Translation in progress Some entries still include text in the original language.
Oct 12 · Monday
Another 240 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
提出 COBRA 双 LLM 架构，防御计算机使用 Agent 的分支转向攻击
Published Oct 2
Evaluated models gpt-5 , UI-TARS-1.5-7B , claude-sonnet-5 and others6 Abstract 提出分支转向防御架构 COBRA，通过事前能力约束与边界代理消除分支转向攻击并兼顾效用。
提出 ZoneClaw，用记忆分区防御计算机使用 Agent 的持久记忆攻击
Published Oct 1
Evaluated models Claude Sonnet 4.6 , GPT-5.5 , GLM-5.2 and others4 提出 Tracekit，审计编码 Agent 的意图、推理与动作并检测账本篡改
Published Sep 29
Evaluated models Claude Code (claude -p, version 2.1) , 独立评审（同一 CLI，无工具） Abstract Tracekit 把意图、自述和动作写入可锚定的哈希链。Tracekit 是无第三方依赖的编码智能体审计层：把人类请求、模型自述和已执行动作并排写入可外部锚定的哈希链，执行前用正则门，事后用规则和独立模型互查。
提出 Skill-as-API，隔离多智能体协作中的 skill 正文与系统提示词
Published Sep 1 Abstract 协议把 skill 正文留在所有者侧，四层限制发现内容、权限期限和注入拼接。Skill-as-API 是面向智能体软件工程的协调协议，用来在跨组织调用时把 skill 的代码和系统提示词留在所有者进程。作者针对三条威胁：经通道或命名空间抽取专有方法，用注入让被调用模型输出系统提示词，以及协作结束后权限继续保留。
提出 ClawSentry 多层监控网关，在技能准入和运行时拦截恶意技能与隐藏指令
Published Aug 21
Evaluated models Codex/GPT-5.4 , Codex/GPT-5.5 , Claude Code/GLM-5.1 and others6 Abstract ClawSentry 用包准入、三级运行时门控和反绕过，压低 skill 攻击并保住干净任务。ClawSentry 是挂在智能体运行时之外的安全监督网关，用来同时盖住 skill 执行的多个生命周期边界，并把已被拒绝的效果记到会话里。
Proposes a static-first validator, CARE, that decides before dispatch whether an agent's shell command may be executed
Published Jul 22 提出 Aura，用可信内核中介移动 Agent 的身份、感知与动作控制
Published Feb 11
Evaluated models Gemini-3-Flash Abstract Aura mediates structured interactions via the Agent Kernel.Aura uses kernel-mediated structured agent interaction, replacing screen-interface mobile assistants. .
You have reached the end