Translation in progress Some entries still include text in the original language.
Oct 12 · Monday
All papers Found 15 papers Another 232 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
提出 PyCache Trap，用字节码缓存替换绕过 Agent 技能扫描器
Published Oct 7
Evaluated models CISCO , HSS , AUDITOR and others8 Abstract 论文剖析智能体技能审查与执行脱节盲区，提出 PyCache Trap 攻击并构建基于可信复现的 EAV 防御。这篇论文研究了智能体技能（Agent Skills）安全扫描中的“审查–执行脱节”问题，并提出了对应的攻击验证与防御方案。
提出 PackHallu，经规则文件提示注入诱导编码 Agent 换用攻击者指定包
Published Oct 7
Evaluated models Qwen2.5-Coder-7B , Qwen3-Coder-30B , Devstral-Small-2-24B and others19 Abstract PackHallu 诱导规则文件换包。PackHallu 研究一种针对编程智能体规则文件的提示注入：让智能体在本应使用合法依赖时，改导入攻击者指定并控制的包。
提出 CORSA，按任务簇优化技能注入的检索与执行
Published Oct 6
Evaluated models GPT-5.4 , DeepSeek-V4-Pro , Qwen3.8-27B and others5 提出 APEX，用跨技能进度记录夹带虚假授权劫持 Agent
Published Oct 1
Evaluated models Claude Sonnet 5 , DeepSeek V4 Flash , GPT-5.4 and others6 提出 CoordPoison，解耦技能投毒的借口与动作
Published Sep 30
Evaluated models DeepSeek-V4-Flash , GLM-5.3-Flash , Claude-Sonnet-4.6 and others5 Abstract CoordPoison 外置借口。CoordPoison 是一种 Skill 供应链投毒方法，把“为何执行”和“执行什么”拆到两个 Skill。 。
提出 TrustProbe，挖掘技能智能体中不可信 skill 到特权操作的信任链漏洞
Published Sep 30
Evaluated models OpenClaw , OpenCode , Hermes Agent and others11 提出跨独立 Agent 的记忆跳跃攻击，经共享工件在助手间自传播
Published Sep 29
Evaluated models GPT-5.6 Luna , Kimi-K2.6 , GPT-OSS-120B and others6 Abstract 论文证实持久工件与内存可形成跨智能体传播链，揭示了将共享工件纳入安全防线的重要意义。该论文系统研究并量化了通过共享持久工件在具有独立私有内存的 LLM 智能体之间发生自传播的“工件介导传播”攻击风险。
提出 SkillDRE，用预执行与运行时双阶段反馈演化恶意 Agent 技能
Published Sep 26
Evaluated models DeepSeek-V4-Pro , GLM-5.2 , Qwen3.5-397B-A17B and others4 提出 SKILLBLOAT，改写技能文档放大编码 Agent token 消耗
Published Aug 22
Evaluated models GLM-4.7-Flash , GLM-5 , GPT-5.4 Mini and others4 提出 ElasticBack，在单个 Agent 技能中植入条件后门
Published Aug 10
Evaluated models GLM-5.2 , MiniMax-M3 , GPT-5.4 and others4 Abstract ElasticBack 用冻结规则加遗传搜索演化 trigger，在单 skill 上做条件后门。ElasticBack 是放在 LLM agent 单个 skill 里的条件后门攻击。 。
提出 EvoBreak，以良性任务组合诱导自进化 Agent 的持久经验并削弱安全边界
Published Aug 3
Evaluated models GPT-5-mini , Llama-3.1-8B-Instruct 提出 MEMGHOST，用单封邮件对持久个人 Agent 做跨会话隐蔽记忆注入
Published Jul 6
Evaluated models GPT-5.4 , Claude Sonnet 4.6 , Claude Sonnet 4.5 and others6 Abstract 总结了论文的研究背景、双代理优化方法 MEMGHOST、全周期实验结果以及作者对记忆信任边界的启示。本文研究了持久化个人智能体面临的隐蔽记忆注入威胁，提出了一套兼顾写入、隐蔽与跨会话生效的自动化生成框架与全周期评测基准。
提出潜伏记忆投毒，诱导 Agent 把外部文档写成持久伪造记忆
Published May 15
Evaluated models GPT-5.4 , GPT-5.5 , Claude Sonnet 4.6 and others12 Abstract 持久记忆成为跨会话攻击面：通用载荷可写入伪造记忆，并在相关后续任务中影响行为。sleeper memory poisoning 研究带持久记忆的 LLM 助手：外部文档能否让助手存下一则伪造的用户记忆，并在原文档消失后的新会话里被取回、用来改变回复或动作。
构建 Trojan Hippo Bench，评测 Agent 持久记忆投毒与外泄
Published May 4
Evaluated models Gemini 3.1 Pro , GPT-5-mini , GPT-5 Abstract 论文提出了评测智能体持久化记忆攻击与防御的 Trojan Hippo Bench，揭示了潜伏攻击威胁及内存防御的安全与效用权衡。
Proposes SkillJect, which automatically generates poisoned skills to induce code agents to execute hidden scripts
Published Feb 16
Evaluated models Claude-4.6-Sonnet , GPT-5-mini , GLM-4.7 and others10 Abstract SkillJect poisons skills using dual channels and closed-loop refinement.SkillJect is an automated prompt injection framework targeting installable agent skills. The authors address the problem that malicious instructions placed in publicly available or manually installed skills are often rejected or ignored, yet once a skill is installed, it is repeatedly loaded as trusted guidance.
You have reached the end