Skip to content

Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

Agent safety · Papers

Found 10 papers
Filter3

Attack type

Prompt injection10Poisoning and backdoors3

Defense type

Instruction–data separation6Permissions and approval9

Impact

Unauthorized actions10

System type

AI Agent10

Attack surface / entry point

User input15Web pages and interfaces11Documents and messages10Tool responses23Tool and skill descriptions15Code repositories and dependencies6Retrieval corpus4Memory writes7Inter-agent messages8Distribution channels7

Layer

Application layer10

System component

MCP and skills4Memory3Permissions and sandboxing10Multimodal0
Select any value within a category; different categories must all match. Counts include the other filters you have selected.
Attack surface / entry point：Documents and messagesSystem component：Permissions and sandboxingSystem component：MultimodalTopic: Agent safetyClear all
  1. DefensesarXiv 2610.01349

    PACE：面向工具调用 LLM Agent 的来源感知能力强制执行

    提出 PACE，在工具调用前做路径隔离与效果授权

    arXiv
    2610.01349
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    gpt-5.6-luna, DeepSeek-V4-Flash, Qwen-3.8-27B
    AbstractPACE 在工具边界做路径割与效果核验。

    PACE 是面向工具调用型 LLM 智能体的运行时调解：当准入证据无法区分会改变行为的规格时，不在出口站点上撤销调解，而在最后一次工具调用前同时检查表示出的影响路径和请求权限。

    Paper analysisRead analysis
  2. DefensesarXiv 2610.02569

    Pincer：用数字分身学习用户偏好并执行动态最小权限

    为 Agent 提出资源层授权系统 Pincer，用数字分身执行动态最小权限

    arXiv
    2610.02569
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    Claude Haiku 4.5, Muse Spark 1.2 Contributor
    AbstractPincer 在资源层以三票合取做授权。

    Pincer 是加在现成 coding agent 上的资源层授权防御：用只受用户侧信息影响的 digital twin 做动态最小权限，并与 tool-call 层防御并存。要处理的是用户维护策略带来的权限蠕变和授权疲劳，以及不学习用户策略的 tool-call 分类器。作者引述工作称 auto mode 会放行多数不安全操作，并认为推理代码或复杂 shell 的效果在这一层不实际。

    Paper analysisRead analysis
  4. DefensesarXiv 2609.22573

    研究提出面向企业 MCP 的零信任授权与工具发现方案

    提出企业 MCP 零信任授权与发现扩展，在架构上拒绝提示注入下的越权调用

    arXiv
    2609.22573
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    gpt-5, claude-sonnet-4-6, claude-opus-4-7 and others6
    Abstract同一份按工具声明同时管 MCP 的发现、列表和调用，使注入不能扩大已有凭证的权限。

    作者把零信任放在 MCP 工具调用边界：智能体即使被提示注入，也不能调用其凭证范围之外的工具。问题来自三点部署性质。调用意图会随不可信上下文改变。

    Paper analysisRead analysis
  5. DefensesarXiv 2609.14631

    IntentCap 提出按任务意图限定 LLM Agent 权限的机制

    提出 IntentCap，按来源字段所有权合成并裁决 Agent 能力租约

    arXiv
    2609.14631
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Abstract四源字段租约约束副作用。

    IntentCap 是把智能体能力绑到当前任务意图、并按上下文来源划分字段所有权的权限机制。

    Paper analysisRead analysis
  9. Evaluation and benchmarksarXiv 2608.09476

    ActBench: A Self-Evolving Benchmark for Behavioral Safety of Collaborative Agents

    构建自演化基准 ActBench，评测协作智能体的行为安全

    arXiv
    2608.09476
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    Claude-Opus-4.8, Claude-Sonnet-4.6, GPT-5.5 and others15

    AbstractActBench 通过自演化搜索与双证据重构评测轨迹行为安全，揭示基础模型决策差异主导了协同智能体的操作风险。

    Paper analysisRead analysis
  10. DefensesarXiv 2603.12644

    Revealing security threats and defense architectures for autonomous agents: an OpenClaw case study

    Reviews threats to autonomous agents and proposes a full-lifecycle defense blueprint, FASA

    arXiv
    2603.12644
    Published
    Layer
    Application layer
    Setting
    AI Agent
    AbstractUsing OpenClaw as an example, it divides risks into three layers and uses FASA to describe defense from input to system execution.

    This is a threat review and defense architecture report using OpenClaw as a case study, not a scored attack or defense evaluation.

    Paper analysisRead analysis
You have reached the end