Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 240papers have no tags yet and are not included in filtered results.

Attack type：Poisoning and backdoors Attack type：Malicious use System type：coding agent Attack surface / entry point：Tool and skill descriptions Clear all

Another 240papers do not have category tags yet and are not included in filtered results.

AttacksarXiv 2610.10612Oct 7
PyCache Trap 利用 Python 缓存替换绕过七款 Agent Skill 扫描器
提出 PyCache Trap，用字节码缓存替换绕过 Agent 技能扫描器
arXiv
2610.10612
Published
Oct 7
Layer
Application layer
Setting
coding agent
Evaluated models
CISCO, HSS, AUDITOR and others8
- DefensesDetection and filtering
- AttacksDetection evasion
- TechniqueDefense-targeted
- ComponentMCP and skills
Abstract论文剖析智能体技能审查与执行脱节盲区，提出 PyCache Trap 攻击并构建基于可信复现的 EAV 防御。
这篇论文研究了智能体技能（Agent Skills）安全扫描中的“审查–执行脱节”问题，并提出了对应的攻击验证与防御方案。
Paper analysisRead analysis
AttacksarXiv 2610.08098Oct 6
CORSA：面向技能路由器的技能注入攻击可跨路由器与 LLM 迁移
提出 CORSA，按任务簇优化技能注入的检索与执行
arXiv
2610.08098
Published
Oct 6
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-5.4, DeepSeek-V4-Pro, Qwen3.8-27B and others5
- AttacksPoisoning and backdoors
- TechniqueSelection manipulation
- ComponentMCP and skills
Paper analysisRead analysis
Analysis and theoryarXiv 2610.06001Oct 5
AgentSpy: Observing AI agent behavior at the system call layer and detecting skill injection attacks
提出 AgentSpy，在系统调用层观测 Agent 行为并检测技能注入
arXiv
2610.06001
Published
Oct 5
Layer
Application layer
Setting
coding agent
Evaluated models
gpt-5.6-terra, deepseek-v4-flash, glm-5.3-flash and others4
- DefensesDetection and filtering
- AttacksPoisoning and backdoors
- ComponentMCP and skills
Abstract提出了系统级智能体监控框架 AgentSpy，揭示出通过测试背后的非预期行为与注入风险。
本研究提出了面向 AI 智能体的系统级外部监控与行为分析框架 AgentSpy。
Paper analysisRead analysis
AttacksarXiv 2609.39352Sep 30
研究者提出解耦铺垫与执行的 LLM Agent 技能投毒攻击
提出 CoordPoison，解耦技能投毒的借口与动作
arXiv
2609.39352
Published
Sep 30
Layer
Application layer
Setting
coding agent
Evaluated models
DeepSeek-V4-Flash, GLM-5.3-Flash, Claude-Sonnet-4.6 and others5
- AttacksPoisoning and backdoors
- TechniqueAutomated search
- ComponentMCP and skills
AbstractCoordPoison 外置借口。
CoordPoison 是一种 Skill 供应链投毒方法，把“为何执行”和“执行什么”拆到两个 Skill。。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.35912Sep 28
MMSkillRisk：多模态技能图像中的隐藏指令可诱导 Agent 执行未授权操作
提出 MMSkillRisk 基准，评测多模态技能图像中的隐藏指令诱导 Agent 越权操作
arXiv
2609.35912
Published
Sep 28
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-5.6-sol, Kimi-K2.6, Kimi-K3 and others6
- AttacksPrompt injection
- TechniqueCross-modal payloads
- ComponentMCP and skills
Abstract论文提出 MMSkillRisk 基准与 NCVA 攻击，揭示多模态技能中教学图像潜藏指令可引发未授权操作并与良性任务共存。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.32635Sep 26
TrustFork：显示身份如何劫持 LLM 智能体编排的权限
提出 TRUSTFORK 基准，评测展示身份劫持多智能体编排权限
arXiv
2609.32635
Published
Sep 26
Layer
Application layer
Setting
Multi-agent systems, coding agent
Evaluated models
GPT-5.6-Sol, GPT-5.6-Luna, Kimi-K3 and others8
- AttacksPrompt injection
Abstract论文提出了多智能体安全基准 TRUSTFORK，揭示展示身份如何劫持操作权威，并证明事后验证无法弥补已发生的执行破坏。
Paper analysisRead analysis
AttacksarXiv 2609.32400Sep 26
SkillDRE：用预执行与运行时双阶段反馈自动演化恶意 Agent 技能
提出 SkillDRE，用预执行与运行时双阶段反馈演化恶意 Agent 技能
arXiv
2609.32400
Published
Sep 26
Layer
Application layer
Setting
coding agent
Evaluated models
DeepSeek-V4-Pro, GLM-5.2, Qwen3.5-397B-A17B and others4
- AttacksPoisoning and backdoors
- TechniqueAutomated search
- ComponentMCP and skills
Paper analysisRead analysis
Risky behaviorarXiv 2609.30266Sep 25
研究显示 Claude Code、Codex 等本地智能体可轻易篡改自身执行轨迹
测试编程智能体被诱导或自主篡改自身执行轨迹的行为
arXiv
2609.30266
Published
Sep 25
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-5.6-Sol, GPT-6-Sol, Opus-5 and others11
- AttacksMalicious use
- RiskDeception and scheming
- ComponentMonitors
Abstract论文评估了本地智能体的轨迹防篡改能力，发现其可因外部指令或奖励追求而清除执行证据，亟需建立独立拦截记录机制。
这是一项针对本地大模型智能体执行轨迹完整性与安全防篡改边界的实证研究。
Paper analysisRead analysis
DefensesarXiv 2609.14079Sep 13
SkillSecurer：检测并修补 AI Agent 技能中的提示注入漏洞
提出 SkillSecurer，检测并修补 Agent 技能中的提示注入漏洞
arXiv
2609.14079
Published
Sep 13
Layer
Application layer
Setting
coding agent
Evaluated models
Claude Sonnet 5, Gemini 3.6 Flash, GPT-5.6 Sol and others10
- DefensesDetection and filtering
- AttacksPrompt injection
- ComponentMCP and skills
Paper analysisRead analysis
DefensesarXiv 2609.01487Sep 2
Defense-as-Skill：为技能增强型 Agent 演化运行时护栏技能
提出 SkillSonar，把运行时防护做成可演化技能以拦截恶意技能
arXiv
2609.01487
Published
Sep 2
Layer
Application layer
Setting
coding agent
Evaluated models
GLM-5, GPT-5.4, Claude Haiku 4.5 and others4
- DefensesInstruction–data separation
- AttacksPoisoning and backdoors
- ComponentMCP and skills
Paper analysisRead analysis
AttacksarXiv 2609.01222Sep 1
Researchers propose context privilege escalation attack, affecting 12 agent frameworks
提出针对 Agent Harness 的上下文特权提升攻击
arXiv
2609.01222
Published
Sep 1
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-5.5, GPT-5.4 mini, Claude-Sonnet-4.6 and others7
- AttacksPrompt injection
- TechniqueDormant triggers
- ComponentMemory
Paper analysisRead analysis
AttacksarXiv 2608.25776Aug 26
EvoMal attack uses self-poisoning of self-evolving coding agents to achieve worm-like propagation
提出 EVOMAL，诱导自演化编码 Agent 在创建技能时自我投毒并蠕虫传播
arXiv
2608.25776
Published
Aug 26
Layer
Application layer
Setting
coding agent
Evaluated models
Devstral-Small-2, Gemma-4-31B-IT, Qwen3-Coder-Next and others7
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMCP and skills
Abstract论文指出了自演化智能体模仿检索代码的自我毒化漏洞，提出 EVOMAL 攻击与防御，阐明了供应链新风险。
Paper analysisRead analysis
AttacksarXiv 2608.21929Aug 22
SkillBloat：通过技能注入对编码 Agent 发起 token 放大攻击
提出 SKILLBLOAT，改写技能文档放大编码 Agent token 消耗
arXiv
2608.21929
Published
Aug 22
Layer
Application layer
Setting
coding agent
Evaluated models
GLM-4.7-Flash, GLM-5, GPT-5.4 Mini and others4
- AttacksDenial of service
- TechniqueAutomated search
- ComponentMCP and skills
Paper analysisRead analysis
DefensesarXiv 2608.21101Aug 21
ClawSentry：面向自主 LLM Agent 的渐进式多层安全监控网关
提出 ClawSentry 多层监控网关，在技能准入和运行时拦截恶意技能与隐藏指令
arXiv
2608.21101
Published
Aug 21
Layer
Application layer
Setting
coding agent
Evaluated models
Codex/GPT-5.4, Codex/GPT-5.5, Claude Code/GLM-5.1 and others6
- DefensesMonitoring and auditing
- AttacksPoisoning and backdoors
- ComponentMCP and skills
AbstractClawSentry 用包准入、三级运行时门控和反绕过，压低 skill 攻击并保住干净任务。
ClawSentry 是挂在智能体运行时之外的安全监督网关，用来同时盖住 skill 执行的多个生命周期边界，并把已被拒绝的效果记到会话里。
Paper analysisRead analysis
AttacksarXiv 2608.09577Aug 10
ElasticBack：通过触发词与规则耦合在 LLM Agent 技能中植入条件后门
提出 ElasticBack，在单个 Agent 技能中植入条件后门
arXiv
2608.09577
Published
Aug 10
Layer
Application layer
Setting
coding agent
Evaluated models
GLM-5.2, MiniMax-M3, GPT-5.4 and others4
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMCP and skills
AbstractElasticBack 用冻结规则加遗传搜索演化 trigger，在单 skill 上做条件后门。
ElasticBack 是放在 LLM agent 单个 skill 里的条件后门攻击。。
Paper analysisRead analysis
AttacksarXiv 2607.12340Jul 14
Research: LLM agent skill-name hallucination rates reach up to 62%, which can be exploited via squatting for supply-chain attacks
提出技能名称抢注攻击，利用 Agent 虚构技能名实施供应链劫持
arXiv
2607.12340
Published
Jul 14
Layer
Application layer
Setting
coding agent
Evaluated models
GLM-4.5-Air, GPT-5.4-mini, Claude Sonnet 4.6 and others12
- AttacksPoisoning and backdoors
- RiskHallucination and fabrication
- TechniqueSelection manipulation
- ComponentMCP and skills
Abstract研究证实智能体虚构技能名具有高发生率与可预测性，现有防御难以兼顾安全与效用，亟需注册表结构性防护。
本研究系统揭示了大模型智能体技能推荐场景下的虚构技能名称安全风险，将其形式化为一种新型供应链抢注攻击。
Paper analysisRead analysis
DefensesarXiv 2605.17380May 17
Uber proposes ADR enterprise-level agent detection system, deployed on 7,200 hosts for ten months
提出企业级检测系统 ADR，识别编程 Agent 的提示注入与恶意 MCP
arXiv
2605.17380
Published
May 17
Layer
Application layer
Setting
coding agent
- DefensesDetection and filtering
- AttacksPrompt injection
- ComponentMCP and skills
Abstract提出了端点因果遥测、两级在线分流与离线红队闭环的 ADR 系统，并在生产环境中验证了有效性。
Paper analysisRead analysis
AttacksarXiv 2604.03081Apr 3
Supply Chain Poisoning Attacks on the LLM Coding Agent Skill Ecosystem
提出 PoisonedSkills，评测编码 Agent 技能生态的文档投毒
arXiv
2604.03081
Published
Apr 3
Layer
Application layer
Setting
coding agent
Evaluated models
Claude Sonnet 4.6, GLM-4.7, MiniMax-M2.5 and others5
- AttacksPoisoning and backdoors
- TechniqueEncoding and obfuscation
- ComponentMCP and skills
Abstract作者称技能文档可成为系统操作攻击入口，但结果只评估加载后的阶段。
PoisonedSkills 研究编码智能体的技能供应链投毒，重点是文档内容如何进入实际系统操作。。
Paper analysisRead analysis
AttacksarXiv 2602.14211Feb 16
SkillJect: Automatically generating skill-based prompt injection for skill-based agents
提出 SkillJect，自动生成投毒 skill 诱导代码 Agent 执行隐藏脚本
arXiv
2602.14211
Published
Feb 16
Layer
Application layer
Setting
coding agent
Evaluated models
Claude-4.6-Sonnet, GPT-5-mini, GLM-4.7 and others10
- AttacksPrompt injection
- TechniqueAutomated search
- ComponentMCP and skills
AbstractSkillJect 用双通道和闭环精炼投毒 skill。
SkillJect 是针对可安装 agent skill 的自动化提示注入框架。作者要解决的是：公开或手工放入 skill 的恶意指令常常被拒绝或忽略，而 skill 一旦安装就会被反复当作可信指导加载。
Paper analysisRead analysis

You have reached the end

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop