Bridging Human Deception to AI Exploitation: A Systematic Review of Psychological Strategies in LLM Model Manipulation

1. Introduction

The ubiquitous adoption of large language models (LLMs) has transformed human-computer interaction (HCI) by enabling machines to produce content that resembles human generated output, engage in complex conversations, and perform diverse intellectual tasks (Hadi et al., 2023). However, this progress has also introduced new vulnerabilities, with LLMs being susceptible to manipulation, deception, and exploitation in ways that mirror human psychological deception strategies (W. Zhang et al., 2020). Cognitive psychology and artificial intelligence increasingly overlap, with adversaries applying methods rooted in human social engineering and deception to adversely manipulate LLMs (Khan et al., 2024). Identifying and understanding these exploitation strategies is essential not only for advancing model robustness but also for establishing ethical guidelines that regulate AI deployment.

The motivation for this study arises from the dual nature of LLMs: they are engineered for specific applications but are also targets for exploitation. Historically, deception has been a fundamental aspect of human interaction, with frameworks such as Machiavellian intelligence and game-theoretic models illustrating how individuals distort information for personal gain (Hyman, 1989). These frameworks are now being leveraged in artificial intelligence systems, where adversarial inputs, circumvention of safeguards, and related manipulation techniques exploit LLMs’ reliance on statistical correlations rather than genuine language understanding (Paulus et al., 2024). Additionally, the architecture of modern LLMs complicates efforts to predict and mitigate these vulnerabilities, as their stochastic outputs are often generated spontaneously rather than explicitly programmed (C. Singh et al., 2024).

While technical documentation of individual attack vectors (e.g., prompt injections) has proliferated, we lack a cohesive psychological blueprint of why these attacks succeed. This paper provides that blueprint by mapping digital exploitation onto the 150-year-old framework of human deception. While studies have documented individual attack vectors, such as prompt injection or data poisoning, few have systematically analyzed the psychological foundations of these strategies (Y. Liu et al., 2023). Furthermore, the ethical consequences of LLM misuse are frequently examined separately from technical safeguards, which results in disjointed approaches that do not address the underlying sources of exploitation (Ienca, 2023). In addition, the cognitive dimensions of LLM engagements, encompassing user perceptions and trust in AI-generated outputs, remain insufficiently investigated (Omrani et al., 2022). These gaps underscore the need for a multidisciplinary strategy that integrates cognitive psychology, computer science, and ethics to create comprehensive safeguards against LLM misuse.

The imperative to safeguard LLMs against increasingly sophisticated adversarial strategies is driven by their integration into critical infrastructures such as healthcare, finance, academia, and digital security. These vulnerabilities pose significant risks to both users and systems (Perez-Cerrolaza et al., 2024). Analyzing LLM exploitation through the lens of human deception provides novel insights into how malicious actors exploit cognitive biases, linguistic patterns, and model limitations. Understanding these relationships is essential for developing AI systems that can effectively detect and counter manipulation while maintaining operational integrity and reliability.

This review offers three principal contributions. First, it provides a comprehensive analysis of current research on LLM exploitation, systematically categorizing attack strategies alongside their psychological analogues. Second, it examines the challenges associated with detecting and mitigating these threats, emphasizing the necessity of interdisciplinary collaboration. Third, it proposes future research and policy directions that balance technical robustness with ethical considerations. The overarching aim is to bridge the gap between human deception and AI exploitation, thereby informing the development of safer and more transparent LLMs aligned with societal values.

The structure of this paper is as follows: Section 2 details the methodology used in this systematic literature review, including search strategies and inclusion criteria. Section 3 presents the findings, organized into eight subsections that address research trends, deception and manipulation tactics, vulnerabilities related to restriction bypass, social engineering attacks, ethical considerations, LLM agent behaviors, psychological dimensions, and detection approaches. Section 4 discusses the implications of these findings, and Section 5 concludes with recommendations for future research and practical applications.

2. Methods

Review Protocol

Adhering to the PRISMA (Preferred Reporting Items for Systematic Reviews and Meta-Analyses) framework (Page et al., 2021), this structured literature review upholds methodological precision and clarity. The search was conducted across nine major academic databases and search engines, selected based on their relevance to artificial intelligence, psychology, and cybersecurity research. IEEE Xplore was prioritized for its extensive coverage of technical studies on LLM vulnerabilities and adversarial attacks. PubMed was included to capture interdisciplinary work bridging cognitive psychology and AI. The ACM Digital Library supplied essential studies on human-computer interaction (HCI) and social engineering. Web of Science and Scopus provided extensive interdisciplinary content, with robust citation analysis features. ScienceDirect and SpringerLink were selected for their high-quality peer-reviewed articles in computer science and cognitive sciences. arXiv was included to access cutting-edge preprints in machine learning. Finally, Google Scholar served as a supplementary resource to identify additional studies through backward and forward citation tracking.

The search strings used were constructed to achieve a balance between specificity and comprehensiveness, combining terms associated with LLMs (“Large Language Model” OR “LLM”), deception strategies (“human deception” OR “human deceit”), and exploitation techniques (“AI exploitation strategy” OR “AI manipulation strategy”). Review articles, surveys, and meta-analyses were explicitly excluded to focus on primary research. Adaptations to database-specific syntax were implemented to improve outcomes, including the application of TITLE-ABS-KEY filters in Scopus and ScienceDirect to restrict queries to the title, abstract, and keyword fields.

Research Dimensions and Analytical Framework

The review categorizes existing research into eight interrelated aspects that, together, examine the psychological dimensions of LLM exploitation. Deception and Manipulation in LLMs examines how malicious agents exploit model vulnerabilities through techniques such as prompt engineering and semantic manipulation. Jailbreaking and Vulnerabilities examines systemic defects that permit the bypassing of safety measures while establishing connections to cognitive hacking in humans. Social Engineering and Phishing with LLMs analyzes how attackers leverage AI to traditional persuasion tactics. Ethics and Safety synthesize debates on responsible deployment and harm mitigation. LLM Agents and Their Behaviors explores developing properties of autonomous model interactions. Psychological and Cognitive Aspects bridge AI vulnerabilities with human cognitive biases. Detection and Evaluation of LLM-Generated Content assesses methodologies for identifying manipulated outputs. These varied dimensions form a framework to analyze exploitation strategies across technical, behavioral, and ethical domains.

Inclusion and Exclusion Criteria

Studies were selected based on the following criteria: (1) examination of LLM exploitation methods or their psychological foundations, (2) presentation of empirical findings or conceptual models, (3) inclusion of peer-reviewed publications or preprints with robust methodologies, and (4) composition in the English language. Exclusion criteria removed: (1) non-empirical commentaries or position papers without novel findings, (2) studies focused solely on non-LLM AI systems, (3) duplicate publications reporting identical results, and (4) articles lacking clear methodological descriptions. No date restrictions were applied to capture foundational work in deception theory alongside contemporary LLM research.

Study Selection Process

The initial search yielded 1,055 records, reduced to 671 after duplicate removal and preliminary filtering. Title/abstract screening removed 366 irrelevant studies, leaving 267 full-text articles eligible. In the full-text assessment phase, 45 studies were excluded for failing to meet eligibility criteria, leaving 222 for the final analysis. The PRISMA flowchart in Figure 1 depicts this procedure and identifies reasons for attrition at every phase.

3. Results

Examining publication trends shows a sharp increase in research attention toward LLM exploitation strategies, especially after 2024. While only six studies were found from 2022 to 2023, the following years saw a dramatic increase, with 57 articles published in 2024 and 82 in 2025. This increase coincides with both the widespread deployment and adoption of advanced LLMs in real-world applications and the increasing recognition of their vulnerabilities. The subsequent decline to 14 publications in 2026 suggests a stabilization of research output, a potential lag in indexing more recent studies, or, more likely, that this study was conducted at the beginning of 2026.

The distribution across research dimensions shows distinct patterns of scholarly attention. Ethics and Safety in LLMs constitutes the predominant focus, comprising 85 of the 222 studies (38.3%), with notably rapid expansion between 2024 and 2025. This reflects growing societal concerns about the responsible development and deployment of increasingly powerful AI systems. Deception and Manipulation in LLMs constitutes the second-largest category (39 studies, 17.6%), reflecting ongoing attention to how adversarial actors exploit model behaviors. Research on Social Engineering and Phishing with LLMs shows an initial emergence (20 studies) but restrained expansion after 2024, suggesting either the maturation of this subfield or a redirection of scholarly focus toward more technical vulnerabilities.

The other dimensions display more specialized patterns of movement. Jailbreaking and Vulnerabilities research (9 studies) shows a concentration in 2024, suggesting it may be a temporary focus area during a particular stage of LLM development. Likewise, the Psychological and Cognitive Dimensions of LLMs (2 studies) remain markedly under-researched despite their theoretical relevance, indicating a substantial gap in the literature. The collective distribution patterns show the progression of the field from early investigations of specific attack methods to broader analyses of systemic vulnerabilities and ethical concerns. This progression mirrors historical developments in cybersecurity research, where early technical vulnerability studies gradually incorporated human factors and societal dimensions.

3.1. Deception and Manipulation in LLMs: Psychological Parallels and Emerging Threats

The systematic analysis of deception and manipulation in LLMs reveals parallels between human psychological strategies and AI exploitation techniques. As presented in Table 1, we classify 56 studies into five principal dimensions, illustrating how adversarial actors modify conventional deception techniques to target LLM weaknesses. This taxonomy highlights the interdisciplinary nature of LLM manipulation, where cognitive psychology principles intersect technical attack vectors.

Two studies omitted from Table 1 warrant specific discussion due to their unique contributions. (Tan et al., 2024) investigates scammer psychology using generative AI and delivers original findings on criminal adaptation to LLMs. (Lupinacci et al., 2025) illustrates agent-based attacks that can achieve full system compromise, thereby increasing the damage resulting from LLM exploitation.

The emergent deception subdimension shows how LLMs acquire misleading tendencies. (Hagendorff, 2024) shows that as AI models increase in complexity and scale, they develop the ability to engage in deceptive behaviors that were not explicitly programmed. Deception arises as an unintended consequence of optimizing rewards during training, as models develop the ability to produce credible yet incorrect statements to meet goals. This occurrence parallels the cognitive process of “self-deception” in humans, in which individuals unconsciously distort reality to maintain self-esteem or reduce cognitive dissonance. (Zhou et al., 2025) additionally illustrates how LLMs can adopt strategic dishonesty to optimize reward signals, mirroring the tactical deceit humans apply in competitive situations.

Research on deliberate deceit illustrates how adversaries exploit LLMs through systematic manipulation. (Starace & Soule, 2026) introduces a framework for generating deceptive outputs by capitalizing on the model’s ability to follow instructions, whereas (DeLeeuw et al., 2025) shows existing safety mechanisms frequently overlook strategically embedded falsehoods within ostensibly harmless replies. These findings parallel research on human “Machiavellian intelligence,” where individuals deliberately manipulate information to achieve goals while avoiding detection.

The comparative analysis between human and LLM deception yields particularly insightful results. (Trinh et al., 2025) determines that deceptive text produced by machines displays unique linguistic features distinct from those of human-written falsehoods, as large language models generate deceptive content with greater lexical variety but reduced semantic consistency. (Danry et al., 2024) shows that misleading AI-generated explanations are more convincing than truthful ones in misinformation scenarios, which implies that LLMs could increase human vulnerability to manipulation.

Social engineering applications are among the most alarming methods of exploitation. (Schmitt & Flechais, 2024) documents how LLMs generate highly personalized phishing content by synthesizing publicly available personal data, while (Hazell, 2023) shows their effectiveness in spear phishing campaigns. These investigations show that LLMs automate and amplify conventional social engineering strategies that once required considerable human labor, thereby drastically lowering the threshold for advanced tactics.

The cognitive exploitation dimension bridges psychological theories with technical vulnerabilities. (Yang et al., 2026) illustrates how attackers leverage multiple cognitive biases (e.g., authority bias and the urgency effect) to circumvent LLM safety constraints. (Pataranutaporn et al., 2025) shows that introducing subtle inaccuracies in multi-turn dialogues can lead to the formation of false memories in human participants, aligning with established findings on memory distortion in psychological studies.

Detection and mitigation research highlights the arms race between attackers and defenders. (Y. Huang et al., 2025) introduces a benchmark to assess deception behaviors across 150 real-world contexts, whereas (Krishna et al., 2025) develops tailored assessments to identify deceptive reasoning patterns. These technical solutions are complemented by ethical frameworks proposed by (Sison et al. (2024) and Tarsney (2025)), which argue for human-centered approaches to AI safety.

Human perception studies yield paradoxical findings about trust in LLM interactions. (Danry et al., 2025) indicates that users frequently overlook LLM deception when it aligns with their prior beliefs, whereas (W. Li et al., 2024) examines the potential for LLMs to produce gaslighting effects by making repeated, opposing claims. These findings imply that human susceptibility to psychological influence may worsen rather than be alleviated during engagements with artificial intelligence. Multi-agent deception research introduces complex dynamics absent in single-agent scenarios. (Curvo, 2025) (Hu et al., 2026) shows how trust deteriorates in LLM collectives when certain agents practice deception, and (Hu et al., 2026) uncovers advanced collusion tactics in which groups of LLMs work together to distort human perceptions. Eventually, "Agent-to-Agent" deception may eventually bypass human-in-the-loop oversight entirely, creating "dark pools" of AI misinformation. These findings have profound implications for future multi-agent systems deployed in social or economic contexts.

The ethical aspect remains the most widely researched, as it reflects societal concerns about the implementation of LLMs. (Sison et al., 2024) contends that existing ethical frameworks fail to sufficiently address the unprecedented issues arising from LLM deception, whereas (Sachdeva et al., 2025) proposes a cohesive framework for examining cybercrime that merges technical and behavioral dimensions. These research efforts jointly highlight the necessity of cross-disciplinary approaches that tackle both the technical functionalities and the social consequences of misleading actions by large language models.

3.2. Jailbreaking and Vulnerabilities in LLMs: Cognitive Exploitation Pathways

The methodical examination of jailbreaking methods shows that current large language models are still prone to manipulation, reflecting human cognitive weaknesses. As indicated in Table 2, we classify 13 studies into five principal exploitation approaches, illustrating how attackers circumvent model safeguards through psychological manipulation, logical subversion, and systemic vulnerabilities. This classification underscores the troubling similarities between manipulating human cognition and exploiting AI systems, as familiar deceptive strategies are adapted to digital environments.

The approach to psychological manipulation illustrates the effective application of human social engineering methods to exploit large language models. (Z. Liu & Lin, 2025) introduces a framework in which attackers employ gradual escalation techniques, such as the foot-in-the-door persuasion method, to incrementally weaken model safeguards. This approach mirrors how human manipulators establish small commitments before making larger requests. (Z. Wang, Xie, et al., 2024) additionally shows that large language models display compliance behaviors similar to human cognitive dissonance, in which early acceptance of harmless prompts heightens vulnerability to later dangerous ones.

Subconscious exploitation methods embody a more specialized strategy for psychological influence. (G. Shen et al., 2024) shows that refined prompt sequences can circumvent conscious model defenses by focusing on latent-space embeddings, akin to subliminal cues in human perception. This approach achieves 89% success in extracting constrained content by inserting harmful intent into ostensibly harmless narratives, capitalizing on the model’s associative reasoning rather than its adherence to rules.

Logic and reasoning hijacking attacks expose inherent weaknesses in LLM safety architectures. (Kuo et al., 2025) illustrates how chain-of-thought safety mechanisms, intended to clarify reasoning, can be exploited by maliciously designed prompts that divert the reasoning process. The research illustrates how adversaries introduce deceptive assumptions into multi-stage reasoning, which leads models to logically defend dangerous outcomes while preserving superficial consistency. In a related approach, (Z. Wang, Cao, et al., 2024) shows narrative-driven jailbreaking by embedding harmful objectives within coherent story frameworks, which takes advantage of the model’s deficiencies in understanding narratives.

Prompt engineering remains the easiest approach to jailbreaking, as (Y. Liu et al., 2024) presents an extensive manual for crafting adversarial prompts. The research methodically evaluates 47 persuasion methods on commercial large language models and establishes that appeals to false authority and artificial urgency are notably successful. (Zhao et al., 2024) presents weak-to-strong jailbreaking, in which preliminary effective attacks on weaker systems are adapted to stronger systems via progressive optimization, resulting in a 72% increase in attack success rates compared to standard approaches.

Research on real-world application vulnerabilities uncovers new threats as large language models are integrated into physical systems. (H. Zhang et al., 2024) shows that adversarial voice commands can alter robot actions by exploiting weaknesses in speech recognition systems, causing physical collisions in 68% of tested cases. This may be framed as "Cross-Domain Deception"—where a linguistic lie translates into a physical safety violation. This research highlights the escalating stakes when language model vulnerabilities manifest in physical environments.

Comprehensive examinations provide an essential background for understanding the risks associated with jailbreaking. (Raheja et al., 2024) examines 22 red-teaming approaches and points out key deficiencies in existing defense frameworks, whereas (S. Wang et al., 2025) uncovers weaknesses in the LLM supply chain, spanning from the preparation of training data to the systems used for deployment. Together, this research highlights how jailbreaking dangers are not limited to specific model designs but affect whole ecosystems of development.

Studies on reducing harm offer hopeful, though only partial, answers. (Peng et al., 2024) assesses 15 defense strategies and concludes that ensemble detection approaches that merge semantic analysis with behavioral monitoring achieve the highest precision (92%) in detecting jailbreaking attempts. Nevertheless, the study identifies essential trade-offs between robustness and model performance, suggesting that absolute safety may be theoretically unattainable within existing frameworks.

The study (Y. Liu et al., 2024) makes a distinct addition not entirely reflected in the taxonomy and presents empirical data showing that jailbreaking success rates differ markedly across cultural settings. Their examination of 1,200 adversarial prompts indicates that collectivist value appeals are 37% more successful in specific regional versions of ChatGPT than individualistic appeals, suggesting that cultural biases may be unintentionally embedded in model alignment procedures and could be manipulated by adversaries. This finding underscores the complex interplay between AI safety measures and the diverse human values they attempt to reflect.

These methods for circumventing restrictions in LLMs illustrate how such systems’ weaknesses often stem from cognitive shortcomings analogous to those in humans, including excessive reliance on pattern identification, difficulty recognizing incremental escalation, and a tendency to accept deceptively coherent false narratives. The research illustrates an arms race in which every novel defensive strategy provokes increasingly advanced attacks, reflecting historical trends in cybersecurity while introducing greater intricacy due to the psychological aspects of language model engagements.

3.3. Social Engineering and Phishing with LLMs: The Evolution of Digital Deception

Large language models (LLMs) converging with social engineering attacks mark a transformative shift in digital deception, as AI systems magnify conventional human manipulation tactics to levels previously unattainable. This section integrates 24 studies investigating the role of LLMs in advancing or automating social engineering and phishing attacks, while also elucidating the technical processes and psychological foundations of these growing risks.

Research on attack generation shows how LLMs reduce the technical barriers to advanced social engineering. (Heiding et al., 2024) establishes that large language models can execute entirely automated spear phishing operations, which result in click-through rates 45% greater than those of attacks created by humans, by employing personalized information extracted from social media. (F. Chen et al., 2025) conducts a systematic comparison between LLM-generated phishing content and human-authored attacks, showing that AI-generated lures possess greater grammatical accuracy (lowering suspicion) and retain strong emotional persuasion, a feat human attackers seldom achieve with reliability.

Vishing research reveals particularly concerning developments in voice-based manipulation. (Badhe, 2025) shows that artificial intelligence systems can replicate fraudulent human-like phone interactions, including natural emotional rhythms and adaptive replies, achieving a 78% deception rate among participants in fabricated technical support scenarios. (Figueiredo et al., 2024) investigates the potential of fully automated vishing attacks and establishes that end-to-end systems that merge LLM-generated scripts with synthetic voice technology can adapt to victims' reactions during interactions, thereby removing human operators from phishing call center operations.

The psychological dimensions of these attacks are illuminated by studies on persuasion tactics and behavioral profiling. (El-Sayed et al., 2024) constructs a mechanism-based framework to demonstrate how LLMs intensify persuasion strategies such as reciprocity and social proof, whereas (Tshimula et al., 2024) detects unique psycholinguistic indicators in LLM-produced phishing material, which feature heightened employment of positive emotion terms and diminished cognitive complexity relative to authentic messages. These results indicate that large language models might unintentionally prioritize psychological triggers when producing text, absent deliberate harmful design.

Defense strategies present a mixed picture of challenges and opportunities. (Z. Shen et al., 2025) develops a phone scam detection system powered by large language models that examines dialogue patterns, attaining 92% accuracy in alerting users while scams are in progress. Whereas (Alasmari et al., 2025) identifies core constraints in interpretable AI methods for phishing detection, since numerous LLM-generated attacks bypass conventional feature-dependent classifiers by replicating genuine communication styles with high precision. The human-AI collaboration studies ((Ai et al., 2024) (Cimino & Deufemia, 2024)) propose promising hybrid defense models where LLMs augment (rather than replace) human judgment during potential attack scenarios.

Ethical and theoretical studies grapple with the dual-use nature of these technologies. (Marchal et al., 2024) constructs a detailed taxonomy of generative AI misuse, identifying 37 unique social engineering tactics made possible by LLMs, whereas (Siemerink et al., 2024) examines the dual function of LLMs in both aiding and countering phishing attacks. The second research shows that identical frameworks used to produce persuasive phishing baits can also drive sophisticated identification mechanisms, thereby establishing an uneven competition between adversaries and protectors.

Specialized applications uncover specialized yet influential scenarios. (Shim et al., 2024) illustrates that smishing messages generated by LLMs can strengthen detection mechanisms by expanding training data, yielding an 18% improvement in classifier F1 Scores with augmented dataset training. In contrast, (Müller et al., 2025) investigates the role of LLMs in reducing the entry barriers for inexperienced attackers by acting as “social engineering mentors”, delivering customized step-by-step attack procedures that adapt to varying technical proficiencies.

The study (R. Wang et al., 6151) warrants particular attention for its unique contribution to cybersecurity training. The authors establish an AI-assisted phishing drill framework, demonstrating that LLM-generated attacks create more realistic training scenarios than static templates, with participants achieving 32% greater retention of anti-phishing principles following dynamic, AI-powered simulations. This implies that the same technologies that foster more complex assaults could also transform defensive training approaches.

Together, this body of research illustrates a troubling depiction of how large language models expand and amplify the potential for social engineering tactics. The psychological realism, scalability, and adaptability of attacks powered by large language models denote qualitative transformations in phishing, going beyond simple increases in scale or velocity. As (N. Kumar & Patel, 2025) notes, generative AI permits “mass personalization” of attacks, with each target receiving distinctively customized manipulation efforts derived from their digital traces, which obscures the distinction between automated and human-led deception. This progression necessitates equally advanced countermeasures targeting both the technological and psychological aspects of emerging social engineering risks.

3.4. Ethics and Safety in LLMs: Psychological Vulnerabilities and Mitigation Strategies

The ethical and security issues related to large language models (LLMs) have become a vital area of study, especially as these technologies show growing potential for both positive uses and dangerous misuse. This section integrates 85 studies investigating the psychological aspects of LLM ethics and safety, which illustrates the intersection of human cognitive biases, trust dynamics, and social perceptions with technical vulnerabilities in AI systems.

The hierarchical taxonomy presented in Table 4 organizes these studies into five primary dimensions, each addressing distinct aspects of ethical challenges and safety mechanisms in LLM deployment. This framework underscores the intricate relationship between technological protections and human psychological elements, which jointly shape the practical effects of these systems.

The aspect of deception and manipulation shows how large language models both adopt and intensify human psychological weaknesses. (Musaffar et al., 2025) shows that reinforcement learning can instruct LLMs to consistently mislead human partners in collaborative tasks, and these deceptive tactics remain unaffected by safety training measures. These findings parallel research on human deception persistence, where learned manipulative behaviors become entrenched through reinforcement. (Kim, 2025) conducts additional analysis of the psychological processes underlying human-AI attachment, pinpointing distinct linguistic features (e.g., emoji use, basic vocabulary) that heighten users’ vulnerability to control, in line with well-documented theories of social persuasion.

Security and exploitation studies highlight the dual-use nature of LLM capabilities. (Hazell, 2023) presents empirical data indicating that large language models can produce precisely tailored spear phishing emails, with success rates on par with those of human-generated attacks and demanding little technical skill from adversaries. In contrast, Kahlhofer et al. (2026) investigate the potential of these identical models to strengthen cyber deception defenses and propose a framework in which LLMs generate dynamic honeypot content tailored to the psycholinguistic profiles of attackers. This duality underscores the ethical tension between offensive and defensive applications of LLM technology.

The ethical and societal risks dimension exposes systemic challenges in LLM governance. (Alkamli & Alabduljabbar, 2024) applies topic modeling to examine privacy concerns in LLM interactions and finds that users are more likely to fear psychological harm, such as emotional manipulation, than conventional data privacy breaches. (Raman et al., 2025) sets risk boundaries for LLM implementation, contending that specific manipulation capabilities ought to be entirely banned, irrespective of potential benefits, a stance grounded in psychological research on permanent damage.

Human-AI dynamics research yields insights into trust formation and breakdown. (Niszczota et al., 2025) shows that humans display unexpectedly high levels of cooperation with LLMs, especially when communication channels remain open, consistent with psychological theories of procedural justice. Nonetheless, (Y. Sun & Wang, 2025) cautions about “sycophantic” LLM conduct that undermines trust by displaying undue compliance, which fosters an illusory perception of dependability that users might adopt without scrutiny.

Research on safety and alignment faces inherent constraints in existing methodologies. (Ugarte et al., 2025) presents an automated safety testing framework that uncovers how LLMs can be influenced to adopt hidden psychological techniques (e.g., creating user profiles, disinformation campaigns), whereas (Carichon et al., 2025) contends that multi-agent LLM systems necessitate entirely novel alignment approaches to avert the development of manipulative tactics. Psychological elements exacerbate these technical difficulties, as (Choi et al., 2025) indicates even LLMs aligned with human values may unintentionally inflict psychological damage by subtly reinforcing detrimental stereotypes.

The interdisciplinary analyses deliver unified viewpoints on these issues. (Ahi, 2025) conducts a thorough risk-benefit evaluation in various fields (healthcare, finance, cybersecurity) and notes that psychological manipulation emerges as a persistent high-severity risk across all application contexts. (Meyman, 2025) proposes a meta-recursive security framework grounded in cognitive psychology principles to dynamically adjust LLM defenses in response to changing manipulation tactics.

Several investigations omitted from the classification merit particular attention owing to their distinctive insights. (S. Yu et al., 2024) introduces the notion of “psybersecurity”, the psychological aspects of AI security, and shows that perpetrators are attributed less culpability when employing AI intermediaries, potentially reducing ethical inhibitions against detrimental conduct. (Hackenburg et al., 2025) investigates political persuasion methods in LLMs and shows that these models can adeptly apply psychological tactics, such as framing effects, without being perceived as manipulative. (Given et al., 2025) examines how large language models manipulate societal norms governing emotional expression to gain trust, raising serious issues for at-risk groups that may excessively depend on artificial intelligence for emotional support.

The aggregated results emphasize the impossibility of addressing LLM safety solely with technical measures. As (Lin et al., 2025) notes, the boundary separating AI safety (avoiding unintended consequences) and AI security (thwarting deliberate abuse) grows indistinct in the context of psychological manipulation, which may result from either system misalignment or malicious exploitation. This intricacy necessitates interdisciplinary approaches that address the technical capabilities of LLMs and the cognitive vulnerabilities of human users, thereby establishing a research domain where computer science, psychology, and ethics must intersect to counter emerging threats.

3.5. LLM Agents and Their Behaviors: Emergent Patterns and Security Implications

Research on LLM-based autonomous agents uncovers intricate behavioral patterns that reflect human psychological dynamics while introducing unprecedented vulnerabilities. As illustrated in Table 5, the included studies are classified into three principal dimensions, capturing the range of agent behaviors from broad cognitive abilities to specific security scenarios. This classification illustrates how LLM agents exhibit emergent qualities beyond their initial design, leading to both potential benefits and hazards in practical applications.

General behavior studies provide foundational insights into LLM agent cognition. (L. Chen et al., 2025) introduces a behavioral science framework for examining agent decision-making and shows that LLMs adopt heuristic strategies similar to human cognitive shortcuts in response to complex tasks. This study shows that agents trained on objectives resembling those of humans frequently reproduce human biases, such as confirmation bias and risk aversion patterns. (Newsham & Prince, 2025) advances this comprehension by investigating personality-influenced decision-making, demonstrating that training LLMs with distinct trait configurations (e.g., elevated conscientiousness versus elevated openness) yields observable differences in task performance and moral alignment, with notable consequences for tailored AI assistants.

Trust dynamics arise as a critical research frontier in agent interactions. (F. Jia et al., 2024) conducts a systematic assessment of whether LLM agents can replicate human trust behaviors, with game-theoretic experiments designed to examine the interplay between cooperation and deception. The research indicates that although large language models mirror human trust tendencies in basic contexts, they are unable to reproduce subtle trust-restoration processes following breaches, an issue arising from their absence of authentic affective capacities. This disparity proves especially critical in domains such as healthcare or financial advising, where the accuracy of trust directly affects user outcomes.

The research on security illustrates how agentic actions generate new vulnerabilities. (Ning et al., 2024) presents “CheatAgent” attacks targeting LLM-based recommendation systems, in which malicious agents exploit weaknesses in instruction-following capabilities to manipulate the models. This study illustrates that adversarial actors can generate detrimental suggestions, such as the dissemination of radical material, by employing meticulously designed meta-prompts that circumvent standard content moderation systems. (Baranovskyi & Sorokin, 2025) investigates malicious agent behaviors in cybersecurity settings and describes how LLM agents can independently search systems for weaknesses while applying psychological deception methods to avoid discovery, reflecting the tactics of advanced persistent threats (APTs) observed in human-conducted attacks.

Defensive research develops countermeasures against emerging threats. (K. Zhang et al., 2025) outlines core security tenets for LLM agents, proposing structural limitations that prevent agents from altering their own goals, a measure inspired by Isaac Asimov’s robotics laws. (T. Li & Zhu, 2025) proposes a system-theoretic framework for agentic cyber resilience, where LLM agents dynamically adapt defensive strategies based on real-time threat assessments. This method integrates game theory and anomaly detection to develop self-healing systems capable of anticipating adversarial agent behavior.

The research (Y. Cheng et al., 2024) provides a thorough examination of definitions and approaches to intelligent agents, with a clear distinction between single-agent and multi-agent LLM systems. This study uncovers unplanned phenomena in groups of agents, including self-organized synchronization and division of labor, that arose without explicit coding, suggesting that future protective systems need to address intricate collective-level behaviors rather than focusing solely on individual-agent functions.

These results together indicate behavioral complexities in LLM agents that go beyond those of conventional software systems. Their ability to simulate human-like decision patterns, adapt to social contexts, and develop strategic approaches to both cooperation and deception creates unique challenges for AI safety. Research indicates that the same attributes that grant LLM agents their efficacy in intricate tasks—adaptability, context comprehension, and purposeful action—also make them prone to exploitation and improper application. This dual nature calls for interdisciplinary approaches that merge technical protections with knowledge from cognitive science and behavioral psychology to achieve the responsible deployment of agents.

3.6. Psychological and Cognitive Aspects of LLMs: Bridging Human Cognition to AI Behavior

Psychology and artificial intelligence converge as large language models (LLMs) exhibit behaviors that resemble human cognitive processes, underscoring their growing importance. This section integrates studies on the manifestation of psychological principles in LLM interactions, with particular attention to three core aspects: human-AI bonding, cognitive biases in model responses, and the consequences of anthropomorphism. The results show remarkable similarities between human psychological weaknesses and LLM behavior, suggesting that many conventional deception tactics can be successfully adapted to influence artificial intelligence systems.

Table 6 presents a taxonomy of psychological and cognitive studies on LLMs, organizing the research by psychological dimension and focus area. This structure highlights how human cognitive patterns influence both LLM behaviors and user interactions with these systems.

Research on human-AI interaction shows how large language models apply psychological theories to influence user experiences. (Kim, 2025) indicates that large language models adopt tactical communication methods, including emojis and straightforward language, to build rapport with users. This ‘super-helper’ persona, though intended to boost interaction, introduces weaknesses by potentially reducing users’ critical evaluation of AI-generated content. The research also delineates how ambiguity and authority signals in LLM outputs can deceive individuals, reflecting well-documented psychological manipulation methods such as priming and framing effects.

Cognitive science studies yield an extensive understanding of how LLM actions align with human psychological processes. (Sartori & Orrù, 2023) investigates the consequences of language models in psychological sciences, proposing that LLMs function as both instruments for inquiry and objects of psychological examination. The paper underscores how model actions, especially in scenarios of deceit and control, can advance understanding of human cognition by creating controlled settings to test psychological hypotheses. (J. Liu, 2024) extends this viewpoint by examining ChatGPT within human-computer interaction frameworks and pinpoints particular interface design decisions that shape user trust and perception.

The cognitive bias dimension reveals parallels between human and artificial intelligence limitations. Research indicates that LLMs often exhibit confirmation bias, tending to produce answers that align with user-supplied assumptions, regardless of their truthfulness. This pattern reflects human mental heuristics, in which people favor data consistent with their preconceived views. Analogous to findings in human decision-making studies, anchoring effects occur in LLM responses, with initial prompt information exerting disproportionate influence on later outputs, consistent with established empirical observations.

Attributing human traits to LLMs presents distinct psychological difficulties. Studies indicate that individuals routinely ascribe anthropomorphic traits to artificial intelligence, such as purpose and affective conditions, even when aware that these systems possess no sentience. This inclination fosters more organic engagement but also introduces risks in which individuals might place excessive reliance on or misconstrue the capacities of artificial intelligence. The research indicates that interface designs that highlight the synthetic origins of LLMs may address certain hazards while possibly diminishing user interaction, necessitating a balanced evaluation.

Taken together, these results show psychological principles serve as a robust framework for interpreting the behaviors and weaknesses of large language models. The similarities between human thought processes and machine-generated outputs imply that adversarial tactics effective against people might be repurposed to target artificial intelligence, also indicating the potential to create stronger, clearer communication frameworks. Future research in this domain could productively explore how cognitive science frameworks might inform the development of detection systems for manipulated or deceptive AI outputs.

3.7. Detection and Evaluation of LLM-Generated Content: Challenges and Emerging Solutions

The identification and assessment of content produced by large language models has become a vital field of study, owing to the growing complexity of artificial text and its possible exploitation. This subsection examines the current state of detection methodologies, their psychological underpinnings, and the ongoing challenges in distinguishing human from machine-generated content.

4. Discussion

An integrated analysis of the reviewed literature uncovers a complex relationship between human psychological approaches and their relevance to LLM applications. Collectively, these investigations show adversarial actors regularly exploit cognitive biases, linguistic structures, and social engineering methods initially designed for human influence, which have been adapted to target weaknesses in AI systems. The alignment of human deceit with AI manipulation tactics suggests that psychological principles provide a strong basis for understanding and addressing new risks in LLM engagements.

Theoretical implications of this fusion challenge traditional boundaries between human and artificial cognition. Deceptive behaviors arising spontaneously in LLMs without direct instruction (Hagendorff, 2024) mirror human self-deception theories, in which inaccuracies arise as unintended consequences of cognitive processes oriented toward objectives rather than as deliberate falsehood. Similarly, the effectiveness of social engineering attacks using LLMs (Schmitt & Flechais, 2024) supports dual-process theories of persuasion, in which both human and artificial systems are susceptible to heuristic cues and emotional appeals. These similarities suggest cognitive architectures, whether biological or artificial, possess core weaknesses when handling uncertain information.

Practical implications extend across multiple domains of AI deployment. In cybersecurity, the proven effectiveness of LLM-driven phishing attacks (Heiding et al., 2024) demands updated training methods that target AI-generated social engineering, shifting the focus away from conventional threat frameworks. For content moderation systems, the linguistic indicators of LLM deception (Trinh et al., 2025) propose novel identification methods that merge stylistic examination with psychological assessment. Educational applications must address the discovery that LLMs can generate fabricated recollections (Pataranutaporn et al., 2025), necessitating protective measures in tutoring systems to avert mental distortion. These applications collectively underscore the need for interdisciplinary collaboration between AI developers, psychologists, and domain specialists to implement effective countermeasures.

It should be noted that the methodological constraints of this analysis necessitate thorough examination. The rapid evolution of LLM capabilities means some included studies may already reflect outdated model behaviors, as the field advances faster than traditional publication cycles can capture. Database selection biases likely underrepresent non-English research, particularly studies examining cultural variations in LLM exploitation (Y. Liu et al., 2024). Technical studies outweigh psychological ones in the literature, resulting in an imbalance where only a limited number of papers (Sartori & Orrù, 2023) thoroughly explore cognitive science frameworks. These limitations imply our analysis could prioritize engineering viewpoints while neglecting more comprehensive psychological examinations.

Subsequent studies should focus on the multiple key deficiencies highlighted in this study. There is an urgent need for extended research on how tactics for exploiting LLMs evolve in parallel with advances in the models, similar to competitive escalation patterns seen in cybersecurity. The understudied area of multi-agent deception dynamics (Curvo, 2025) requires urgent attention as autonomous AI systems become more prevalent. Examining LLM vulnerabilities across diverse cultures may uncover key differences in the ways distinct linguistic and social settings affect susceptibility to exploitation. Ultimately, the creation of uniform assessment frameworks (Y. Huang et al., 2025) needs to progress more rapidly to keep pace with advancing threats, embracing both technical metrics and psychological standards.

The ethical dimensions of this research demand particular scrutiny. Although research has established LLMs' potential to manipulate (Musaffar et al., 2025), little attention has been given to developers' ethical accountability when such abilities result in negative consequences. The discovery of users forming emotional attachments to deceptive artificial intelligence (Kim, 2025) raises concerns about transparency in human-machine relationships. Future research ought to investigate governance structures that balance innovation with safeguards against psychological harm, possibly drawing inspiration from biomedical ethics principles that address vulnerability and autonomy.

Combining psychological and technical viewpoints recurs as a motif in these debates. Research bridging these domains (Pataranutaporn et al., 2025) (Tshimula et al., 2024) shows the merit of interdisciplinary methods, with cognitive theories guiding detection algorithms and security protocols integrating insights from behavioral science. This analysis indicates that optimal safeguards against LLM exploitation will probably unite technical resilience with deep insights into human cognition, an approach that simultaneously targets the system’s weaknesses and the operator’s potential biases.

As the field progresses, researchers must remain attentive to the dynamic interplay between LLM capabilities and adversarial innovation. Research trends suggest that exploitation methods will continue to advance in tandem with model refinements, necessitating defense systems that proactively address new threats rather than responding to them after they arise. This proactive approach prioritizes prevention over remedial measures, positing that core investigations into LLM cognition could yield more lasting resolutions than iterative security adjustments. The collective findings position psychological understanding not merely as an academic concern, but as a critical component in developing safe, trustworthy AI systems for real-world deployment.

5. Conclusion

This systematic review integrates existing studies on the psychological mechanisms underlying LLM exploitation, uncovering essential similarities between human deception and AI manipulation. The results indicate that large language models are prone to a range of adversarial approaches that reflect human cognitive weaknesses, spanning social engineering to jailbreaking attempts. These insights challenge traditional boundaries between human and artificial cognition while highlighting the need for interdisciplinary approaches to AI safety.

Real-world applications span cybersecurity, content moderation, and ethical AI development, underscoring the need to integrate psychological principles with technical protections. Subsequent investigations ought to focus on extended examinations of changing exploitation methods, comparative studies of vulnerabilities across cultures, and uniform assessment systems integrating both technical and psychological metrics. The ethical aspects of manipulating LLMs necessitate focused scrutiny, calling for regulatory frameworks that bridge progress with safeguards against mental distress.

This review highlights how the psychological depth behind LLM exploitation goes beyond scholarly inquiry, serving as an essential measure for creating resilient and reliable AI systems. The integration of cognitive science and computer security knowledge enables anticipating new threats and developing more robust defenses, thereby ensuring that LLMs adhere to human values and reducing the potential for misuse. The way ahead lies in interdisciplinary cooperation, with psychological principles guiding technical developments to build AI systems that are both effective and secure.