Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 255papers have no tags yet and are not included in filtered results.

Impact：Unauthorized actions System type：coding agent System type：Browser and computer use System type：Multi-agent systems System component：Permissions and sandboxing Clear all

Another 255papers do not have category tags yet and are not included in filtered results.

Evaluation and benchmarksarXiv 2610.07639Oct 6
HarnessSecurity-Bench horizontally evaluates the security mechanisms of six coding agent frameworks.
评测编码智能体 harness 安全机制在对抗任务中的防护效果
arXiv
2610.07639
Published
Oct 6
Layer
Application layer
Setting
coding agent
- AttacksPrompt injection
- ComponentPermissions and sandboxing
Paper analysisRead analysis
DefensesarXiv 2610.05246Oct 4
研究测量策略网关跨平台命令裁决的能力边界
提出策略门裁决已实现动作，并测量跨平台命令拦截边界
arXiv
2610.05246
Published
Oct 4
Layer
Application layer
Setting
coding agent
Evaluated models
claude-opus-5, deepseek-v4.1-flash, gpt-6-astra
- DefensesPermissions and approval
- RiskDangerous agent actions
- ComponentPermissions and sandboxing
Paper analysisRead analysis
DefensesarXiv 2610.03089Oct 2
COBRA：为计算机使用 Agent 防御分支引导攻击的双 LLM 架构
提出 COBRA 双 LLM 架构，防御计算机使用 Agent 的分支转向攻击
arXiv
2610.03089
Published
Oct 2
Layer
Application layer
Setting
Browser and computer use
Evaluated models
gpt-5, UI-TARS-1.5-7B, claude-sonnet-5 and others6
- DefensesPermissions and approval
- AttacksPrompt injection
- ComponentPermissions and sandboxing
Abstract提出分支转向防御架构 COBRA，通过事前能力约束与边界代理消除分支转向攻击并兼顾效用。
Paper analysisRead analysis
DefensesarXiv 2609.38983Sep 30
The paper proposes an Approval Laundering taxonomy and empirically shows that Claude Code's approval and execution binding fails
形式化编程 Agent 的审批洗白并提出 HMAC 权能令牌防御
arXiv
2609.38983
Published
Sep 30
Layer
Application layer
Setting
coding agent
Evaluated models
Claude Code (v2.1.197, opus[1m] / claude-sonnet-5-ccmax), Codex CLI (@openai/codex v0.154.0)
- DefensesPermissions and approval
- RiskDangerous agent actions
- ComponentPermissions and sandboxing
Abstract系统揭示编程智能体审批洗白风险，提出七字段权能防御机制，证实其能消除身份时序偏离但难防副作用偏离。
Paper analysisRead analysis
AttacksarXiv 2609.33910Sep 28
论文提出残留授权重放攻击：长期运行 Agent 的授权可跨任务复用
提出残余权限重放攻击，跨任务复用长期 Agent 的历史授权绕过确认
arXiv
2609.33910
Published
Sep 28
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-4.1, Gemini-3.1-Flash-Lite, Qwen3-14B and others6
- AttacksPrompt injection
- TechniqueDefense-targeted
- ComponentPermissions and sandboxing
Paper analysisRead analysis
DefensesarXiv 2609.22949Sep 19
多智能体系统提示注入威胁模型与防御架构：14 类攻击向量与四类防御
提出多智能体系统提示注入的威胁模型与四层架构防御
arXiv
2609.22949
Published
Sep 19
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
GPT-4o (2024-08-06), Claude 3.5 Sonnet, Llama 3 70B-Instruct
- DefensesInstruction–data separation
- AttacksPrompt injection
- ComponentPermissions and sandboxing
Paper analysisRead analysis
DefensesarXiv 2609.17648Sep 15
多智能体 LLM 流水线中的信任传播与结构隔离
用任务绑定令牌和策略预言机拦住多智能体流水线的未授权执行
arXiv
2609.17648
Published
Sep 15
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
gemma4:31b-cloud
- DefensesPermissions and approval
- AttacksPoisoning and backdoors
- ComponentPermissions and sandboxing
Abstract结构性授权拦住了记忆投毒的未授权执行，持密钥时承重的是策略预言机。
作者在一条会改写沙箱邮件库的四智能体流水线上，检查低权限失陷会不会变成未授权的真实动作。
Paper analysisRead analysis
DefensesarXiv 2609.15803Sep 15
研究者提出 k-robust 联盟对齐，用多智能体评审委托授权
提出 k-robust 联盟对齐，刻画误对齐评审下的安全委托授权
arXiv
2609.15803
Published
Sep 15
Layer
Application layer
Setting
Multi-agent systems
- DefensesPermissions and approval
- RiskMisalignment and value divergence
- ComponentPermissions and sandboxing
Abstract联盟覆盖使无个体对齐的评审面板仍可相对基线安全授权，数值分数改善完备性。
委托授权的安全不要求每位评审者对齐，而要求面板在效用空间覆盖委托人。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2608.07556Aug 2
MasDrift：跨多智能体架构的授权保持基准
提出 MasDrift，评测多智能体在良性任务中的授权保持
arXiv
2608.07556
Published
Aug 2
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
DeepSeek V4 Flash, Qwen3.7 Plus, GPT-5.4 Nano and others6
- RiskDangerous agent actions
- ComponentPermissions and sandboxing
Abstract授权保持可被测量：层级用未授权动作换完成率，重锚定比沿链携带更稳。
MasDrift 把多智能体设计中的授权保持做成可测量性质，对象是没有攻击者的普通委托。
Paper analysisRead analysis
DefensesarXiv 2607.21642Jul 22
CARE: Pre-execution command validation for LLM agents that execute shell commands
Proposes a static-first validator, CARE, that decides before dispatch whether an agent's shell command may be executed
arXiv
2607.21642
Published
Jul 22
Layer
Application layer
Setting
coding agent
- DefensesPermissions and approval
- AttacksPrompt injection
- ComponentPermissions and sandboxing
Paper analysisRead analysis
AttacksarXiv 2605.08460May 9
论文建模多智能体网络中的子智能体继承攻击面
建模并利用多智能体网络中子智能体生成时的记忆继承漏洞
arXiv
2605.08460
Published
May 9
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
MiniMax M2.5, Llama-4-Maverick-17B-128E-Instruct-FP8, Qwen3.5-Plus and others5
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMemory
Abstract形式化子智能体继承，在 OpenClaw 上演示四类编排层漏洞并提出防御。
作者对多智能体网络里的子智能体继承做形式化分析，并用开源框架上的 PoC 演示编排层如何让单点妥协继续扩散。
Paper analysisRead analysis
DefensesarXiv 2602.10915Feb 11
Blind Gods and Broken Screens: Building a Secure, Intent-Centric Mobile Agent Operating System
提出 Aura，用可信内核中介移动 Agent 的身份、感知与动作控制
arXiv
2602.10915
Published
Feb 11
Layer
Application layer
Setting
Browser and computer use
Evaluated models
Gemini-3-Flash
- DefensesInstruction–data separation
- AttacksPrompt injection
- ComponentPermissions and sandboxing
AbstractAura mediates structured interactions via the Agent Kernel.
Aura uses kernel-mediated structured agent interaction, replacing screen-interface mobile assistants..
Paper analysisRead analysis

You have reached the end

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop