Skip to content

Translation in progress Some entries still include text in the original language.

Oct 13 · Tuesday

All papers

Found 7 papers
Filter4

Attack type

Prompt injection17Poisoning and backdoors7Model tampering0

Attack technique

Dormant triggers4

Impact

Output manipulation3

System type

AI Agent6coding agent5

Attack surface / entry point

User input25Web pages and interfaces14Documents and messages17Tool responses17Tool and skill descriptions35Code repositories and dependencies7Retrieval corpus25Memory writes37Inter-agent messages4Training data3Weights and gradients4Distribution channels37

Layer

Application layer7

System component

Memory3
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 201papers have no tags yet and are not included in filtered results.
Attack type：Poisoning and backdoorsAttack type：Model tamperingAttack surface / entry point：Code repositories and dependenciesLayer：Application layerClear all

Another 201papers do not have category tags yet and are not included in filtered results.

  1. AttacksarXiv 2610.09264

    研究者提出 PackHallu：经规则文件提示注入对编码 Agent 发起包幻觉攻击

    提出 PackHallu，经规则文件提示注入诱导编码 Agent 换用攻击者指定包

    arXiv
    2610.09264
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    Qwen2.5-Coder-7B, Qwen3-Coder-30B, Devstral-Small-2-24B and others19
    AbstractPackHallu 诱导规则文件换包。

    PackHallu 研究一种针对编程智能体规则文件的提示注入：让智能体在本应使用合法依赖时，改导入攻击者指定并控制的包。

    Paper analysisRead analysis
  2. AttacksarXiv 2610.07510

    PersistBD: attackers can strengthen backdoors before release so that they maintain high attack success rates even after developer SFT and RL.

    提出 PERSISTBD，发布前强化供应链后门使其经良性 SFT 与 RL 后仍外发凭据

    arXiv
    2610.07510
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    Qwen2.5-Coder-3B-Instruct, Qwen2.5-Coder-7B-Instruct, Qwen3-Coder-30B-A3B-Instruct
    Abstract总结了论文关于后门在 SFT/RL 中存活的发现、两因子机制、PERSISTBD 方法与核心数字。

    本文研究第三方 LLM 智能体在开发者进行良性监督微调（SFT）和强化学习（RL）后训练时的后门持久性风险。

    Paper analysisRead analysis
  3. Evaluation and benchmarksarXiv 2609.32616

    Cave-Bench：虚假指控下 LLM 智能体最高 60.06% 的运行会破坏正确工作

    提出 CAVE-BENCH，评测智能体在虚假指责下破坏已完成的正确工作

    arXiv
    2609.32616
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    Claude-Sonnet-5, Claude-Opus-5, GPT-5.6-Sol and others14

    Abstract论文提出了评估智能体在虚假指责下破坏已有正确成果的 CAVE-BENCH，发现强模型易推翻已知证据，提出了门控缓解方案。

    Paper analysisRead analysis
  4. AttacksarXiv 2609.02774

    CodePoisonRAG：针对检索增强代码生成的知识投毒攻击

    提出 CodePoisonRAG，对检索增强代码生成的知识库投毒以植入漏洞

    arXiv
    2609.02774
    Published
    Layer
    Application layer
    Setting
    LLM applications
    Evaluated models
    Qwen 3.5 9B, Code Llama 13B, DeepSeek-Coder-V2 16B

    AbstractCodePoisonRAG 展示了 RACG 外部知识库的新攻击面，在较低投毒率下可定向诱发指定漏洞并部分抵御防御。

    Paper analysisRead analysis
  6. Evaluation and benchmarksarXiv 2607.14611

    论文评测 Claude Code 与 Codex 记忆文件中的提示注入风险

    评测编码 Agent 记忆文件中提示注入的跨会话影响

    arXiv
    2607.14611
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    Claude Haiku 4.5, Claude Opus 4.7, GPT-5.2 and others4
    Abstract已植入记忆文件的载荷可以跨会话影响 Claude Code 与 Codex，攻击成功与载荷是否留下是两种不同的失败。

    Bad Memory 在沙箱合成工作区里评测文件型持久记忆上的提示注入，比较载荷能否改变当前会话，以及能否在后续会话中留下或叠加。

    Paper analysisRead analysis
  7. AttacksarXiv 2605.15338

    Hidden in Memory: Latent Memory Poisoning of LLM Agents

    提出潜伏记忆投毒，诱导 Agent 把外部文档写成持久伪造记忆

    arXiv
    2605.15338
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    GPT-5.4, GPT-5.5, Claude Sonnet 4.6 and others12
    Abstract持久记忆成为跨会话攻击面：通用载荷可写入伪造记忆，并在相关后续任务中影响行为。

    sleeper memory poisoning 研究带持久记忆的 LLM 助手：外部文档能否让助手存下一则伪造的用户记忆，并在原文档消失后的新会话里被取回、用来改变回复或动作。

    Paper analysisRead analysis
You have reached the end