Translation in progress Some entries still include text in the original language.

Oct 13 · Tuesday

All papers

Found 60 papers

Filter5

System component

MCP and skills16 Memory5 Guardrails and judges6 Monitors11 Reasoning chains3 Permissions and sandboxing8 Vision10 Multimodal11

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 227papers have no tags yet and are not included in filtered results.

Attack type：Prompt injection System type：Models and APIs System type：coding agent System type：Browser and computer use System type：Embodied systems and robotics Clear all

Another 227papers do not have category tags yet and are not included in filtered results.

InterpretabilityarXiv 2610.12361Oct 9
Study: legal reasoning models citing legal provisions does not equal relying on legal provisions.
Uses premise permutation and hidden-layer tracing to audit whether legal chain-of-thought truly relies on the cited legal provisions.
arXiv
2610.12361
Published
Oct 9
Layer
Model layer
Setting
Models and APIs
Evaluated models
Qwen3-8B, Qwen3-14B, Llama-3.1-8B and others7
- AttacksPrompt injection
- ComponentReasoning chains
AbstractUsing counterfactual substitution of authorities and internal commitment tracing, the authors find that legal CoT rulings depend on authorities only to a limited extent and are vulnerable to prompt injection manipulation.
This study conducts an empirical audit of the causal truthfulness of legal citations in chain-of-thought reasoning of large language models in the legal domain.
Paper analysisRead analysis
DefensesarXiv 2610.11942Oct 8
LGWM: Verifying GUI agent screen transitions with action-conditioned world models
Proposes LGWM, using an action-conditioned world model to verify GUI agent screen transitions.
arXiv
2610.11942
Published
Oct 8
Layer
Application layer
Setting
Browser and computer use
Evaluated models
LGWM
- DefensesMonitoring and auditing
- AttacksPrompt injection
- ComponentMonitors
Paper analysisRead analysis
AttacksarXiv 2610.09264Oct 7
研究者提出 PackHallu：经规则文件提示注入对编码 Agent 发起包幻觉攻击
提出 PackHallu，经规则文件提示注入诱导编码 Agent 换用攻击者指定包
arXiv
2610.09264
Published
Oct 7
Layer
Application layer
Setting
coding agent
Evaluated models
Qwen2.5-Coder-7B, Qwen3-Coder-30B, Devstral-Small-2-24B and others19
- AttacksPrompt injection
- TechniqueAutomated search
AbstractPackHallu 诱导规则文件换包。
PackHallu 研究一种针对编程智能体规则文件的提示注入：让智能体在本应使用合法依赖时，改导入攻击者指定并控制的包。
Paper analysisRead analysis
AttacksarXiv 2610.09027Oct 7
P-VMI：对抗图像经 KV cache 持续影响多轮对话
提出持久视觉记忆注入，使对抗图像经缓存在触发时操控输出
arXiv
2610.09027
Published
Oct 7
Layer
Infrastructure layer
Setting
Models and APIs
Evaluated models
Qwen3-8B, Qwen3-VL-8B-Instruct, Gemma-4-12B
- AttacksPrompt injection
- TechniqueDormant triggers
- ComponentVision
Abstract论文提出 P-VMI，证实对抗输入被掩蔽后仍可经 KV 缓存持久控制模型，强调了保留状态的安全风险。
Paper analysisRead analysis
AttacksarXiv 2610.08098Oct 6
CORSA：面向技能路由器的技能注入攻击可跨路由器与 LLM 迁移
提出 CORSA，按任务簇优化技能注入的检索与执行
arXiv
2610.08098
Published
Oct 6
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-5.4, DeepSeek-V4-Pro, Qwen3.8-27B and others5
- AttacksPoisoning and backdoors
- TechniqueSelection manipulation
- ComponentMCP and skills
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.07639Oct 6
HarnessSecurity-Bench horizontally evaluates the security mechanisms of six coding agent frameworks.
评测编码智能体 harness 安全机制在对抗任务中的防护效果
arXiv
2610.07639
Published
Oct 6
Layer
Application layer
Setting
coding agent
- AttacksPrompt injection
- ComponentPermissions and sandboxing
Paper analysisRead analysis
Analysis and theoryarXiv 2610.06001Oct 5
AgentSpy: Observing AI agent behavior at the system call layer and detecting skill injection attacks
提出 AgentSpy，在系统调用层观测 Agent 行为并检测技能注入
arXiv
2610.06001
Published
Oct 5
Layer
Application layer
Setting
coding agent
Evaluated models
gpt-5.6-terra, deepseek-v4-flash, glm-5.3-flash and others4
- DefensesDetection and filtering
- AttacksPoisoning and backdoors
- ComponentMCP and skills
Abstract提出了系统级智能体监控框架 AgentSpy，揭示出通过测试背后的非预期行为与注入风险。
本研究提出了面向 AI 智能体的系统级外部监控与行为分析框架 AgentSpy。
Paper analysisRead analysis
DefensesarXiv 2610.05163Oct 4
Researchers construct segmented prompt injection on Claude Code and Codex and release a boundary action audit benchmark
提出 PAA 方法，在边界动作前审计长流程智能体的分阶段提示注入
arXiv
2610.05163
Published
Oct 4
Layer
Application layer
Setting
coding agent
Evaluated models
Claude Code (v2.1.172, Claude Sonnet 5), Codex CLI (v0.144.0, GPT-5.5)
- DefensesMonitoring and auditing
- AttacksPrompt injection
- ComponentMonitors
Abstract论文针对长流程注入提出边界动作审计与 PAA，在保持低误阻的同时实现高拦截率。
本研究针对长流程智能体在执行任务时面临的分阶段间接提示注入威胁，提出了在动作生效前进行拦截的边界动作审计框架与路径对齐归因方法。
Paper analysisRead analysis
AttacksarXiv 2610.05139Oct 4
研究揭示代码注释中的上下文注入攻击面
提出推理时上下文注入，用代码注释诱导补全生成含弱点的代码
arXiv
2610.05139
Published
Oct 4
Layer
Prompt layer
Setting
coding agent
Evaluated models
StarCoderBase, DeepSeek-Coder-base, Qwen2.5-base and others10
- AttacksPrompt injection
Paper analysisRead analysis
AttacksarXiv 2610.03857Oct 3
研究者提出 EviLLM 攻击：通过被入侵账号向 AI 代码生成流程注入漏洞
提出 EviLLM，经账户指令或插件向代码生成流程注入漏洞
arXiv
2610.03857
Published
Oct 3
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-4o, Llama 3.2 (3B)
- AttacksPrompt injection
- TechniqueDefense-targeted
Paper analysisRead analysis
DefensesarXiv 2610.03073Oct 2
SecJev：为 System One 决策模型引入安全专业知识
提出 SecJev，用场景加权训练把决策模型适配为安全类型化判断
arXiv
2610.03073
Published
Oct 2
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
SecJev-0.8B, SecJev-2B, SecJev-4B and others4
- DefensesDetection and filtering
- AttacksPrompt injection
- ComponentGuardrails and judges
AbstractSecJev 用共享打分器做安全决策，0.8B 的 task-macro 超过 Kev-9B。
SecJev 是 0.8B 到 9B 的安全决策模型族，作者称据其所知是首个面向安全的 Jev-like 家族。
Paper analysisRead analysis
DefensesarXiv 2610.02413Oct 2
研究：分类后缀可提升激活探针的分布外恶意输入检测
用分类后缀提升激活探针对分布外恶意输入的检测
arXiv
2610.02413
Published
Oct 2
Layer
Model layer
Setting
Models and APIs
Evaluated models
Llama-3.1-8B, Qwen3.5-9B, Gemma-4-12B
- DefensesMonitoring and auditing
- AttacksJailbreaks
- ComponentMonitors
Abstract作者称排序增益来自分类格式，低 FPR 精度来自点名准则。
用户轮后的分类后缀，被作者用作激活探针的分布外检测干预：排序看格式，低 FPR 精度看是否点名恶意/良性。
Paper analysisRead analysis
DefensesarXiv 2610.03089Oct 2
COBRA: A Dual-LLM Architecture for Defending Computer-Using Agents Against Branch-Jumping Attacks
提出 COBRA 双 LLM 架构，防御计算机使用 Agent 的分支转向攻击
arXiv
2610.03089
Published
Oct 2
Layer
Application layer
Setting
Browser and computer use
Evaluated models
gpt-5, UI-TARS-1.5-7B, claude-sonnet-5 and others6
- DefensesPermissions and approval
- AttacksPrompt injection
- ComponentPermissions and sandboxing
Abstract提出分支转向防御架构 COBRA，通过事前能力约束与边界代理消除分支转向攻击并兼顾效用。
Paper analysisRead analysis
DefensesarXiv 2610.00450Oct 1
ZoneClaw 用记忆分区防御 OpenClaw 式计算机使用 Agent 的持久记忆攻击
提出 ZoneClaw，用记忆分区防御计算机使用 Agent 的持久记忆攻击
arXiv
2610.00450
Published
Oct 1
Layer
Application layer
Setting
Browser and computer use
Evaluated models
Claude Sonnet 4.6, GPT-5.5, GLM-5.2 and others4
- DefensesInstruction–data separation
- AttacksPoisoning and backdoors
- ComponentMemory
Paper analysisRead analysis
InterpretabilityarXiv 2609.37737Sep 29
研究用因果激活修补定位模型服从提示注入指令的决策层
用因果激活修补定位模型服从提示注入的决策层
arXiv
2609.37737
Published
Sep 29
Layer
Model layer
Setting
Models and APIs
Evaluated models
Qwen3-4B, Qwen3-14B, Qwen3-32B and others7
- AttacksPrompt injection
Abstract合规的因果杠杆集中在网络后三分之一的低秩子空间，该层也是混淆下检测最好的位置。
这篇工作用逐层激活修补定位提示注入合规发生在网络何处，并把该位置用于检测验证。。
Paper analysisRead analysis
InterpretabilityarXiv 2609.37040Sep 29
研究：自然语言自动编码器中哪些 token 最值得审计
比较用于审计提示注入与隐瞒的 token 位置选择信号
arXiv
2609.37040
Published
Sep 29
Layer
Model layer
Setting
Models and APIs
Evaluated models
Qwen2.5-7B, Gemma-3-12B, Gemma-3-27B and others4
- AttacksPrompt injection
- RiskDeception and scheming
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.36817Sep 29
pikit：面向间接提示注入研究与评测的可组合工具包
构建可组合工具包 pikit，评测编码智能体的间接提示注入
arXiv
2609.36817
Published
Sep 29
Layer
Application layer
Setting
coding agent
- AttacksPrompt injection
Abstractpikit 提供组合式间接注入评测。
pikit 是面向间接提示注入研究的组合式工具包，主要贡献是组织攻击、投递通道、防御和判定流程，而非提出新的攻击优化算法。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.06898Sep 29
DIBench：面向移动 GUI 智能体多候选选择决策完整性的安全基准
用 DIBench 评测移动 GUI 智能体被 UI 注入后的决策完整性
arXiv
2610.06898
Published
Sep 29
Layer
Application layer
Setting
Browser and computer use
Evaluated models
Qwen2.5-VL(32B), Qwen3-VL(32B), GUI-Owl(32B) and others7
- AttacksPrompt injection
- ComponentVision
Abstract论文提出移动智能体决策完整性基准 DIBench，发现欺诈 UI 注入诱导目标选择并推高完成率，通用防御收益不稳定。
Paper analysisRead analysis
DefensesarXiv 2609.35659Sep 29
Tracekit：面向自主编码 Agent 的防篡改意图-推理-动作审计系统
提出 Tracekit，审计编码 Agent 的意图、推理与动作并检测账本篡改
arXiv
2609.35659
Published
Sep 29
Layer
Application layer
Setting
coding agent
Evaluated models
Claude Code (claude -p, version 2.1), 独立评审（同一 CLI，无工具）
- DefensesMonitoring and auditing
- AttacksPrompt injection
- RiskDangerous agent actions
- ComponentMonitors
AbstractTracekit 把意图、自述和动作写入可锚定的哈希链。
Tracekit 是无第三方依赖的编码智能体审计层：把人类请求、模型自述和已执行动作并排写入可外部锚定的哈希链，执行前用正则门，事后用规则和独立模型互查。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.35912Sep 28
MMSkillRisk：多模态技能图像中的隐藏指令可诱导 Agent 执行未授权操作
提出 MMSkillRisk 基准，评测多模态技能图像中的隐藏指令诱导 Agent 越权操作
arXiv
2609.35912
Published
Sep 28
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-5.6-sol, Kimi-K2.6, Kimi-K3 and others6
- AttacksPrompt injection
- TechniqueCross-modal payloads
- ComponentMCP and skills
Abstract论文提出 MMSkillRisk 基准与 NCVA 攻击，揭示多模态技能中教学图像潜藏指令可引发未授权操作并与良性任务共存。
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop

All papers

Attack type

Attack technique

Model risks

Defense type

Impact

System type

Attack surface / entry point

Layer

System component

Study: legal reasoning models citing legal provisions does not equal relying on legal provisions.

LGWM: Verifying GUI agent screen transitions with action-conditioned world models

研究者提出 PackHallu：经规则文件提示注入对编码 Agent 发起包幻觉攻击

P-VMI：对抗图像经 KV cache 持续影响多轮对话

CORSA：面向技能路由器的技能注入攻击可跨路由器与 LLM 迁移

HarnessSecurity-Bench horizontally evaluates the security mechanisms of six coding agent frameworks.

AgentSpy: Observing AI agent behavior at the system call layer and detecting skill injection attacks

Researchers construct segmented prompt injection on Claude Code and Codex and release a boundary action audit benchmark

研究揭示代码注释中的上下文注入攻击面

研究者提出 EviLLM 攻击：通过被入侵账号向 AI 代码生成流程注入漏洞

SecJev：为 System One 决策模型引入安全专业知识

研究：分类后缀可提升激活探针的分布外恶意输入检测

COBRA: A Dual-LLM Architecture for Defending Computer-Using Agents Against Branch-Jumping Attacks

ZoneClaw 用记忆分区防御 OpenClaw 式计算机使用 Agent 的持久记忆攻击

研究用因果激活修补定位模型服从提示注入指令的决策层

研究：自然语言自动编码器中哪些 token 最值得审计

pikit：面向间接提示注入研究与评测的可组合工具包

DIBench：面向移动 GUI 智能体多候选选择决策完整性的安全基准

Tracekit：面向自主编码 Agent 的防篡改意图-推理-动作审计系统

MMSkillRisk：多模态技能图像中的隐藏指令可诱导 Agent 执行未授权操作