Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 227papers have no tags yet and are not included in filtered results.

System component：Permissions and sandboxing Clear all

Another 227papers do not have category tags yet and are not included in filtered results.

AttacksarXiv 2610.00392Sep 30
A2A-TIBA：针对 A2A 协议 LLM 智能体的间接提示注入攻击与三层同构攻防模型
提出 A2A-TIBA，经 A2A 对等任务间接注入并植入常驻回调
arXiv
2610.00392
Published
Sep 30
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
MiniMax-M3, deepseek-v4-pro, glm-5.3 and others8
- AttacksPrompt injection
- TechniqueMulti-turn escalation
- ComponentMCP and skills
AbstractA2A-TIBA 一次植入后绕过智能体，GDA 用四类结果定位防线，ELA-ITL 把信封标注列为第三层。
A2A-TIBA 把间接提示注入和绕过放进 A2A：gray-box 攻击者已能投递任务，诱导目标部署常驻回调程序后，下令和外传不再经过智能体。
Paper analysisRead analysis
AttacksarXiv 2609.39065Sep 30
TrustProbe finds 104 skill trust chain vulnerabilities in 11 open-source agents
提出 TrustProbe，挖掘技能智能体中不可信 skill 到特权操作的信任链漏洞
arXiv
2609.39065
Published
Sep 30
Layer
Application layer
Setting
AI Agent
Evaluated models
OpenClaw, OpenCode, Hermes Agent and others11
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMCP and skills
Paper analysisRead analysis
AttacksarXiv 2609.34518Sep 28
SEAD 论文提出工具型 Agent 的状态视角攻击与防御方法 DART 与 SAGE
提出工具型 Agent 的自适应攻击 DART 与预执行防御 SAGE
arXiv
2609.34518
Published
Sep 28
Layer
Application layer
Setting
AI Agent
Evaluated models
GPT-5.6 Luna, GPT-5.6 Terra, Gemini 3.8 Flash and others5
- DefensesPermissions and approval
- AttacksJailbreaks
- ComponentPermissions and sandboxing
Abstract论文提出状态控制框架 SEAD、攻击 DART 与防御 SAGE，实验显示执行反馈与环境探测在攻防交互中具有关键作用。
Paper analysisRead analysis
AttacksarXiv 2609.33910Sep 28
论文提出残留授权重放攻击：长期运行 Agent 的授权可跨任务复用
提出残余权限重放攻击，跨任务复用长期 Agent 的历史授权绕过确认
arXiv
2609.33910
Published
Sep 28
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-4.1, Gemini-3.1-Flash-Lite, Qwen3-14B and others6
- AttacksPrompt injection
- TechniqueDefense-targeted
- ComponentPermissions and sandboxing
Paper analysisRead analysis
AttacksarXiv 2609.14003Sep 12
FlowSeal：用信息流控制阻断 LLM Agent 的隐私泄露
提出 FLOWSEAL，用工具级信息流控制阻断智能体隐私泄露
arXiv
2609.14003
Published
Sep 12
Layer
Application layer
Setting
AI Agent
Evaluated models
DeepSeek-V3.2, GPT-4.1-mini, Gemini-Flash-2.5
- DefensesInstruction–data separation
- AttacksJailbreaks
- ComponentPermissions and sandboxing
Abstract作者分析大模型智能体隐私检查与攻击面重合问题，提出外部拦截防御 FLOWSEAL 并验证有效性。
Paper analysisRead analysis
AttacksarXiv 2609.11757Sep 11
Researchers disclose a Whisper prompt injection attack on the AP2 payment protocol and propose the A-VIP defense
提出 AP2 支付协议的 Whisper 攻击与 A-VIP 绑定防御
arXiv
2609.11757
Published
Sep 11
Layer
Application layer
Setting
AI Agent
Evaluated models
gemini-2.5-flash-lite, gemini-3.1-flash-lite, gemini-3-flash-preview and others15
- DefensesPermissions and approval
- AttacksPrompt injection
- ComponentPermissions and sandboxing
Abstract论文揭示了 AP2 协议决策层受操纵的风险，提出结构化与权能绑定防御 A-VIP，并发布评测基准。
Paper analysisRead analysis
AttacksarXiv 2609.03884Sep 3
HookPry：利用插件生命周期钩子更新劫持 AI Agent 框架
提出 HOOKPRY，用插件钩子版本更新供应链劫持 Agent 框架
arXiv
2609.03884
Published
Sep 3
Layer
Application layer
Setting
AI Agent
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMCP and skills
Paper analysisRead analysis
AttacksarXiv 2608.29381Aug 30
Researchers propose five categories of safety failures in agent checkpoint rollback and implement three attacks on Hermes, Cline, and LangGraph
提出利用检查点回滚破坏 Agent 执行连续性的攻击
arXiv
2608.29381
Published
Aug 30
Layer
Application layer
Setting
AI Agent
- ComponentPermissions and sandboxing
Abstract论文系统研究了智能体 C/R 的安全性，分析了合法回滚破坏执行连续性的机理，并实证评估了其普遍性与危害。
Paper analysisRead analysis
AttacksarXiv 2608.23858Aug 25
Researchers conduct a systematic security analysis of Google AP2 v0.2, identifying 48 threats
系统分析智能体支付协议的前置上下文操纵与授权威胁
arXiv
2608.23858
Published
Aug 25
Layer
Application layer
Setting
AI Agent
- AttacksPrompt injection
- ComponentMCP and skills
Paper analysisRead analysis
AttacksarXiv 2605.12673May 13
UC Berkeley proposes BenchJack, which automatically audits 10 agent benchmarks and finds 219 reward hacking defects.
提出 BENCHJACK，审计 Agent 基准中的奖励作弊缺陷
arXiv
2605.12673
Published
May 13
Layer
Application layer
Setting
AI Agent
- ComponentPermissions and sandboxing
Abstract论文系统揭示了智能体基准的奖励作弊隐患，提出自动化红队审计与迭代修补系统 BENCHJACK。
论文系统研究了主流 AI 智能体基准评测中的奖励作弊问题，提出了首个针对基准缺陷的自动化红队审计与生成对抗式迭代修补系统 BENCHJACK。
Paper analysisRead analysis
AttacksarXiv 2605.08460May 9
论文建模多智能体网络中的子智能体继承攻击面
建模并利用多智能体网络中子智能体生成时的记忆继承漏洞
arXiv
2605.08460
Published
May 9
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
MiniMax M2.5, Llama-4-Maverick-17B-128E-Instruct-FP8, Qwen3.5-Plus and others5
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMemory
Abstract形式化子智能体继承，在 OpenClaw 上演示四类编排层漏洞并提出防御。
作者对多智能体网络里的子智能体继承做形式化分析，并用开源框架上的 PoC 演示编排层如何让单点妥协继续扩散。
Paper analysisRead analysis
AttacksarXiv 2602.07379Feb 7
Aegis: Governance, Integrity, and Security for AI Voice Agents
提出 Aegis 红队框架，多轮攻击高风险语音 Agent
arXiv
2602.07379
Published
Feb 7
Layer
Application layer
Setting
AI Agent
Evaluated models
GPT-4o, GPT-4o-mini, Gemini-1.5 Pro and others7
- AttacksDenial of service
- TechniqueMulti-turn escalation
- ComponentAudio
AbstractAegis red-teams three types of voice agents: query-based access eliminates authentication and leakage successes, but behavioral attacks remain.
Aegis uses multi-turn red-teaming evaluation on ALLM voice agents already integrated into business systems. The authors call this the first systematic red-teaming framework in this setting.
Paper analysisRead analysis

You have reached the end

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop