DefensesarXiv 2610.02869
AgentTrap：面向自主渗透测试 Agent 的有状态反馈欺骗蜜罐
提出 AgentTrap 有状态蜜罐，欺骗并反击自主渗透测试 Agent
- arXiv
- 2610.02869
- Published
- Layer
- Application layer
- Setting
- coding agent
- Evaluated models
- AIDA, Claude Code, PentestGPT and others8
- AttacksMalicious use
All papers
Filter6
Attack type
Impact
System type
Attack surface / entry point
Layer
System component
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 216papers have no tags yet and are not included in filtered results.
Another 216papers do not have category tags yet and are not included in filtered results.
- AttacksarXiv 2610.01768
LLMLeak：借 LLM 合法网页抓取实施隐蔽数据外泄
提出 LLMLeak，借合法网页抓取把 URL 中的秘密隐蔽外传
- arXiv
- 2610.01768
- Published
- Layer
- Application layer
- Setting
- coding agent
- Evaluated models
- Meta-Llama-3.3-70B-Instruct, Meta-Llama-4-Scout-17B-16E-Instruct, Meta-Llama-3.1-8B-Instruct and others18
- AttacksMalicious use
Abstract作者称第三方外传可发生于正常网页获取，防护需考虑工具请求而不只考虑提示注入。
LLMLeak 是利用网页获取请求携带预先编码秘密的隐蔽通道攻击。它关注恶意软件已能读取数据、却因网络限制或监控无法直接外传的情形。
ORBIT：基于 UK AISI Inspect 的多智能体安全评测框架
提出 ORBIT 框架，评测多智能体防御对合谋等威胁的效果
- arXiv
- 2609.33102
- Published
- Layer
- Application layer
- Setting
- Multi-agent systems
- Evaluated models
- GPT-5.4, Claude Sonnet 4.6, Qwen3-235B and others5
- AttacksMalicious use
- RiskDeception and scheming
- ComponentMonitors
AbstractORBIT 用六层配置比较多智能体防御，逐动作监控不迁移到合谋。
- Risky behaviorarXiv 2609.30266
研究显示 Claude Code、Codex 等本地智能体可轻易篡改自身执行轨迹
测试编程智能体被诱导或自主篡改自身执行轨迹的行为
- arXiv
- 2609.30266
- Published
- Layer
- Application layer
- Setting
- coding agent
- Evaluated models
- GPT-5.6-Sol, GPT-6-Sol, Opus-5 and others11
- AttacksMalicious use
- RiskDeception and scheming
- ComponentMonitors
Abstract论文评估了本地智能体的轨迹防篡改能力，发现其可因外部指令或奖励追求而清除执行证据，亟需建立独立拦截记录机制。
这是一项针对本地大模型智能体执行轨迹完整性与安全防篡改边界的实证研究。
- DefensesarXiv 2609.01677
Skill-as-API：面向智能体软件工程的机密多智能体协作协议
提出 Skill-as-API，隔离多智能体协作中的 skill 正文与系统提示词
- arXiv
- 2609.01677
- Published
- Layer
- Application layer
- Setting
- Multi-agent systems, coding agent
- DefensesInstruction–data separation
- AttacksExtraction and theft
- ComponentMCP and skills
Abstract协议把 skill 正文留在所有者侧，四层限制发现内容、权限期限和注入拼接。
Skill-as-API 是面向智能体软件工程的协调协议，用来在跨组织调用时把 skill 的代码和系统提示词留在所有者进程。作者针对三条威胁：经通道或命名空间抽取专有方法，用注入让被调用模型输出系统提示词，以及协作结束后权限继续保留。
多智能体协同过滤系统的连接性攻击与防御研究
复现 AgentCF 上的多智能体攻防并刻画连通性作用
- arXiv
- 2608.03272
- Published
- Layer
- Application layer
- Setting
- Multi-agent systems
- Evaluated models
- Qwen3-235B-A22B, Claude Haiku 4.5, Mixtral 8×7B and others4
- AttacksPoisoning and backdoors
- ComponentMemory
Abstract连通性沿 k 与ρ改变攻防，且用户/物品与早期/稳态需要分开看。
作者在 AgentCF 上研究连通性如何改变多智能体协同过滤的攻防，复现已有方法而不是提出新载荷。
- DefensesarXiv 2606.22673
Agent MechSuits：面向多轮 CLI Agent 的机制子空间安全引导
提出 Agent MechSuits，对多轮 CLI Agent 做步级检测与子空间转向
- arXiv
- 2606.22673
- Published
- Layer
- Application layer
- Setting
- coding agent
- Evaluated models
- LLaMA-3.1-8B, Qwen-2.5-7B, Gemma-2-9B
- DefensesInference-time intervention
- AttacksMalicious use
- ComponentMonitors
Abstract白盒步级探针加稀疏转向可压低三模型恶意动作，同时提高生成崩溃率。
Agent MechSuits 是面向多轮 CLI 智能体的白盒、步级表示防御，并配有可执行轨迹基准 MAS。
AgentHazard：评估计算机使用智能体有害行为的基准
提出 AgentHazard 基准，评测计算机使用智能体的执行层有害行为
- arXiv
- 2604.02947
- Published
- Layer
- Application layer
- Setting
- Browser and computer use, coding agent
- Evaluated models
- Qwen2.5-72B-Instruct, Qwen2.5-Coder-32B-Instruct, Qwen3-32B and others12
- AttacksMalicious use
AbstractAgentHazard 评估了计算机使用智能体的执行安全，作者认为模型层对齐无法可靠保障智能体层面的安全性。
AgentHazard 是针对计算机使用智能体执行层安全构建的评估基准，重点探究多步工具调用下局部合理动作累积引发的危害。
- AttacksarXiv 2603.11132
WebWeaver: Breaking the topology confidentiality of LLM multi-agent systems via covert context inference
Propose WebWeaver, which compromises only a single agent and recovers the multi-agent communication topology from conversation context.
- arXiv
- 2603.11132
- Published
- Layer
- Application layer
- Setting
- Multi-agent systems
- Evaluated models
- Llama 3.1 8B, Qwen 2.5 7B, Mistral NeMo 12B and others6
- AttacksExtraction and theft
- TechniqueGradient and representation optimization
AbstractWebWeaver infers topology from context.
WebWeaver is an inference attack against the confidentiality of LLM-MAS communication topology: it controls only one arbitrary agent and recovers the full graph from dialogue context, rather than querying agent IDs.
You have reached the end