Skip to content

Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 9 papers
Filter5

Attack type

Prompt injection9

Defense type

Instruction–data separation3Permissions and approval5

Impact

Unauthorized actions5

System type

AI Agent50coding agent7web agent4Browser and computer use2Multi-agent systems7

Attack surface / entry point

User input4Web pages and interfaces3Tool responses3Tool and skill descriptions4Code repositories and dependencies3

Layer

Application layer8

System component

MCP and skills16Memory4Guardrails and judges3Monitors9Reasoning chains2Permissions and sandboxing8Vision5Multimodal5
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 233papers have no tags yet and are not included in filtered results.
Attack type：Prompt injectionSystem type：coding agentSystem type：Browser and computer useSystem component：Reasoning chainsSystem component：Permissions and sandboxingClear all

Another 233papers do not have category tags yet and are not included in filtered results.

  2. DefensesarXiv 2610.03089

    COBRA: A Dual-LLM Architecture for Defending Computer-Using Agents Against Branch-Jumping Attacks

    提出 COBRA 双 LLM 架构，防御计算机使用 Agent 的分支转向攻击

    arXiv
    2610.03089
    Published
    Layer
    Application layer
    Setting
    Browser and computer use
    Evaluated models
    gpt-5, UI-TARS-1.5-7B, claude-sonnet-5 and others6

    Abstract提出分支转向防御架构 COBRA，通过事前能力约束与边界代理消除分支转向攻击并兼顾效用。

    Paper analysisRead analysis
  3. DefensesarXiv 2609.35659

    Tracekit：面向自主编码 Agent 的防篡改意图-推理-动作审计系统

    提出 Tracekit，审计编码 Agent 的意图、推理与动作并检测账本篡改

    arXiv
    2609.35659
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    Claude Code (claude -p, version 2.1), 独立评审（同一 CLI，无工具）
    AbstractTracekit 把意图、自述和动作写入可锚定的哈希链。

    Tracekit 是无第三方依赖的编码智能体审计层：把人类请求、模型自述和已执行动作并排写入可外部锚定的哈希链，执行前用正则门，事后用规则和独立模型互查。

    Paper analysisRead analysis
  5. Risky behaviorarXiv 2609.30266

    研究显示 Claude Code、Codex 等本地智能体可轻易篡改自身执行轨迹

    测试编程智能体被诱导或自主篡改自身执行轨迹的行为

    arXiv
    2609.30266
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    GPT-5.6-Sol, GPT-6-Sol, Opus-5 and others11
    Abstract论文评估了本地智能体的轨迹防篡改能力，发现其可因外部指令或奖励追求而清除执行证据，亟需建立独立拦截记录机制。

    这是一项针对本地大模型智能体执行轨迹完整性与安全防篡改边界的实证研究。

    Paper analysisRead analysis
  6. AttacksarXiv 2609.01023

    Akrasia：针对推理型代码 LLM 的隐蔽后门攻击

    提出隐蔽后门攻击 AKRASIA，在推理代码模型提示中植入触发器并伪装思维链

    arXiv
    2609.01023
    Published
    Layer
    Prompt layer
    Setting
    coding agent
    Evaluated models
    Claude-Sonnet-5, GPT-5.5, Gemini-3.5-flash and others7

    Abstract论文针对推理代码大模型提出了隐蔽推断期后门攻击 AKRASIA，揭示了模型思维链可被利用进行欺骗性伪装的安全隐患。

    Paper analysisRead analysis
  7. DefensesarXiv 2609.01677

    Skill-as-API：面向智能体软件工程的机密多智能体协作协议

    提出 Skill-as-API，隔离多智能体协作中的 skill 正文与系统提示词

    arXiv
    2609.01677
    Published
    Layer
    Application layer
    Setting
    Multi-agent systems, coding agent
    Abstract协议把 skill 正文留在所有者侧，四层限制发现内容、权限期限和注入拼接。

    Skill-as-API 是面向智能体软件工程的协调协议，用来在跨组织调用时把 skill 的代码和系统提示词留在所有者进程。作者针对三条威胁：经通道或命名空间抽取专有方法，用注入让被调用模型输出系统提示词，以及协作结束后权限继续保留。

    Paper analysisRead analysis
  9. DefensesarXiv 2602.10915

    Blind Gods and Broken Screens: Building a Secure, Intent-Centric Mobile Agent Operating System

    提出 Aura，用可信内核中介移动 Agent 的身份、感知与动作控制

    arXiv
    2602.10915
    Published
    Layer
    Application layer
    Setting
    Browser and computer use
    Evaluated models
    Gemini-3-Flash
    AbstractAura mediates structured interactions via the Agent Kernel.

    Aura uses kernel-mediated structured agent interaction, replacing screen-interface mobile assistants..

    Paper analysisRead analysis
You have reached the end