Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 265papers have no tags yet and are not included in filtered results.

Impact：Unauthorized actions System component：Guardrails and judges System component：Multimodal Clear all

Another 265papers do not have category tags yet and are not included in filtered results.

AttacksarXiv 2610.12292Oct 9
The paper proposes an option channel attack: changing one option label can make an agent guardrail allow a prohibited operation
Proposing an option channel attack that renames option labels so that agent guardrails allow prohibited operations
arXiv
2610.12292
Published
Oct 9
Layer
Application layer
Setting
LLM applications
Attacker
Black-box
Evaluated models
LAYA-TD, LAYA-EN, LAYA-ML and others5
- AttacksDetection evasion
- ComponentGuardrails and judges
AbstractThe authors' evaluation indicates that typed models should not serve as final safety arbiters; they are susceptible to off-policy text and option name manipulation, and confidence filtering cannot resist attacks.
Paper analysisRead analysis
AttacksarXiv 2610.10612Oct 7
PyCache Trap 利用 Python 缓存替换绕过七款 Agent Skill 扫描器
提出 PyCache Trap，用字节码缓存替换绕过 Agent 技能扫描器
arXiv
2610.10612
Published
Oct 7
Layer
Application layer
Setting
coding agent
Evaluated models
CISCO, HSS, AUDITOR and others8
- DefensesDetection and filtering
- AttacksDetection evasion
- TechniqueDefense-targeted
- ComponentMCP and skills
Abstract论文剖析智能体技能审查与执行脱节盲区，提出 PyCache Trap 攻击并构建基于可信复现的 EAV 防御。
这篇论文研究了智能体技能（Agent Skills）安全扫描中的“审查–执行脱节”问题，并提出了对应的攻击验证与防御方案。
Paper analysisRead analysis
DefensesarXiv 2610.09469Oct 7
Secure-CUA: Constraining the Impact of Untrusted Content in Computer-Use Agents
提出 Secure-CUA，用动作事务约束计算机使用智能体的不可信影响
arXiv
2610.09469
Published
Oct 7
Layer
Application layer
Setting
web agent
Evaluated models
Claude Opus 5, Gemini 3.8 Flash, GPT-5.6-Sol
- DefensesInstruction–data separation
- AttacksPrompt injection
- ComponentVision
AbstractSecure-CUA 用每步事务约束不可信影响，良性 TSR 接近 Vanilla-CUA。
Secure-CUA 要限制图形界面里不可信内容对 CUA 决策和 GUI 执行的影响，同时保留合法任务所需的不可信信息。
Paper analysisRead analysis
AttacksarXiv 2610.09240Oct 7
WebMirage hijacks visual web agents' browser operations with adversarial images
提出 WebMirage，用局部对抗图像劫持视觉网页 Agent 的浏览器操作
arXiv
2610.09240
Published
Oct 7
Layer
Application layer
Setting
web agent
Evaluated models
LLaVA-v1.5-13B, LLaVA-v1.6-34B, MiniCPM-o-8B and others6
- AttacksPrompt injection
- TechniqueGradient and representation optimization
- ComponentVision
Abstract论文提出了针对网络智能体的端到端视觉红队框架 WebMirage，揭示了从视觉定位到浏览器执行的安全脆弱性。
WebMirage 是一个面向视觉定位网络智能体的流水线感知端到端红队攻击框架。
Paper analysisRead analysis
DefensesarXiv 2610.07657Oct 6
DEFER1 多智能体防御研究报告受控测试中的攻击成功率下降
实现 DEFER，以确定性检查优先拦截多智能体流水线的内容攻击
arXiv
2610.07657
Published
Oct 6
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
Qwen3-235B-A22B-Instruct-2507, gpt-oss-120b, Llama-4-Scout-17B-16E-Instruct and others5
- DefensesPermissions and approval
- AttacksPrompt injection
- ComponentGuardrails and judges
AbstractDEFER 把确定性检查放在 judge 之前。
DEFER 用来测量多智能体授权流水线里，确定性规则在何处结束、LLM judge 从何处开始。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.07359Oct 6
论文实测 Agent 工具调用门控栈的失败相关性
提出 nmult 并评测 Agent 动作门禁堆叠的错误相关性
arXiv
2610.07359
Published
Oct 6
Layer
Application layer
Setting
AI Agent
Evaluated models
AgentTrust runtime (174 rules), GPT-5.5 (gpt55), claude-haiku-4-5-20251001 and others7
- RiskDangerous agent actions
- ComponentPermissions and sandboxing
Abstract论文实测发现大模型裁判间错误显著相关，作者主张按机制选型并在整栈层面度量防护增益。
论文是一项针对智能体动作拦截防御堆叠故障关联性与实际组合价值的实证测量研究。
Paper analysisRead analysis
AttacksarXiv 2610.05943Oct 5
CRIME 框架利用良性 Agent 技能组合诱发恶意行为
提出 CRIME 框架，组合良性 Agent 技能诱发恶意行为
arXiv
2610.05943
Published
Oct 5
Layer
Application layer
Setting
AI Agent
Evaluated models
DeepSeek-V4-Flash, GPT-4o-mini, GPT-4o and others6
- AttacksJailbreaks
- TechniqueAutomated search
- ComponentMCP and skills
Abstract良性技能经 DCA 或 ACA 组合后可产生恶意环境后果，单独审查对不上。
CRIME 把公共技能库中各自通过审查的技能配成两两组合，看联合执行能否实现指定恶意任务。。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.05818Oct 5
研究显示 VLA 模型文本护栏漏检隐含危害指令
评测文本守卫与激活探针能否拦住机器人隐含伤害指令
arXiv
2610.05818
Published
Oct 5
Layer
Prompt layer
Setting
Embodied systems and robotics
Evaluated models
π0.5, OpenVLA-OFT, Llama Guard 3 and others10
- RiskDangerous agent actions
- ComponentGuardrails and judges
Paper analysisRead analysis
AttacksarXiv 2609.39607Sep 30
Pretext 攻击绕过 NVIDIA SkillSpector 等 Agent 技能扫描器
提出 PRETEXT 攻击，迭代改写技能文本绕过技能扫描器并让 Agent 执行木马
arXiv
2609.39607
Published
Sep 30
Layer
Application layer
Setting
AI Agent
Attacker
White-box
Evaluated models
glm (z-ai/glm-5.1), qwen3t (qwen/qwen3-235b-a22b-thinking-2507), gpt-oss (openai/gpt-oss-120b)
- AttacksDetection evasion
- TechniqueAutomated search
- ComponentMCP and skills
Abstract论文提出了针对多阶段技能检测器的白盒攻击，揭示了单纯依赖大模型自适应检测的局限。
PRETEXT 是一项针对基于“静态规则加语义大模型”的智能体技能安全检测框架的白盒攻击与协同进化评估研究。
Paper analysisRead analysis
DefensesarXiv 2609.36121Sep 29
Render Before Reading：把不可信内容渲染成图像以防御提示注入
提出 Pictionary，将不可信文本渲染成图像以防御提示注入
arXiv
2609.36121
Published
Sep 29
Layer
Application layer
Setting
AI Agent
Evaluated models
Claude Opus 4.7, Claude Haiku 4.5, GPT-5.5 and others12
- DefensesInstruction–data separation
- AttacksPrompt injection
- ComponentVision
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.35922Sep 28
VoxParity 评测：语音智能体在需要听声判断时仍按文字行事
提出 VoxParity，固定转写只改音频，评测语音智能体是否按行业规则改工具调用
arXiv
2609.35922
Published
Sep 28
Layer
Application layer
Setting
AI Agent
Evaluated models
MiMo-V2.6-Pro, gemini-3.7-flash, Qwen3.8-Omni and others15
- RiskDangerous agent actions
- ComponentAudio
AbstractVoxParity 用固定转写的音频对比和 words-only null，测量语音智能体是否按所听内容改变工具调用。
VoxParity 测量语音智能体在词语不变、只有声音改变时，是否按行业规则改它所执行的工具调用。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.34862Sep 28
JEV 作为智能体轨迹安全评判器：与生成式 LLM 评判器的实证对比
对比类型化评审与生成式评审对智能体轨迹的安全判定
arXiv
2609.34862
Published
Sep 28
Layer
Application layer
Setting
AI Agent
Evaluated models
JEV, GLM-5.2-Tencent, DeepSeek-V4-Flash and others5
- DefensesDetection and filtering
- RiskDangerous agent actions
- ComponentGuardrails and judges
AbstractJEV 的四基准平均正类 F1 最高，延迟和估计费用更低，但分数据集与精确率有取舍。
在已保存的工具使用智能体轨迹上，比较类型化评审 JEV 与四种生成式评审的回溯安全分类。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.35912Sep 28
MMSkillRisk：多模态技能图像中的隐藏指令可诱导 Agent 执行未授权操作
提出 MMSkillRisk 基准，评测多模态技能图像中的隐藏指令诱导 Agent 越权操作
arXiv
2609.35912
Published
Sep 28
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-5.6-sol, Kimi-K2.6, Kimi-K3 and others6
- AttacksPrompt injection
- TechniqueCross-modal payloads
- ComponentMCP and skills
Abstract论文提出 MMSkillRisk 基准与 NCVA 攻击，揭示多模态技能中教学图像潜藏指令可引发未授权操作并与良性任务共存。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.35886Sep 27
Agentic Commerce Bench：衡量会花钱的智能体的欺诈检测能力
构建支付欺诈基准 ACB，评测花钱智能体的欺诈检测
arXiv
2609.35886
Published
Sep 27
Layer
Application layer
Setting
AI Agent
Evaluated models
gordonguard, pattern judge
- DefensesDetection and filtering
- RiskDangerous agent actions
- ComponentGuardrails and judges
AbstractACB 把支付欺诈与智能体操纵分开测量，作者强调观察权限、误报预算和微支付复核成本。
ACB 是一套智能体支付欺诈基准与检测参考栈，目标是衡量钱是否被不当提取，而不仅是智能体是否接受了恶意指令。
Paper analysisRead analysis
DefensesarXiv 2609.33039Sep 27
TACIT：从 LLM 内部状态检测 Agent 轨迹危害
提出 TACIT，从冻结内部状态检测智能体有害轨迹
arXiv
2609.33039
Published
Sep 27
Layer
Application layer
Setting
AI Agent
Evaluated models
Qwen3-4B, Llama-3.1-8B, Qwen3-4B-Instruct and others4
- DefensesDetection and filtering
- AttacksPrompt injection
- ComponentGuardrails and judges
Abstract提出基于内部表征的智能体轨迹安全检测方法 TACIT，揭示工具风险表征特性并在多项基准上提升检测表现与效率。
Paper analysisRead analysis
AttacksarXiv 2609.32400Sep 26
SkillDRE：用预执行与运行时双阶段反馈自动演化恶意 Agent 技能
提出 SkillDRE，用预执行与运行时双阶段反馈演化恶意 Agent 技能
arXiv
2609.32400
Published
Sep 26
Layer
Application layer
Setting
coding agent
Evaluated models
DeepSeek-V4-Pro, GLM-5.2, Qwen3.5-397B-A17B and others4
- AttacksPoisoning and backdoors
- TechniqueAutomated search
- ComponentMCP and skills
Paper analysisRead analysis
DefensesarXiv 2609.30657Sep 25
研究者提出面向邮件 Agent 的攻击链建模提示注入检测框架
提出面向邮件 Agent 的攻击链提示注入检测框架
arXiv
2609.30657
Published
Sep 25
Layer
Application layer
Setting
AI Agent
Evaluated models
Proposed framework
- DefensesDetection and filtering
- AttacksPrompt injection
- ComponentGuardrails and judges
Abstract攻击链与动作一致性融合改善了严格检测的平均 F1，但迁移、误报和攻击召回仍需分别看。
这是一项邮件智能体提示注入防御的离线建模与评测研究：作者把攻击文本是否恶意、攻击是否推进到工具操作、最终参数是否达标分开处理。
Paper analysisRead analysis
AttacksarXiv 2609.22510Sep 19
特拉维夫大学提出爆炸性提示词：条件触发的间接提示注入可绕过九款生产 Agent
提出条件触发的爆炸提示词，并设计摄入期检测器 DeFuse
arXiv
2609.22510
Published
Sep 19
Layer
Application layer
Setting
AI Agent
Evaluated models
Llama-3.1-8B-Instruct, Llama-3.1-70B-Instruct, Qwen2.5-32B-Instruct and others15
- DefensesDetection and filtering
- AttacksPrompt injection
- TechniqueDormant triggers
- ComponentGuardrails and judges
Abstract论文揭示了条件触发使提示注入绕过防御并在触发时执行工具，提出轻量检测器并在摄入期有效防范。
论文针对大语言模型智能体面临的间接提示注入威胁，研究了利用条件句式实现时间分离的爆炸提示词。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.09404Sep 9
MMPIBench：多模态提示注入对六种 Agent 框架的跨框架评测
用 MMPIBench 评测多模态提示注入对 Agent 框架的影响
arXiv
2609.09404
Published
Sep 9
Layer
Application layer
Setting
AI Agent
Evaluated models
Claude Opus 4.8, GPT-5.4, Gemini 3.1 Pro and others6
- AttacksPrompt injection
- TechniqueCross-modal payloads
- ComponentVision
Abstract论文提出 MMPIBench 评测多模态提示注入对智能体的影响，发现模型主导行为、尝试远超完成，音频通道缺乏防护。
Paper analysisRead analysis
AttacksarXiv 2609.04533Sep 4
Repeat-After-Me：针对黑盒 VLM 的自适应视觉提示注入攻击
提出 Repeat-After-Me 自适应视觉提示注入，诱导 VLM 智能体执行指定任务
arXiv
2609.04533
Published
Sep 4
Layer
Application layer
Setting
AI Agent
Evaluated models
Claude-Opus-4.7, GPT-5.5, Gemini-3.1-Pro and others6
- AttacksPrompt injection
- TechniqueAutomated search
- ComponentVision
Abstract论文提出了针对黑盒 VLM 的前缀诱导自适应视觉提示注入，在多款模型上诱发了工具调用与隐私泄露。
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop