Skip to content

Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

Agent safety · Papers

Found 9 papers
Filter2

Attack type

Prompt injection8Poisoning and backdoors3Extraction and theft1

Defense type

Permissions and approval3

Impact

Unauthorized actions4Output manipulation3

System type

AI Agent9

Attack surface / entry point

User input3Tool responses3Tool and skill descriptions3Inter-agent messages3

Layer

Application layer9

System component

MCP and skills4Permissions and sandboxing7
Select any value within a category; different categories must all match. Counts include the other filters you have selected.
Attack type：Prompt injectionAttack type：Extraction and theftTopic: Agent safetyClear all
  1. AttacksarXiv 2610.02432

    论文提出 LLM 输入扰动鲁棒性度量，并发布 ASA 攻击与 AttestMCP 防护

    提出 ASA 与 AttestMCP，度量并降低 LLM 对输入序列扰动的敏感

    arXiv
    2610.02432
    Published
    Layer
    Application layer
    Setting
    LLM applications, AI Agent
    Attacker
    Black-box
    Evaluated models
    Gemma-3-27B-Instruct, Gemma-3-4B-Instruct, Llama-3.2-3B-Instruct and others12
    Paper analysisRead analysis
  2. AttacksarXiv 2610.00392

    A2A-TIBA：针对 A2A 协议 LLM 智能体的间接提示注入攻击与三层同构攻防模型

    提出 A2A-TIBA，经 A2A 对等任务间接注入并植入常驻回调

    arXiv
    2610.00392
    Published
    Layer
    Application layer
    Setting
    Multi-agent systems
    Evaluated models
    MiniMax-M3, deepseek-v4-pro, glm-5.3 and others8
    AbstractA2A-TIBA 一次植入后绕过智能体，GDA 用四类结果定位防线，ELA-ITL 把信封标注列为第三层。

    A2A-TIBA 把间接提示注入和绕过放进 A2A：gray-box 攻击者已能投递任务，诱导目标部署常驻回调程序后，下令和外传不再经过智能体。

    Paper analysisRead analysis
  5. AttacksarXiv 2609.11757

    Researchers disclose a Whisper prompt injection attack on the AP2 payment protocol and propose the A-VIP defense

    提出 AP2 支付协议的 Whisper 攻击与 A-VIP 绑定防御

    arXiv
    2609.11757
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    gemini-2.5-flash-lite, gemini-3.1-flash-lite, gemini-3-flash-preview and others15

    Abstract论文揭示了 AP2 协议决策层受操纵的风险，提出结构化与权能绑定防御 A-VIP，并发布评测基准。

    Paper analysisRead analysis
  7. AttacksarXiv 2607.12507

    研究者提出 RARE 攻击：LLM 辅助逆向工程中的表示混淆

    提出 RARE-Guard，阻止逆向观察被提升为指令或已验证声明

    arXiv
    2607.12507
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    gpt-5.5, claude-sonnet-4-6, gemini-2.5-pro and others5
    Abstract成对二进制衡量无效提升。

    作者定义的失败是：LLM 辅助逆向中，忠实提取的二进制观察获得它并未赢得的指令权限、声明证据或可信状态。

    Paper analysisRead analysis
  8. AttacksarXiv 2605.08460

    论文建模多智能体网络中的子智能体继承攻击面

    建模并利用多智能体网络中子智能体生成时的记忆继承漏洞

    arXiv
    2605.08460
    Published
    Layer
    Application layer
    Setting
    Multi-agent systems
    Evaluated models
    MiniMax M2.5, Llama-4-Maverick-17B-128E-Instruct-FP8, Qwen3.5-Plus and others5
    Abstract形式化子智能体继承，在 OpenClaw 上演示四类编排层漏洞并提出防御。

    作者对多智能体网络里的子智能体继承做形式化分析，并用开源框架上的 PoC 演示编排层如何让单点妥协继续扩散。

    Paper analysisRead analysis
  9. AttacksarXiv 2602.07379

    Aegis: Governance, Integrity, and Security for AI Voice Agents

    提出 Aegis 红队框架，多轮攻击高风险语音 Agent

    arXiv
    2602.07379
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    GPT-4o, GPT-4o-mini, Gemini-1.5 Pro and others7
    AbstractAegis red-teams three types of voice agents: query-based access eliminates authentication and leakage successes, but behavioral attacks remain.

    Aegis uses multi-turn red-teaming evaluation on ALLM voice agents already integrated into business systems. The authors call this the first systematic red-teaming framework in this setting.

    Paper analysisRead analysis
You have reached the end