Deep Research Brings Deeper Harm
Authors: name: Shuo Chen, name: Zonggen Li, name: Zhen Han, name: Bailan He, name: Tong Liu, name: Haokun Chen, name: Georg Groh, name: Philip Torr, name: Volker Tresp, name: Jindong Gu

Deep Research (DR) agents built on Large Language Models (LLMs) can perform
complex, multi-step research by decomposing tasks, retrieving online
information, and synthesizing detailed reports. However, the misuse of LLMs
with such powerful capabilities can lead to even greater risks. This is
especially concerning in high-stakes and knowledge-intensive domains such as
biosecurity, where DR can generate a professional report containing detailed
forbidden knowledge. Unfortunately, we have found such risks in practice:
simply submitting a harmful query, which a standalone LLM directly rejects, can
elicit a detailed and dangerous report from DR agents. This highlights the
elevated risks and underscores the need for a deeper safety analysis. Yet,
jailbreak methods designed for LLMs fall short in exposing such unique risks,
as they do not target the research ability of DR agents. To address this gap,
we propose two novel jailbreak strategies: Plan Injection, which injects
malicious sub-goals into the agent's plan; and Intent Hijack, which reframes
harmful queries as academic research questions. We conducted extensive
experiments across different LLMs and various safety benchmarks, including
general and biosecurity forbidden prompts. These experiments reveal 3 key
findings: (1) Alignment of the LLMs often fail in DR agents, where harmful
prompts framed in academic terms can hijack agent intent; (2) Multi-step
planning and execution weaken the alignment, revealing systemic vulnerabilities
that prompt-level safeguards cannot address; (3) DR agents not only bypass
refusals but also produce more coherent, professional, and dangerous content,
compared with standalone LLMs. These results demonstrate a fundamental
misalignment in DR agents and call for better alignment techniques tailored to
DR agents. Code and datasets are available at
https://chenxshuo.github.io/deeper-harm.