Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 13 papers

Filter5

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 240papers have no tags yet and are not included in filtered results.

Attack type：Prompt injection Attack type：Extraction and theft System type：coding agent System type：Multi-agent systems Attack surface / entry point：Code repositories and dependencies Clear all

Another 240papers do not have category tags yet and are not included in filtered results.

AttacksarXiv 2610.09264Oct 7
研究者提出 PackHallu：经规则文件提示注入对编码 Agent 发起包幻觉攻击
提出 PackHallu，经规则文件提示注入诱导编码 Agent 换用攻击者指定包
arXiv
2610.09264
Published
Oct 7
Layer
Application layer
Setting
coding agent
Evaluated models
Qwen2.5-Coder-7B, Qwen3-Coder-30B, Devstral-Small-2-24B and others19
- AttacksPrompt injection
- TechniqueAutomated search
AbstractPackHallu 诱导规则文件换包。
PackHallu 研究一种针对编程智能体规则文件的提示注入：让智能体在本应使用合法依赖时，改导入攻击者指定并控制的包。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.07639Oct 6
HarnessSecurity-Bench horizontally evaluates the security mechanisms of six coding agent frameworks.
评测编码智能体 harness 安全机制在对抗任务中的防护效果
arXiv
2610.07639
Published
Oct 6
Layer
Application layer
Setting
coding agent
- AttacksPrompt injection
- ComponentPermissions and sandboxing
Paper analysisRead analysis
AttacksarXiv 2610.05139Oct 4
研究揭示代码注释中的上下文注入攻击面
提出推理时上下文注入，用代码注释诱导补全生成含弱点的代码
arXiv
2610.05139
Published
Oct 4
Layer
Prompt layer
Setting
coding agent
Evaluated models
StarCoderBase, DeepSeek-Coder-base, Qwen2.5-base and others10
- AttacksPrompt injection
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.36817Sep 29
pikit：面向间接提示注入研究与评测的可组合工具包
构建可组合工具包 pikit，评测编码智能体的间接提示注入
arXiv
2609.36817
Published
Sep 29
Layer
Application layer
Setting
coding agent
- AttacksPrompt injection
Abstractpikit 提供组合式间接注入评测。
pikit 是面向间接提示注入研究的组合式工具包，主要贡献是组织攻击、投递通道、防御和判定流程，而非提出新的攻击优化算法。
Paper analysisRead analysis
DefensesarXiv 2609.35659Sep 29
Tracekit：面向自主编码 Agent 的防篡改意图-推理-动作审计系统
提出 Tracekit，审计编码 Agent 的意图、推理与动作并检测账本篡改
arXiv
2609.35659
Published
Sep 29
Layer
Application layer
Setting
coding agent
Evaluated models
Claude Code (claude -p, version 2.1), 独立评审（同一 CLI，无工具）
- DefensesMonitoring and auditing
- AttacksPrompt injection
- RiskDangerous agent actions
- ComponentMonitors
AbstractTracekit 把意图、自述和动作写入可锚定的哈希链。
Tracekit 是无第三方依赖的编码智能体审计层：把人类请求、模型自述和已执行动作并排写入可外部锚定的哈希链，执行前用正则门，事后用规则和独立模型互查。
Paper analysisRead analysis
AttacksarXiv 2609.33910Sep 28
论文提出残留授权重放攻击：长期运行 Agent 的授权可跨任务复用
提出残余权限重放攻击，跨任务复用长期 Agent 的历史授权绕过确认
arXiv
2609.33910
Published
Sep 28
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-4.1, Gemini-3.1-Flash-Lite, Qwen3-14B and others6
- AttacksPrompt injection
- TechniqueDefense-targeted
- ComponentPermissions and sandboxing
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.32616Sep 26
Cave-Bench：虚假指控下 LLM 智能体最高 60.06% 的运行会破坏正确工作
提出 CAVE-BENCH，评测智能体在虚假指责下破坏已完成的正确工作
arXiv
2609.32616
Published
Sep 26
Layer
Application layer
Setting
coding agent
Evaluated models
Claude-Sonnet-5, Claude-Opus-5, GPT-5.6-Sol and others14
- AttacksPrompt injection
- RiskDangerous agent actions
Abstract论文提出了评估智能体在虚假指责下破坏已有正确成果的 CAVE-BENCH，发现强模型易推翻已知证据，提出了门控缓解方案。
Paper analysisRead analysis
AttacksarXiv 2609.01222Sep 1
Researchers propose context privilege escalation attack, affecting 12 agent frameworks
