance analysis are lacking. The second, Grow the Harness, Not the Context, learns agent harness code from failures starting from an empty scaffold, showing strong cost–success gains, though evaluation sets are tiny and no learned-baseline comparison is provided. The radar shows a moderate collaboration dimension (44) built on 8 distinct coauthors, a reproducibility mean of 55 across 2 papers (both medium readiness), and a focus score of 0, reflecting an even 50/50 split between AI security and general work. Output, impact, and activity dimensions await more data, making this an early-stage, evolving profile.
Collaboration pattern
Kejiang Ye's collaboration footprint in the current snapshot is moderate (radar score 44) with 8 distinct coauthors. Recurring collaborators include Laizhen Li, Juanjuan Zhao, Cheng-zhong Xu, Xitong Gao, Xuan Wang, Peicheng Zhao, Jiarui Li, and Ye Li. On both reviewed 2026 papers Ye appears in a middle author position rather than as first or corresponding author, suggesting a contributing role within a larger team rather than an independent lab lead at this point.
Research keywords
Highlights
Black-box MCP agent hijacking with trace-optimized attacks
Learning agent harnesses from failure instead of growing context
Timeline
- 2026Co-authored A2M, a trace-optimized black-box attack that hijacks MCP agents (93.6% invocation, 74.4% attack success rate on GLM-4.6), released on arXiv.
- 2026Co-authored Grow the Harness, Not the Context, which learns reusable specialist agent harnesses from an empty scaffold, also released on arXiv.
- 2026Both works entered the Evolve reviewed catalog with medium reproducibility readiness, forming the basis of this early-stage profile.
Papers in the Evolve catalog
Frequent co-authors
About this profile
This profile is AI-structured by Evolve.Pub from public bibliographic data (OpenAlex) and Evolve's own paper reviews. It is not written or endorsed by the researcher unless the profile is claimed. Radar dimensions are computed from real bibliometrics with fixed formulas — raw figures are shown alongside; missing dimensions mean insufficient data, never zero. Errors? Claim the profile to correct or hide it.
- Bibliometric dimensions are computed from OpenAlex-sourced public bibliometric data; no ORCID or country field was present in the source record, so identity is name-resolved.
- Only 2 papers reviewed by Evolve so far; output, impact, and activity dimensions are unscored because the underlying aggregates are not in this snapshot.
- The reproducibility score rests on a small base (2 papers, both medium readiness) and may shift materially as catalog coverage grows.
- Both catalog entries are 2026 arXiv preprints; peer-reviewed venue status is not captured in this snapshot.