Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 11 papers

Filter5

Attack type

Prompt injection9 Poisoning and backdoors3

Defense type

Detection and filtering9

Impact

Unauthorized actions9

System type

AI Agent9

Attack surface / entry point

User input31 Web pages and interfaces15 Documents and messages14 Tool responses11 Tool and skill descriptions11 Code repositories and dependencies4 Retrieval corpus11 Memory writes3 Inter-agent messages3 Images, audio and video19 Distribution channels6

Layer

Application layer11

System component

MCP and skills15 Memory15 Guardrails and judges10 Monitors14 Reasoning chains3 Permissions and sandboxing23 Embeddings0 Multimodal2

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 240papers have no tags yet and are not included in filtered results.

Attack surface / entry point：Tool responses Layer：Application layer System component：Guardrails and judges System component：Embeddings System component：Multimodal Clear all

Another 240papers do not have category tags yet and are not included in filtered results.

AttacksarXiv 2610.12292Oct 9
The paper proposes an option channel attack: changing one option label can make an agent guardrail allow a prohibited operation
Proposing an option channel attack that renames option labels so that agent guardrails allow prohibited operations
arXiv
2610.12292
Published
Oct 9
Layer
Application layer
Setting
LLM applications
Attacker
Black-box
Evaluated models
LAYA-TD, LAYA-EN, LAYA-ML and others5
- AttacksDetection evasion
- ComponentGuardrails and judges
AbstractThe authors' evaluation indicates that typed models should not serve as final safety arbiters; they are susceptible to off-policy text and option name manipulation, and confidence filtering cannot resist attacks.
Paper analysisRead analysis
DefensesarXiv 2610.07657Oct 6
DEFER1 多智能体防御研究报告受控测试中的攻击成功率下降
实现 DEFER，以确定性检查优先拦截多智能体流水线的内容攻击
arXiv
2610.07657
Published
Oct 6
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
Qwen3-235B-A22B-Instruct-2507, gpt-oss-120b, Llama-4-Scout-17B-16E-Instruct and others5
- DefensesPermissions and approval
- AttacksPrompt injection
- ComponentGuardrails and judges
AbstractDEFER 把确定性检查放在 judge 之前。
DEFER 用来测量多智能体授权流水线里，确定性规则在何处结束、LLM judge 从何处开始。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.03448Oct 2
Study retests 15 prompt injection detectors: benchmark scores poorly predict agent deployment performance
重测提示注入检测器在 Agent 工具输出上的检出与任务阻断
arXiv
2610.03448
Published
Oct 2
Layer
Application layer
Setting
AI Agent
Evaluated models
Horizon-Labs, Wolf Defender, Prismor-1.5B and others15
- DefensesDetection and filtering
- AttacksPrompt injection
- ComponentGuardrails and judges
Abstract论文揭示公开基准无法反映智能体检测器表现，检测能力源于输入格式相似而非通用防御，建议基于工具输出与低误报评测。
Paper analysisRead analysis
DefensesarXiv 2609.36121Sep 29
Render Before Reading：把不可信内容渲染成图像以防御提示注入
提出 Pictionary，将不可信文本渲染成图像以防御提示注入
arXiv
2609.36121
Published
Sep 29
Layer
Application layer
Setting
AI Agent
Evaluated models
Claude Opus 4.7, Claude Haiku 4.5, GPT-5.5 and others12
- DefensesInstruction–data separation
- AttacksPrompt injection
- ComponentVision
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.35886Sep 27
Agentic Commerce Bench：衡量会花钱的智能体的欺诈检测能力
构建支付欺诈基准 ACB，评测花钱智能体的欺诈检测
arXiv
2609.35886
Published
Sep 27
Layer
Application layer
Setting
AI Agent
Evaluated models
gordonguard, pattern judge
- DefensesDetection and filtering
- RiskDangerous agent actions
- ComponentGuardrails and judges
AbstractACB 把支付欺诈与智能体操纵分开测量，作者强调观察权限、误报预算和微支付复核成本。
ACB 是一套智能体支付欺诈基准与检测参考栈，目标是衡量钱是否被不当提取，而不仅是智能体是否接受了恶意指令。
Paper analysisRead analysis
DefensesarXiv 2609.33039Sep 27
TACIT: detecting agent trajectory harm from LLM internal states
提出 TACIT，从冻结内部状态检测智能体有害轨迹
arXiv
2609.33039
Published
Sep 27
Layer
Application layer
Setting
AI Agent
Evaluated models
Qwen3-4B, Llama-3.1-8B, Qwen3-4B-Instruct and others4
- DefensesDetection and filtering
- AttacksPrompt injection
- ComponentGuardrails and judges
Abstract提出基于内部表征的智能体轨迹安全检测方法 TACIT，揭示工具风险表征特性并在多项基准上提升检测表现与效率。
Paper analysisRead analysis
DefensesarXiv 2609.10707Sep 10
面向 AI-SOC 的神经符号防御框架：用 SIEM 解码器与 NeMo Guardrails 阻断日志投毒提示注入
提出神经符号纵深架构，阻断 AI-SOC 的日志投毒与间接提示注入
arXiv
2609.10707
Published
Sep 10
Layer
Application layer
Setting
LLM applications
Evaluated models
Gemma 3 (12B)
- DefensesDetection and filtering
- AttacksPrompt injection
- ComponentGuardrails and judges
Paper analysisRead analysis
DefensesarXiv 2607.25297Jul 28
MTGuard: Hybrid Analysis for Secure MCP Tool Calls in LLM Agents
Proposes MTGuard, which blocks unsafe tool calls by comparing MCP call declarations with execution traces.
arXiv
2607.25297
Published
Jul 28
Layer
Application layer
Setting
AI Agent
Evaluated models
DeepSeek-V4-Flash, DeepSeek-V4-Pro, GPT-5.6 Luna
- DefensesMonitoring and auditing
- AttacksPoisoning and backdoors
- ComponentMCP and skills
Paper analysisRead analysis
DefensesarXiv 2603.14707Mar 16
Visual Confusion Agents: Exploiting and Defending Against Perception Failures in Computer-Use Agents
Proposes out-of-process dual-channel comparison classification to intercept erroneous clicks by computer-use agents
arXiv
2603.14707
Published
Mar 16
Layer
Application layer
Setting
Browser and computer use
Evaluated models
multi-modal-embed-small
- DefensesDetection and filtering
- AttacksPrompt injection
- RiskDangerous agent actions
- ComponentGuardrails and judges
AbstractPerception errors can be exploited by swapping screen pixels.
The authors frame CUA's perception failure as a security vulnerability, visual confused deputy: the agent authorizes click(x,y) based on a misread screen, and the actual landing point differs from the element it believes it is clicking.
Paper analysisRead analysis
DefensesarXiv 2601.10156Jan 15
ToolSafe 提出步骤级护栏 TS-Guard 与 TS-Flow，降低 Agent 有害工具调用
提出 TS-Guard 与 TS-Flow，在执行前检测并引导 Agent 修正有害工具调用
arXiv
2601.10156
Published
Jan 15
Layer
Application layer
Setting
AI Agent
Evaluated models
GPT-4o, TS-Guard, Qwen2.5-14B-Instruct
- DefensesDetection and filtering
- AttacksJailbreaks
- ComponentGuardrails and judges
AbstractTS-Bench 标步骤级风险，TS-Guard 用多任务 RL 做执行前判定，TS-Flow 用反馈代替直接中止。
ToolSafe 研究 LLM 智能体在工具执行前的步骤级安全：基准 TS-Bench、护栏 TS-Guard，以及反馈驱动框架 TS-Flow。
Paper analysisRead analysis
DefensesarXiv 2511.20597Nov 26, 2025
BrowseSafe：研究者构建浏览器 Agent 提示注入基准并评测现有防御
提出 BrowseSafe，在工具输出边界检测并拦截浏览器 Agent 提示注入
arXiv
2511.20597
Published
Nov 26, 2025
Layer
Application layer
Setting
web agent
Evaluated models
Qwen3-30B-A3B-Instruct-2507, Qwen3-8B, PromptGuard-2 (22M) and others10
- DefensesDetection and filtering
- AttacksPrompt injection
- ComponentGuardrails and judges
Paper analysisRead analysis

You have reached the end

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop