Translation in progress Some entries still include text in the original language.

Oct 13 · Tuesday

All papers

Found 9 papers

Filter3

Attack type

Prompt injection7 Poisoning and backdoors3

Defense type

Permissions and approval3

Impact

Unauthorized actions4

System type

AI Agent9 coding agent5

Attack surface / entry point

User input33 Web pages and interfaces21 Documents and messages22 Tool responses37 Tool and skill descriptions19 Code repositories and dependencies9 Retrieval corpus7 Memory writes41 Inter-agent messages11 Distribution channels7

Layer

Application layer9

System component

Memory3 Guardrails and judges4 Reasoning chains3 Permissions and sandboxing6

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 216papers have no tags yet and are not included in filtered results.

Attack surface / entry point：Code repositories and dependencies System component：Memory System component：Permissions and sandboxing Clear all

Another 216papers do not have category tags yet and are not included in filtered results.

Evaluation and benchmarksarXiv 2610.07639Oct 6
HarnessSecurity-Bench horizontally evaluates the security mechanisms of six coding agent frameworks.
评测编码智能体 harness 安全机制在对抗任务中的防护效果
arXiv
2610.07639
Published
Oct 6
Layer
Application layer
Setting
coding agent
- AttacksPrompt injection
- ComponentPermissions and sandboxing
Paper analysisRead analysis
DefensesarXiv 2610.02569Oct 1
Pincer：用数字分身学习用户偏好并执行动态最小权限
为 Agent 提出资源层授权系统 Pincer，用数字分身执行动态最小权限
arXiv
2610.02569
Published
Oct 1
Layer
Application layer
Setting
AI Agent
Evaluated models
Claude Haiku 4.5, Muse Spark 1.2 Contributor
- DefensesPermissions and approval
- AttacksPrompt injection
- ComponentPermissions and sandboxing
AbstractPincer 在资源层以三票合取做授权。
Pincer 是加在现成 coding agent 上的资源层授权防御：用只受用户侧信息影响的 digital twin 做动态最小权限，并与 tool-call 层防御并存。要处理的是用户维护策略带来的权限蠕变和授权疲劳，以及不学习用户策略的 tool-call 分类器。作者引述工作称 auto mode 会放行多数不安全操作，并认为推理代码或复杂 shell 的效果在这一层不实际。
Paper analysisRead analysis
DefensesarXiv 2609.35659Sep 29
Tracekit：面向自主编码 Agent 的防篡改意图-推理-动作审计系统
提出 Tracekit，审计编码 Agent 的意图、推理与动作并检测账本篡改
arXiv
2609.35659
Published
Sep 29
Layer
Application layer
Setting
coding agent
Evaluated models
Claude Code (claude -p, version 2.1), 独立评审（同一 CLI，无工具）
- DefensesMonitoring and auditing
- AttacksPrompt injection
- RiskDangerous agent actions
- ComponentMonitors
AbstractTracekit 把意图、自述和动作写入可锚定的哈希链。
Tracekit 是无第三方依赖的编码智能体审计层：把人类请求、模型自述和已执行动作并排写入可外部锚定的哈希链，执行前用正则门，事后用规则和独立模型互查。
Paper analysisRead analysis
AttacksarXiv 2609.33910Sep 28
论文提出残留授权重放攻击：长期运行 Agent 的授权可跨任务复用
提出残余权限重放攻击，跨任务复用长期 Agent 的历史授权绕过确认
arXiv
2609.33910
Published
Sep 28
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-4.1, Gemini-3.1-Flash-Lite, Qwen3-14B and others6
- AttacksPrompt injection
- TechniqueDefense-targeted
- ComponentPermissions and sandboxing
Paper analysisRead analysis
DefensesarXiv 2609.31282Sep 25
基于区块链的 Agentic AI 框架：面向安全软件供应链的资源优化与能耗感知
提出 AttestChain，将供应链安全智能体报告签名上链并据此控制发布
arXiv
2609.31282
Published
Sep 25
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
GPT-class LLM
- DefensesWatermarking and provenance
- ComponentPermissions and sandboxing
AbstractAttestChain 将智能体报告与链上发布门控结合，现有证据来自受控合成构建的总体结果。
AttestChain 是一个把 LLM 安全检查、智能体身份验证和许可链发布策略连接起来的软件供应链防御框架。。
Paper analysisRead analysis
AttacksarXiv 2609.01222Sep 1
Researchers propose context privilege escalation attack, affecting 12 agent frameworks
提出针对 Agent Harness 的上下文特权提升攻击
arXiv
2609.01222
Published
Sep 1
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-5.5, GPT-5.4 mini, Claude-Sonnet-4.6 and others7
- AttacksPrompt injection
- TechniqueDormant triggers
- ComponentMemory
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2607.14611Jul 16
论文评测 Claude Code 与 Codex 记忆文件中的提示注入风险
评测编码 Agent 记忆文件中提示注入的跨会话影响
arXiv
2607.14611
Published
Jul 16
Layer
Application layer
Setting
coding agent
Evaluated models
Claude Haiku 4.5, Claude Opus 4.7, GPT-5.2 and others4
- AttacksPoisoning and backdoors
- ComponentMemory
Abstract已植入记忆文件的载荷可以跨会话影响 Claude Code 与 Codex，攻击成功与载荷是否留下是两种不同的失败。
Bad Memory 在沙箱合成工作区里评测文件型持久记忆上的提示注入，比较载荷能否改变当前会话，以及能否在后续会话中留下或叠加。
Paper analysisRead analysis
AttacksarXiv 2605.15338May 15
Hidden in Memory: Latent Memory Poisoning of LLM Agents
提出潜伏记忆投毒，诱导 Agent 把外部文档写成持久伪造记忆
arXiv
2605.15338
Published
May 15
Layer
Application layer
Setting
AI Agent
Evaluated models
GPT-5.4, GPT-5.5, Claude Sonnet 4.6 and others12
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMemory
Abstract持久记忆成为跨会话攻击面：通用载荷可写入伪造记忆，并在相关后续任务中影响行为。
sleeper memory poisoning 研究带持久记忆的 LLM 助手：外部文档能否让助手存下一则伪造的用户记忆，并在原文档消失后的新会话里被取回、用来改变回复或动作。
Paper analysisRead analysis
AttacksarXiv 2605.12673May 13
UC Berkeley proposes BenchJack, which automatically audits 10 agent benchmarks and finds 219 reward hacking defects.
提出 BENCHJACK，审计 Agent 基准中的奖励作弊缺陷
arXiv
2605.12673
Published
May 13
Layer
Application layer
Setting
AI Agent
- ComponentPermissions and sandboxing
Abstract论文系统揭示了智能体基准的奖励作弊隐患，提出自动化红队审计与迭代修补系统 BENCHJACK。
论文系统研究了主流 AI 智能体基准评测中的奖励作弊问题，提出了首个针对基准缺陷的自动化红队审计与生成对抗式迭代修补系统 BENCHJACK。
Paper analysisRead analysis

You have reached the end

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop