Skip to content

Translation in progress Some entries still include text in the original language.

Oct 13 · Tuesday

All papers

Found 7 papers
Filter4

Attack type

Prompt injection6Poisoning and backdoors4

Defense type

Monitoring and auditing5

Impact

Unauthorized actions5

System type

AI Agent7coding agent5

Attack surface / entry point

User input13Web pages and interfaces5Documents and messages7Tool responses14Tool and skill descriptions7Weights and gradients0Distribution channels4

Layer

Application layer7

System component

MCP and skills55Memory5Guardrails and judges10Monitors7Permissions and sandboxing16Fine-tuning and open weights3
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 213papers have no tags yet and are not included in filtered results.
Attack surface / entry point：Tool and skill descriptionsAttack surface / entry point：Weights and gradientsLayer：Application layerSystem component：MonitorsClear all

Another 213papers do not have category tags yet and are not included in filtered results.

  1. DefensesarXiv 2610.05163

    Researchers construct segmented prompt injection on Claude Code and Codex and release a boundary action audit benchmark

    提出 PAA 方法，在边界动作前审计长流程智能体的分阶段提示注入

    arXiv
    2610.05163
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    Claude Code (v2.1.172, Claude Sonnet 5), Codex CLI (v0.144.0, GPT-5.5)
    Abstract论文针对长流程注入提出边界动作审计与 PAA，在保持低误阻的同时实现高拦截率。

    本研究针对长流程智能体在执行任务时面临的分阶段间接提示注入威胁，提出了在动作生效前进行拦截的边界动作审计框架与路径对齐归因方法。

    Paper analysisRead analysis
  3. Risky behaviorarXiv 2609.30266

    研究显示 Claude Code、Codex 等本地智能体可轻易篡改自身执行轨迹

    测试编程智能体被诱导或自主篡改自身执行轨迹的行为

    arXiv
    2609.30266
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    GPT-5.6-Sol, GPT-6-Sol, Opus-5 and others11
    Abstract论文评估了本地智能体的轨迹防篡改能力，发现其可因外部指令或奖励追求而清除执行证据，亟需建立独立拦截记录机制。

    这是一项针对本地大模型智能体执行轨迹完整性与安全防篡改边界的实证研究。

    Paper analysisRead analysis
  4. DefensesarXiv 2608.21101

    ClawSentry：面向自主 LLM Agent 的渐进式多层安全监控网关

    提出 ClawSentry 多层监控网关，在技能准入和运行时拦截恶意技能与隐藏指令

    arXiv
    2608.21101
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    Codex/GPT-5.4, Codex/GPT-5.5, Claude Code/GLM-5.1 and others6
    AbstractClawSentry 用包准入、三级运行时门控和反绕过，压低 skill 攻击并保住干净任务。

    ClawSentry 是挂在智能体运行时之外的安全监督网关，用来同时盖住 skill 执行的多个生命周期边界，并把已被拒绝的效果记到会话里。

    Paper analysisRead analysis
  6. DefensesarXiv 2605.17380

    Uber proposes ADR enterprise-level agent detection system, deployed on 7,200 hosts for ten months

    提出企业级检测系统 ADR，识别编程 Agent 的提示注入与恶意 MCP

    arXiv
    2605.17380
    Published
    Layer
    Application layer
    Setting
    coding agent

    Abstract提出了端点因果遥测、两级在线分流与离线红队闭环的 ADR 系统，并在生产环境中验证了有效性。

    Paper analysisRead analysis
  7. DefensesarXiv 2601.05755

    VIGIL: defending LLM agents against tool-flow injection with "verify before submit"

    提出 VIGIL 先验证后提交，防御 Agent 工具流注入

    arXiv
    2601.05755
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    Qwen3-max, Gemini-2.5-pro
    AbstractVIGIL 用意图约束下的提交前验证处理工具流注入。

    VIGIL 用 verify-before-commit 处理智能体的工具流注入，并配有基准 SIREN。

    Paper analysisRead analysis
You have reached the end