提出针对 Agent Harness 的上下文特权提升攻击
arXiv
2609.01222
Published
Sep 1
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-5.5, GPT-5.4 mini, Claude-Sonnet-4.6 and others7
- AttacksPrompt injection
- TechniqueDormant triggers
- ComponentMemory
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2607.20759Jul 23
IssueTrojanBench: evaluating AI coding agents against malicious issue requests
Proposes IssueTrojanBench to evaluate coding agents' execution of malicious issues
arXiv
2607.20759
Published
Jul 23
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-5.3 Codex, GPT-5.4, Sonnet 4.6
- AttacksPrompt injection
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2607.14611Jul 16
论文评测 Claude Code 与 Codex 记忆文件中的提示注入风险
评测编码 Agent 记忆文件中提示注入的跨会话影响
arXiv
2607.14611
Published
Jul 16
Layer
Application layer
Setting
coding agent
Evaluated models
Claude Haiku 4.5, Claude Opus 4.7, GPT-5.2 and others4
- AttacksPoisoning and backdoors
- ComponentMemory
Abstract已植入记忆文件的载荷可以跨会话影响 Claude Code 与 Codex，攻击成功与载荷是否留下是两种不同的失败。
Bad Memory 在沙箱合成工作区里评测文件型持久记忆上的提示注入，比较载荷能否改变当前会话，以及能否在后续会话中留下或叠加。
Paper analysisRead analysis
AttacksarXiv 2607.11698Jul 13
AHA 用自动研究循环发现生产 Agent 漏洞概念
提出 AHA 自动科研循环，发现生产 Agent 的可复用漏洞概念
arXiv
2607.11698
Published
Jul 13
Layer
Application layer
Setting
coding agent
Attacker
Black-box
Evaluated models
Minimax-M2.7, Kimi-K2.6, Deepseek-V4-Pro and others5
- AttacksPrompt injection
- TechniqueAutomated search
Abstract论文提出基于可证伪科研循环的 AHA 框架，从生产级智能体中挖掘并沉淀漏洞概念图，提升攻击复用率并指导防御加固。
AHA 是一项针对生产级 LLM 智能体自动化红队测试的研究，旨在解决传统方法仅保留具体攻击载荷而缺乏成因解释、导致跨版本复用困难且无法指导修复的问题。
Paper analysisRead analysis
AttacksarXiv 2509.22040Sep 26, 2025
研究：通过编码规则文件对Cursor与GitHub Copilot实施提示注入
通过规则文件提示注入劫持编码编辑器并执行未授权终端命令
arXiv
2509.22040
Published
Sep 26, 2025
Layer
Application layer
Setting
coding agent
Evaluated models
Cursor, GitHub Copilot, Claude 4 Sonnet and others4
- AttacksPrompt injection
- TechniqueRole-play and persuasion
Abstract论文提出了针对代码编辑器的提示注入评估框架 AIShellJack，实验显示攻击能诱导 AI 执行未授权终端命令。
Paper analysisRead analysis
AttacksarXiv 2509.05372Sep 4, 2025
研究：对抗性 bug 报告可诱导 LLM 自动程序修复系统生成不安全补丁
用对抗缺陷报告诱导自动程序修复系统生成不安全补丁
arXiv
2509.05372
Published
Sep 4, 2025
Layer
Application layer
Setting
coding agent
Evaluated models
claude-sonnet-4-20250514, o4-mini, GPT-4.1-mini and others8
- AttacksPrompt injection
- TechniqueRole-play and persuasion
- ComponentGuardrails and judges
Paper analysisRead analysis

You have reached the end

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop

All papers

Attack type

Impact

System type

Attack surface / entry point

Layer

System component

研究者提出 PackHallu：经规则文件提示注入对编码 Agent 发起包幻觉攻击

HarnessSecurity-Bench horizontally evaluates the security mechanisms of six coding agent frameworks.

研究揭示代码注释中的上下文注入攻击面

pikit：面向间接提示注入研究与评测的可组合工具包

Tracekit：面向自主编码 Agent 的防篡改意图-推理-动作审计系统

论文提出残留授权重放攻击：长期运行 Agent 的授权可跨任务复用

Cave-Bench：虚假指控下 LLM 智能体最高 60.06% 的运行会破坏正确工作

Researchers propose context privilege escalation attack, affecting 12 agent frameworks

IssueTrojanBench: evaluating AI coding agents against malicious issue requests

论文评测 Claude Code 与 Codex 记忆文件中的提示注入风险

AHA 用自动研究循环发现生产 Agent 漏洞概念

研究：通过编码规则文件对Cursor与GitHub Copilot实施提示注入

研究：对抗性 bug 报告可诱导 LLM 自动程序修复系统生成不安全补丁