Translation in progress Some entries still include text in the original language.
Oct 12 · Monday
Another 255 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
提出 PyCache Trap，用字节码缓存替换绕过 Agent 技能扫描器
Published Oct 7
Evaluated models CISCO , HSS , AUDITOR and others8 Abstract 论文剖析智能体技能审查与执行脱节盲区，提出 PyCache Trap 攻击并构建基于可信复现的 EAV 防御。这篇论文研究了智能体技能（Agent Skills）安全扫描中的“审查–执行脱节”问题，并提出了对应的攻击验证与防御方案。
提出 StateWise，在编码智能体行动前诊断并修复失效持久状态
Published Oct 4
Evaluated models GPT-5.6-sol , DeepSeek v4 Pro , Qwen 3.7 Max and others4 Abstract StateWise 在动作前修复失效的持久前提。StateWise 是在执行带副作用的动作之前，诊断并修复编码智能体持久操作状态的框架。
提出 ZoneClaw，用记忆分区防御计算机使用 Agent 的持久记忆攻击
Published Oct 1
Evaluated models Claude Sonnet 4.6 , GPT-5.5 , GLM-5.2 and others4 提出 SkillDRE，用预执行与运行时双阶段反馈演化恶意 Agent 技能
Published Sep 26
Evaluated models DeepSeek-V4-Pro , GLM-5.2 , Qwen3.5-397B-A17B and others4 提出针对 Agent Harness 的上下文特权提升攻击
Published Sep 1
Evaluated models GPT-5.5 , GPT-5.4 mini , Claude-Sonnet-4.6 and others7 提出 SkillMisevo-Bench，量化自改进 Agent 的技能误演化
Published Aug 13
Evaluated models Claude Code , Codex , Hermes and others4 提出 ColluSkill，用跨技能组合绕过 Agent 技能扫描器
Published Aug 10
Evaluated models GPT-5.5 , DeepSeek-V4-Pro , GLM-5.2 Abstract 论文揭示了单技能孤立扫描的盲区，提出多技能链攻击 ColluSkill 与上下文防御 ChainGuard 并验证了有效性。
Proposes a static-first validator, CARE, that decides before dispatch whether an agent's shell command may be executed
Published Jul 22 提出进程外双通道对比分类，拦截计算机使用智能体的错误点击
Published Mar 16
Evaluated models multi-modal-embed-small Abstract 感知错误可被屏幕像素对调利用。作者把 CUA 的感知失败写成安全漏洞visual confused deputy ：智能体按看错的屏幕授权 click(x,y)，真实落点与它以为的元素不一致。
You have reached the end