Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 16 papers

Filter5

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 240papers have no tags yet and are not included in filtered results.

System type：LLM applications System type：coding agent System type：web agent System component：Memory System component：Fine-tuning and open weights Clear all

Another 240papers do not have category tags yet and are not included in filtered results.

Risky behaviorarXiv 2610.12822Oct 9
Reward hacking as a transmissible strategy in multi-agent coding systems
Show that reward hacking can propagate through code, memory, and plans in multi-agent coding systems
arXiv
2610.12822
Published
Oct 9
Layer
Application layer
Setting
Multi-agent systems, coding agent
Evaluated models
Qwen2.5-Coder-14B, Gemma-3-12B, Qwen2.5-Coder-7B and others16
- RiskReward hacking
- ComponentMemory
AbstractThe authors state that reward hacking can spread across models and affect routing and aggregation, and that review can reduce delivery.
Reward hacking induced by coding RL can leave the source agent and enter subsequent collaboration and system coordination.
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.08902Oct 7
论文提出 agent plasticity 指标衡量智能体通过经验自我改进的效率
提出 agent plasticity 指标衡量智能体通过经验自我改进的效率
arXiv
2610.08902
Published
Oct 7
Layer
Application layer
Setting
coding agent
Evaluated models
Claude Fable 5, Claude Opus 5, GPT-5.6 Sol and others10
- ComponentMemory
Abstract作者用固定权重协议比较前沿模型把经验写成制品后的留出增益与习得效率。
作者用 agent plasticity 衡量一件事：权重冻结时，智能体把经验写成可继承制品，再换成留出能力增益，这个转换有多省。
Paper analysisRead analysis
AttacksarXiv 2610.07510Oct 6
PersistBD: attackers can strengthen backdoors before release so that they maintain high attack success rates even after developer SFT and RL.
提出 PERSISTBD，发布前强化供应链后门使其经良性 SFT 与 RL 后仍外发凭据
arXiv
2610.07510
Published
Oct 6
Layer
Application layer
Setting
coding agent
Evaluated models
Qwen2.5-Coder-3B-Instruct, Qwen2.5-Coder-7B-Instruct, Qwen3-Coder-30B-A3B-Instruct
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentFine-tuning and open weights
Abstract总结了论文关于后门在 SFT/RL 中存活的发现、两因子机制、PERSISTBD 方法与核心数字。
本文研究第三方 LLM 智能体在开发者进行良性监督微调（SFT）和强化学习（RL）后训练时的后门持久性风险。
Paper analysisRead analysis
DefensesarXiv 2610.07403Oct 6
针对 LLM 谄媚的纵深防御：记忆门控对激活诱导与记忆诱导谄媚的评估
评测记忆门控对激活诱导与记忆诱导谄媚的防御效果
arXiv
2610.07403
Published
Oct 6
Layer
Application layer
Setting
LLM applications
Evaluated models
Llama-3.1-8B-Instruct, Qwen2.5-7B-Instruct, Mistral-7B-Instruct-v0.3 and others4
- DefensesDetection and filtering
- RiskMisalignment and value divergence
- ComponentMemory
Abstract作者称外部记忆过滤成立，数据未显示反向转向再有贡献。
作者在四个开源指令模型上，把激活转向和外部记忆处理放进同一纵深防御协议，看记忆诱发谄媚和内部谄媚压力能否分开压低，以及个性化效用还剩多少。要处理的问题是：检索到的用户历史会推动模型顺从存储信念。只改外部上下文，并不直接动模型内部的谄媚表征。
Paper analysisRead analysis
AttacksarXiv 2610.05793Oct 5
研究者训练出按多智能体拓扑触发的代码后门模型
提出拓扑条件后门，使代码模型在推断多智能体部署时植入漏洞
arXiv
2610.05793
Published
Oct 5
Layer
Training and data layer
Setting
coding agent
Evaluated models
Qwen2.5-7B-Instruct, Qwen2.5-Coder-7B-Instruct
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentFine-tuning and open weights
Abstract论文证实了拓扑条件后门的可训练性与泛化性，展示了常规评测盲区，并提出差异化拓扑审计作为检测防御方向。
Paper analysisRead analysis
DefensesarXiv 2610.05241Oct 4
StateWise：在 Agent 执行动作前诊断并修复持久操作状态
提出 StateWise，在编码智能体行动前诊断并修复失效持久状态
arXiv
2610.05241
Published
Oct 4
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-5.6-sol, DeepSeek v4 Pro, Qwen 3.7 Max and others4
- DefensesPermissions and approval
- RiskDangerous agent actions
- ComponentMemory
AbstractStateWise 在动作前修复失效的持久前提。
StateWise 是在执行带副作用的动作之前，诊断并修复编码智能体持久操作状态的框架。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.34227Sep 28
Jev 预注册测试：智能体记忆何时该用选择替代抽取？
预注册检验智能体记忆中选择原始轮次能否替代事实抽取
arXiv
2609.34227
Published
Sep 28
Layer
Application layer
Setting
LLM applications
Evaluated models
jev-1.13.0
- ComponentMemory
Paper analysisRead analysis
AttacksarXiv 2609.13889Sep 12
PMPA：针对 OpenClaw 与 Claude Code 的持久记忆投毒攻击
提出 PMPA，经外部源向 Agent 持久记忆投毒并跨会话泄露隐私
arXiv
2609.13889
Published
Sep 12
Layer
Application layer
Setting
coding agent
Evaluated models
DeepSeek-V4-Flash, DeepSeek-V4-Pro, Qwen3-Max
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMemory
Abstract论文提出了持久记忆投毒攻击 PMPA，报告了 harness 智能体在处理外部数据时易受跨会话记忆投毒与隐私泄露的风险。
Paper analysisRead analysis
AttacksarXiv 2609.01222Sep 1
Researchers propose context privilege escalation attack, affecting 12 agent frameworks
提出针对 Agent Harness 的上下文特权提升攻击
arXiv
2609.01222
Published
Sep 1
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-5.5, GPT-5.4 mini, Claude-Sonnet-4.6 and others7
- AttacksPrompt injection
- TechniqueDormant triggers
- ComponentMemory
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2608.12851Aug 13
The researchers propose SkillMisevo-Bench to quantify the risk of skill mis-evolution in self-improving agents.
提出 SkillMisevo-Bench，量化自改进 Agent 的技能误演化
arXiv
2608.12851
Published
Aug 13
Layer
Application layer
Setting
coding agent
Evaluated models
Claude Code, Codex, Hermes and others4
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMemory
Paper analysisRead analysis
Risky behaviorarXiv 2608.10218Aug 11
研究者用进化算法构造多智能体 LLM 系统中的自我传播“思维病毒”
用演化算法构造 mind virus 并测量其在多智能体中的传播
arXiv
2608.10218
Published
Aug 11
Layer
Application layer
Setting
Multi-agent systems, coding agent
Evaluated models
Claude Haiku 4.5, Claude Sonnet 4.6, Gemini 3 Flash and others7
- RiskMisalignment and value divergence
- ComponentMemory
Paper analysisRead analysis
AttacksarXiv 2608.06862Aug 7
SynChain：诱导计算机使用 Agent 自建攻击链并跨任务持久化
提出 SYNCHAIN，诱导计算机使用 Agent 自建跨任务持久攻击链
arXiv
2608.06862
Published
Aug 7
Layer
Application layer
Setting
Browser and computer use, coding agent
Evaluated models
Qwen3.5-9B, Llama-3.1-8B, Ministral-3-8B
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMCP and skills
Abstract论文揭示了 CUA 自合成工件带来的内部供应链威胁，验证了潜伏载荷的跨任务传播能力与防御局限。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2608.04830Aug 5
ContextWeave：面向长周期办公工作流的智能体记忆基准
构建 ContextWeave，评测办公工作流智能体记忆的下游增益
arXiv
2608.04830
Published
Aug 5
Layer
Application layer
Setting
coding agent
Evaluated models
DeepSeek-V4-Pro, GPT-5.5, GLM-5.1 and others5
- ComponentMemory
AbstractContextWeave 用真实办公任务流检验记忆是否改善工作区质量与偏好对齐。
ContextWeave 是面向语言智能体记忆的纵向基准，用来看召回先前经验能否让后续办公任务做得更好。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2607.14611Jul 16
论文评测 Claude Code 与 Codex 记忆文件中的提示注入风险
评测编码 Agent 记忆文件中提示注入的跨会话影响
arXiv
2607.14611
Published
Jul 16
Layer
Application layer
Setting
coding agent
Evaluated models
Claude Haiku 4.5, Claude Opus 4.7, GPT-5.2 and others4
- AttacksPoisoning and backdoors
- ComponentMemory
Abstract已植入记忆文件的载荷可以跨会话影响 Claude Code 与 Codex，攻击成功与载荷是否留下是两种不同的失败。
Bad Memory 在沙箱合成工作区里评测文件型持久记忆上的提示注入，比较载荷能否改变当前会话，以及能否在后续会话中留下或叠加。
Paper analysisRead analysis
AttacksarXiv 2604.03890Apr 5
From prompts to physical actions: structured backdoor attacks against LLM-mediated robot control systems
Propose a structured JSON backdoor that triggers malicious actions in robot control via a poisoned LoRA
arXiv
2604.03890
Published
Apr 5
Layer
Training and data layer
Setting
Embodied systems and robotics, LLM applications
Evaluated models
Llama-3.1-8B-Instruct, Gemma-2-9B-IT, DeepSeek-R1-Distill-Llama-8B and others4
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentFine-tuning and open weights
Abstract推理层后门传不到执行。
Paper analysisRead analysis
AttacksarXiv 2604.02623Apr
论文提出 eTAMP 攻击：网页内容注入可跨会话污染 Web Agent 记忆
提出 eTAMP，用网页内容跨会话投毒 Web Agent 轨迹记忆并诱导越权操作
arXiv
2604.02623
Published
Apr
Layer
Application layer
Setting
web agent
Evaluated models
GPT-5-mini, GPT-5.2, GPT-OSS-120B and others6
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMemory
Abstract论文提出了基于环境注入的跨任务记忆投毒攻击 eTAMP，作者报告智能体在环境压力下易感性增加且能力与安全并不协同。
该论文评估了基于大语言模型的 Web 智能体在利用历史交互轨迹进行记忆增强时的安全脆弱性。
Paper analysisRead analysis

You have reached the end

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop

All papers

Attack type

Attack technique

Impact

System type

Attack surface / entry point

Layer

System component

Reward hacking as a transmissible strategy in multi-agent coding systems

论文提出 agent plasticity 指标衡量智能体通过经验自我改进的效率

PersistBD: attackers can strengthen backdoors before release so that they maintain high attack success rates even after developer SFT and RL.

针对 LLM 谄媚的纵深防御：记忆门控对激活诱导与记忆诱导谄媚的评估

研究者训练出按多智能体拓扑触发的代码后门模型

StateWise：在 Agent 执行动作前诊断并修复持久操作状态

Jev 预注册测试：智能体记忆何时该用选择替代抽取？

PMPA：针对 OpenClaw 与 Claude Code 的持久记忆投毒攻击

Researchers propose context privilege escalation attack, affecting 12 agent frameworks

The researchers propose SkillMisevo-Bench to quantify the risk of skill mis-evolution in self-improving agents.

研究者用进化算法构造多智能体 LLM 系统中的自我传播“思维病毒”

SynChain：诱导计算机使用 Agent 自建攻击链并跨任务持久化

ContextWeave：面向长周期办公工作流的智能体记忆基准

论文评测 Claude Code 与 Codex 记忆文件中的提示注入风险

From prompts to physical actions: structured backdoor attacks against LLM-mediated robot control systems

论文提出 eTAMP 攻击：网页内容注入可跨会话污染 Web Agent 记忆