Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 254papers have no tags yet and are not included in filtered results.

Attack surface / entry point：Web pages and interfaces Attack surface / entry point：Code repositories and dependencies Layer：Application layer System component：Memory System component：RAG Clear all

Another 254papers do not have category tags yet and are not included in filtered results.

AttacksarXiv 2610.11932Oct 8
A Fudan team measures the citation fragility of AI search: ordinary posts can enter citations and answer text
Measures citation fragility in AI search, demonstrating that ordinary public posts can enter citations and answers.
arXiv
2610.11932
Published
Oct 8
Layer
Application layer
Setting
LLM applications
Evaluated models
Grok, Doubao, ChatGPT and others10
- AttacksPoisoning and backdoors
- ComponentRAG
AbstractThe authors claim the paper quantifies vulnerabilities in AI search caused by citation preferences and low posting thresholds; tests show public web posts can penetrate AI citations, and they call for auditing the citation supply chain.
Paper analysisRead analysis
DefensesarXiv 2610.00450Oct 1
ZoneClaw 用记忆分区防御 OpenClaw 式计算机使用 Agent 的持久记忆攻击
提出 ZoneClaw，用记忆分区防御计算机使用 Agent 的持久记忆攻击
arXiv
2610.00450
Published
Oct 1
Layer
Application layer
Setting
Browser and computer use
Evaluated models
Claude Sonnet 4.6, GPT-5.5, GLM-5.2 and others4
- DefensesInstruction–data separation
- AttacksPoisoning and backdoors
- ComponentMemory
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.19705Sep 17
SoK 论文提出 FARSIGHT 框架，评测 15 个学术金融 LLM 交易 Agent 的鲁棒性与安全失败
用 FARSIGHT 方案级评测金融 LLM 交易 Agent 的稳健性与安全失败
arXiv
2609.19705
Published
Sep 17
Layer
Application layer
Setting
AI Agent
Evaluated models
ChatGPT Deep Research
- AttacksPrompt injection
- RiskDangerous agent actions
- ComponentMemory
Paper analysisRead analysis
AttacksarXiv 2609.02774Sep 3
CodePoisonRAG：针对检索增强代码生成的知识投毒攻击
提出 CodePoisonRAG，对检索增强代码生成的知识库投毒以植入漏洞
arXiv
2609.02774
Published
Sep 3
Layer
Application layer
Setting
LLM applications
Evaluated models
Qwen 3.5 9B, Code Llama 13B, DeepSeek-Coder-V2 16B
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentRAG
AbstractCodePoisonRAG 展示了 RACG 外部知识库的新攻击面，在较低投毒率下可定向诱发指定漏洞并部分抵御防御。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.02316Sep 2
Counter-GEO-Bench：现有护栏难挡 GEO 虚假信息
构建 COUNTER-GEO-BENCH，评测生成式搜索中的 GEO 虚假信息防御
arXiv
2609.02316
Published
Sep 2
Layer
Application layer
Setting
LLM applications
Evaluated models
Gemma-4-31B-IT, Qwen-3.5-35B-A3B, Llama-4-Scout-17B-16E and others8
- DefensesDetection and filtering
- AttacksPrompt injection
- ComponentRAG
Abstract论文构建了针对 GEO 虚假信息的首个防御基准，揭示通用护栏的失效与反作用，并提出了有效的轻量对比检测基线。
Paper analysisRead analysis
DefensesarXiv 2609.02127Sep 2
论文提出带类型溯源与断言护栏，防止持久化 AI Agent 把不可信输入当作自身历史
提出类型化溯源与断言护栏，约束持久 Agent 释放自传断言
arXiv
2609.02127
Published
Sep 2
Layer
Application layer
Setting
AI Agent
- DefensesWatermarking and provenance
- AttacksPoisoning and backdoors
- ComponentMemory
Paper analysisRead analysis
AttacksarXiv 2609.01222Sep 1
Researchers propose context privilege escalation attack, affecting 12 agent frameworks
提出针对 Agent Harness 的上下文特权提升攻击
arXiv
2609.01222
Published
Sep 1
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-5.5, GPT-5.4 mini, Claude-Sonnet-4.6 and others7
- AttacksPrompt injection
- TechniqueDormant triggers
- ComponentMemory
Paper analysisRead analysis
AttacksarXiv 2608.04565Aug 5
Researchers propose Breadcrumbing long-range attack that can hijack the evidence chain of DeepResearch-style search agents
提出权威链劫持与轨迹引导策略演化，劫持搜索 Agent 的证据链
arXiv
2608.04565
Published
Aug 5
Layer
Application layer
Setting
web agent
Evaluated models
Qwen3.5-9B, Gemma4-31B, DeepResearch and others7
- AttacksPrompt injection
- TechniqueAutomated search
- ComponentRAG
Abstract论文揭示了多步搜索智能体在受限中间人操纵下的脆弱性，提出 ACH 策略与 TGSE 演化方法并完成系统验证。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2607.14611Jul 16
论文评测 Claude Code 与 Codex 记忆文件中的提示注入风险
评测编码 Agent 记忆文件中提示注入的跨会话影响
arXiv
2607.14611
Published
Jul 16
Layer
Application layer
Setting
coding agent
Evaluated models
Claude Haiku 4.5, Claude Opus 4.7, GPT-5.2 and others4
- AttacksPoisoning and backdoors
- ComponentMemory
Abstract已植入记忆文件的载荷可以跨会话影响 Claude Code 与 Codex，攻击成功与载荷是否留下是两种不同的失败。
Bad Memory 在沙箱合成工作区里评测文件型持久记忆上的提示注入，比较载荷能否改变当前会话，以及能否在后续会话中留下或叠加。
Paper analysisRead analysis
AttacksarXiv 2606.04329Jun 3
研究者系统研究 LLM 智能体记忆投毒攻击并提出 MPBench 基准
系统研究 LLM 智能体记忆投毒并构建基准 MPBench
arXiv
2606.04329
Published
Jun 3
Layer
Application layer
Setting
AI Agent
Evaluated models
Meta-Llama-3.1-70B-Instruct, Deberta-v3-base, Llama-3.1-8B-Instruct and others5
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMemory
Abstract系统研究了智能体记忆投毒风险，揭示了写入渠道漏洞，构建了 MPBench 基准并指出提示注入防御的局限。
Paper analysisRead analysis
AttacksarXiv 2605.15338May 15
Hidden in Memory: Latent Memory Poisoning of LLM Agents
提出潜伏记忆投毒，诱导 Agent 把外部文档写成持久伪造记忆
arXiv
2605.15338
Published
May 15
Layer
Application layer
Setting
AI Agent
Evaluated models
GPT-5.4, GPT-5.5, Claude Sonnet 4.6 and others12
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMemory
Abstract持久记忆成为跨会话攻击面：通用载荷可写入伪造记忆，并在相关后续任务中影响行为。
sleeper memory poisoning 研究带持久记忆的 LLM 助手：外部文档能否让助手存下一则伪造的用户记忆，并在原文档消失后的新会话里被取回、用来改变回复或动作。
Paper analysisRead analysis
AttacksarXiv 2604.02623Apr
论文提出 eTAMP 攻击：网页内容注入可跨会话污染 Web Agent 记忆
提出 eTAMP，用网页内容跨会话投毒 Web Agent 轨迹记忆并诱导越权操作
arXiv
2604.02623
Published
Apr
Layer
Application layer
Setting
web agent
Evaluated models
GPT-5-mini, GPT-5.2, GPT-OSS-120B and others6
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMemory
Abstract论文提出了基于环境注入的跨任务记忆投毒攻击 eTAMP，作者报告智能体在环境压力下易感性增加且能力与安全并不协同。
该论文评估了基于大语言模型的 Web 智能体在利用历史交互轨迹进行记忆增强时的安全脆弱性。
Paper analysisRead analysis
DefensesarXiv 2603.12644Mar 13
揭示自主 Agent 的安全威胁与防御架构：OpenClaw 案例研究
梳理自主 Agent 威胁并提出全生命周期防御蓝图 FASA
arXiv
2603.12644
Published
Mar 13
Layer
Application layer
Setting
AI Agent
- DefensesInstruction–data separation
- AttacksPrompt injection
- ComponentPermissions and sandboxing
Abstract以 OpenClaw 为例划分三层风险，并用 FASA 描述从输入到系统执行的防御。
这是一份以 OpenClaw 为案例的威胁梳理和防御架构报告，不是带分数的攻击或防御评测。
Paper analysisRead analysis
DefensesarXiv 2603.11619Mar 12
驯服 OpenClaw：自主 LLM 智能体威胁的安全分析与缓解
提出对齐五阶段的纵深防御，缓解自主 Agent 跨阶段威胁
arXiv
2603.11619
Published
Mar 12
Layer
Application layer
Setting
AI Agent
- DefensesInstruction–data separation
- AttacksPrompt injection
- ComponentMCP and skills
Abstract这是对 OpenClaw 的生命周期威胁分析与分层缓解设计，案例为定性证据。
这是对 OpenClaw 的生命周期威胁分析，并配套一套分层缓解设计。要处理的问题是：自主智能体把即时通讯、持久记忆、第三方插件和高权限执行连在一起之后，攻击不再限于单轮越狱，而会跨初始化到执行的多个阶段复合。作者认为只加固单个接口的防御，挡不住这种跨时间攻击。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2601.10923Jan 16
Hidden-in-Plain-Text：面向社交网络 RAG 间接提示注入的基准
用 OpenRAG-Soc 评测社交网页 RAG 的间接提示注入与检索投毒
arXiv
2601.10923
Published
Jan 16
Layer
Application layer
Setting
LLM applications
Evaluated models
Llama-3-8B-Instruct, Mistral-7B-Instruct, Qwen2.5-14B and others8
- AttacksPrompt injection
- TechniqueEncoding and obfuscation
- ComponentRAG
Paper analysisRead analysis

You have reached the end

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop