Translation in progress Some entries still include text in the original language.

Oct 13 · Tuesday

All papers

Found 8 papers

Filter6

Attack type

Prompt injection7 Poisoning and backdoors6

Attack technique

Dormant triggers3

Impact

Unauthorized actions4

System type

AI Agent8 coding agent3

Attack surface / entry point

User input24 Web pages and interfaces10 Documents and messages14 Tool responses16 Tool and skill descriptions5 Code repositories and dependencies4 Retrieval corpus4 Memory writes40 Inter-agent messages4 Training data5 Weights and gradients10 Distribution channels8

Layer

Model layer0 Application layer8

System component

MCP and skills54 Memory7 Guardrails and judges14 Monitors8 Permissions and sandboxing21 Fine-tuning and open weights1

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 215papers have no tags yet and are not included in filtered results.

Attack surface / entry point：Tool and skill descriptions Attack surface / entry point：Code repositories and dependencies Layer：Model layer Layer：Application layer System component：Memory System component：Fine-tuning and open weights Clear all

Another 215papers do not have category tags yet and are not included in filtered results.

AttacksarXiv 2610.07510Oct 6
PersistBD: attackers can strengthen backdoors before release so that they maintain high attack success rates even after developer SFT and RL.
提出 PERSISTBD，发布前强化供应链后门使其经良性 SFT 与 RL 后仍外发凭据
arXiv
2610.07510
Published
Oct 6
Layer
Application layer
Setting
coding agent
Evaluated models
Qwen2.5-Coder-3B-Instruct, Qwen2.5-Coder-7B-Instruct, Qwen3-Coder-30B-A3B-Instruct
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentFine-tuning and open weights
Abstract总结了论文关于后门在 SFT/RL 中存活的发现、两因子机制、PERSISTBD 方法与核心数字。
本文研究第三方 LLM 智能体在开发者进行良性监督微调（SFT）和强化学习（RL）后训练时的后门持久性风险。
Paper analysisRead analysis
DefensesarXiv 2610.02861Oct 2
论文提出在 Kubernetes 上保护 AI Agent 的七层纵深防御框架与参考架构
提出 Kubernetes 运维智能体的七层纵深防御框架与参考架构
arXiv
2610.02861
Published
Oct 2
Layer
Application layer
Setting
AI Agent
- DefensesPermissions and approval
- AttacksPrompt injection
- ComponentPermissions and sandboxing
Abstract把运维智能体当不可信租户，用七层控制在完全攻破假设下约束行动。
把 Kubernetes 上的运维智能体当作不可信租户，在假定提示注入已完全控制其工具选择的前提下，用基础设施重建数据面与控制面的边界。要解决的是：智能体读日志、注解、工单或 MCP 工具描述时，这些内容可以变成它带着自身凭据执行的命令。模型对齐和分类器只降低概率。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.03153Oct 2
EvoRiskBench: An evolutionary benchmark for runtime security risks of workspace agents
构建 EvoRiskBench 评测工作区 Agent 的运行时安全风险
arXiv
2610.03153
Published
Oct 2
Layer
Application layer
Setting
AI Agent
Evaluated models
GPT-5.6 Sol, DeepSeek-V4-Pro-0813, Claude Opus 5
- AttacksPrompt injection
- ComponentMCP and skills
Abstract论文构建了工作空间智能体运行时风险基准 EvoRiskBench，发现高执行力智能体在 IPI 下面临较高安全风险。
Paper analysisRead analysis
AttacksarXiv 2609.01222Sep 1
Researchers propose context privilege escalation attack, affecting 12 agent frameworks
提出针对 Agent Harness 的上下文特权提升攻击
arXiv
2609.01222
Published
Sep 1
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-5.5, GPT-5.4 mini, Claude-Sonnet-4.6 and others7
- AttacksPrompt injection
- TechniqueDormant triggers
- ComponentMemory
Paper analysisRead analysis
DefensesarXiv 2609.29647Aug 29
AgentKernel：面向 Agent 的可信原生操作系统内核
提出 AgentKernel，用四支柱强制中介 Agent 的输入、工具与记忆
arXiv
2609.29647
Published
Aug 29
Layer
Application layer
Setting
AI Agent
- DefensesInstruction–data separation
- AttacksPrompt injection
- ComponentPermissions and sandboxing
AbstractAgentKernel 是四支柱智能体 OS 设计，安全论证未附带实测数字。
AgentKernel 是把安全做成组织原则的智能体 OS 架构，不是带跑分的攻防评测。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2607.14611Jul 16
论文评测 Claude Code 与 Codex 记忆文件中的提示注入风险
评测编码 Agent 记忆文件中提示注入的跨会话影响
arXiv
2607.14611
Published
Jul 16
Layer
Application layer
Setting
coding agent
Evaluated models
Claude Haiku 4.5, Claude Opus 4.7, GPT-5.2 and others4
- AttacksPoisoning and backdoors
- ComponentMemory
Abstract已植入记忆文件的载荷可以跨会话影响 Claude Code 与 Codex，攻击成功与载荷是否留下是两种不同的失败。
Bad Memory 在沙箱合成工作区里评测文件型持久记忆上的提示注入，比较载荷能否改变当前会话，以及能否在后续会话中留下或叠加。
Paper analysisRead analysis
AttacksarXiv 2605.15338May 15
Hidden in Memory: Latent Memory Poisoning of LLM Agents
提出潜伏记忆投毒，诱导 Agent 把外部文档写成持久伪造记忆
arXiv
2605.15338
Published
May 15
Layer
Application layer
Setting
AI Agent
Evaluated models
GPT-5.4, GPT-5.5, Claude Sonnet 4.6 and others12
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMemory
Abstract持久记忆成为跨会话攻击面：通用载荷可写入伪造记忆，并在相关后续任务中影响行为。
sleeper memory poisoning 研究带持久记忆的 LLM 助手：外部文档能否让助手存下一则伪造的用户记忆，并在原文档消失后的新会话里被取回、用来改变回复或动作。
Paper analysisRead analysis
AttacksarXiv 2605.11047May 11
DeepTrap 框架在 OpenClaw 上自动挖掘智能体执行上下文漏洞
提出 DEEPTRAP 以搜索可诱导不安全轨迹的执行上下文载荷
arXiv
2605.11047
Published
May 11
Layer
Application layer
Setting
AI Agent
Evaluated models
GPT-5.4, Claude Sonnet 4.6, GLM-5 and others9
- AttacksPrompt injection
- TechniqueAutomated search
- ComponentMemory
AbstractDEEPTRAP 用轨迹级搜索发现 OpenClaw 上下文风险，作者称不能只看最终回复。
DEEPTRAP 是针对 OpenClaw 的自动化红队框架，搜索执行前被改写的文件、记忆、技能、工具元数据或配置，而不是改用户指令。
Paper analysisRead analysis

You have reached the end

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop