Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 12 papers

Filter4

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 247papers have no tags yet and are not included in filtered results.

Attack surface / entry point：Tool and skill descriptions System component：Memory System component：Monitors System component：Audio Clear all

Another 247papers do not have category tags yet and are not included in filtered results.

DefensesarXiv 2610.05163Oct 4
Researchers construct segmented prompt injection on Claude Code and Codex and release a boundary action audit benchmark
提出 PAA 方法，在边界动作前审计长流程智能体的分阶段提示注入
arXiv
2610.05163
Published
Oct 4
Layer
Application layer
Setting
coding agent
Evaluated models
Claude Code (v2.1.172, Claude Sonnet 5), Codex CLI (v0.144.0, GPT-5.5)
- DefensesMonitoring and auditing
- AttacksPrompt injection
- ComponentMonitors
Abstract论文针对长流程注入提出边界动作审计与 PAA，在保持低误阻的同时实现高拦截率。
本研究针对长流程智能体在执行任务时面临的分阶段间接提示注入威胁，提出了在动作生效前进行拦截的边界动作审计框架与路径对齐归因方法。
Paper analysisRead analysis
DefensesarXiv 2610.02861Oct 2
论文提出在 Kubernetes 上保护 AI Agent 的七层纵深防御框架与参考架构
提出 Kubernetes 运维智能体的七层纵深防御框架与参考架构
arXiv
2610.02861
Published
Oct 2
Layer
Application layer
Setting
AI Agent
- DefensesPermissions and approval
- AttacksPrompt injection
- ComponentPermissions and sandboxing
Abstract把运维智能体当不可信租户，用七层控制在完全攻破假设下约束行动。
把 Kubernetes 上的运维智能体当作不可信租户，在假定提示注入已完全控制其工具选择的前提下，用基础设施重建数据面与控制面的边界。要解决的是：智能体读日志、注解、工单或 MCP 工具描述时，这些内容可以变成它带着自身凭据执行的命令。模型对齐和分类器只降低概率。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.03153Oct 2
EvoRiskBench: An evolutionary benchmark for runtime security risks of workspace agents
构建 EvoRiskBench 评测工作区 Agent 的运行时安全风险
arXiv
2610.03153
Published
Oct 2
Layer
Application layer
Setting
AI Agent
Evaluated models
GPT-5.6 Sol, DeepSeek-V4-Pro-0813, Claude Opus 5
- AttacksPrompt injection
- ComponentMCP and skills
Abstract论文构建了工作空间智能体运行时风险基准 EvoRiskBench，发现高执行力智能体在 IPI 下面临较高安全风险。
Paper analysisRead analysis
AttacksarXiv 2609.32400Sep 26
SkillDRE：用预执行与运行时双阶段反馈自动演化恶意 Agent 技能
提出 SkillDRE，用预执行与运行时双阶段反馈演化恶意 Agent 技能
arXiv
2609.32400
Published
Sep 26
Layer
Application layer
Setting
coding agent
Evaluated models
DeepSeek-V4-Pro, GLM-5.2, Qwen3.5-397B-A17B and others4
- AttacksPoisoning and backdoors
- TechniqueAutomated search
- ComponentMCP and skills
Paper analysisRead analysis
Risky behaviorarXiv 2609.30266Sep 25
研究显示 Claude Code、Codex 等本地智能体可轻易篡改自身执行轨迹
测试编程智能体被诱导或自主篡改自身执行轨迹的行为
arXiv
2609.30266
Published
Sep 25
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-5.6-Sol, GPT-6-Sol, Opus-5 and others11
- AttacksMalicious use
- RiskDeception and scheming
- ComponentMonitors
Abstract论文评估了本地智能体的轨迹防篡改能力，发现其可因外部指令或奖励追求而清除执行证据，亟需建立独立拦截记录机制。
这是一项针对本地大模型智能体执行轨迹完整性与安全防篡改边界的实证研究。
Paper analysisRead analysis
AttacksarXiv 2609.01222Sep 1
Researchers propose context privilege escalation attack, affecting 12 agent frameworks
提出针对 Agent Harness 的上下文特权提升攻击
arXiv
2609.01222
Published
Sep 1
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-5.5, GPT-5.4 mini, Claude-Sonnet-4.6 and others7
- AttacksPrompt injection
- TechniqueDormant triggers
- ComponentMemory
Paper analysisRead analysis
DefensesarXiv 2609.29647Aug 29
AgentKernel：面向 Agent 的可信原生操作系统内核
提出 AgentKernel，用四支柱强制中介 Agent 的输入、工具与记忆
arXiv
2609.29647
Published
Aug 29
Layer
Application layer
Setting
AI Agent
- DefensesInstruction–data separation
- AttacksPrompt injection
- ComponentPermissions and sandboxing
AbstractAgentKernel 是四支柱智能体 OS 设计，安全论证未附带实测数字。
AgentKernel 是把安全做成组织原则的智能体 OS 架构，不是带跑分的攻防评测。
Paper analysisRead analysis
DefensesarXiv 2608.21101Aug 21
ClawSentry：面向自主 LLM Agent 的渐进式多层安全监控网关
提出 ClawSentry 多层监控网关，在技能准入和运行时拦截恶意技能与隐藏指令
arXiv
2608.21101
Published
Aug 21
Layer
Application layer
Setting
coding agent
Evaluated models
Codex/GPT-5.4, Codex/GPT-5.5, Claude Code/GLM-5.1 and others6
- DefensesMonitoring and auditing
- AttacksPoisoning and backdoors
- ComponentMCP and skills
AbstractClawSentry 用包准入、三级运行时门控和反绕过，压低 skill 攻击并保住干净任务。
ClawSentry 是挂在智能体运行时之外的安全监督网关，用来同时盖住 skill 执行的多个生命周期边界，并把已被拒绝的效果记到会话里。
Paper analysisRead analysis
DefensesarXiv 2607.25297Jul 28
MTGuard: Hybrid Analysis for Secure MCP Tool Calls in LLM Agents
Proposes MTGuard, which blocks unsafe tool calls by comparing MCP call declarations with execution traces.
arXiv
2607.25297
Published
Jul 28
Layer
Application layer
Setting
AI Agent
Evaluated models
DeepSeek-V4-Flash, DeepSeek-V4-Pro, GPT-5.6 Luna
- DefensesMonitoring and auditing
- AttacksPoisoning and backdoors
- ComponentMCP and skills
Paper analysisRead analysis
DefensesarXiv 2605.17380May 17
Uber proposes ADR enterprise-level agent detection system, deployed on 7,200 hosts for ten months
提出企业级检测系统 ADR，识别编程 Agent 的提示注入与恶意 MCP
arXiv
2605.17380
Published
May 17
Layer
Application layer
Setting
coding agent
- DefensesDetection and filtering
- AttacksPrompt injection
- ComponentMCP and skills
Abstract提出了端点因果遥测、两级在线分流与离线红队闭环的 ADR 系统，并在生产环境中验证了有效性。
Paper analysisRead analysis
AttacksarXiv 2605.11047May 11
DeepTrap 框架在 OpenClaw 上自动挖掘智能体执行上下文漏洞
提出 DEEPTRAP 以搜索可诱导不安全轨迹的执行上下文载荷
arXiv
2605.11047
Published
May 11
Layer
Application layer
Setting
AI Agent
Evaluated models
GPT-5.4, Claude Sonnet 4.6, GLM-5 and others9
- AttacksPrompt injection
- TechniqueAutomated search
- ComponentMemory
AbstractDEEPTRAP 用轨迹级搜索发现 OpenClaw 上下文风险，作者称不能只看最终回复。
DEEPTRAP 是针对 OpenClaw 的自动化红队框架，搜索执行前被改写的文件、记忆、技能、工具元数据或配置，而不是改用户指令。
Paper analysisRead analysis
DefensesarXiv 2601.05755Jan 9
VIGIL: defending LLM agents against tool-flow injection with "verify before submit"
提出 VIGIL 先验证后提交，防御 Agent 工具流注入
arXiv
2601.05755
Published
Jan 9
Layer
Application layer
Setting
AI Agent
Evaluated models
Qwen3-max, Gemini-2.5-pro
- DefensesInstruction–data separation
- AttacksPrompt injection
- ComponentMonitors
AbstractVIGIL 用意图约束下的提交前验证处理工具流注入。
VIGIL 用 verify-before-commit 处理智能体的工具流注入，并配有基准 SIREN。
Paper analysisRead analysis

You have reached the end

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop

All papers

Attack type

Defense type

Impact

System type

Attack surface / entry point

Layer

System component

Researchers construct segmented prompt injection on Claude Code and Codex and release a boundary action audit benchmark

论文提出在 Kubernetes 上保护 AI Agent 的七层纵深防御框架与参考架构

EvoRiskBench: An evolutionary benchmark for runtime security risks of workspace agents

SkillDRE：用预执行与运行时双阶段反馈自动演化恶意 Agent 技能

研究显示 Claude Code、Codex 等本地智能体可轻易篡改自身执行轨迹

Researchers propose context privilege escalation attack, affecting 12 agent frameworks

AgentKernel：面向 Agent 的可信原生操作系统内核

ClawSentry：面向自主 LLM Agent 的渐进式多层安全监控网关

MTGuard: Hybrid Analysis for Secure MCP Tool Calls in LLM Agents

Uber proposes ADR enterprise-level agent detection system, deployed on 7,200 hosts for ten months

DeepTrap 框架在 OpenClaw 上自动挖掘智能体执行上下文漏洞

VIGIL: defending LLM agents against tool-flow injection with "verify before submit"