Skip to content

Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 23 papers
Filter4

Attack type

Prompt injection18Poisoning and backdoors5

Defense type

Instruction–data separation10Permissions and approval14

Impact

Unauthorized actions14Output manipulation6

System type

LLM applications4AI Agent19coding agent3web agent3

Attack surface / entry point

User input32Web pages and interfaces17Documents and messages13Tool responses25Tool and skill descriptions16Code repositories and dependencies7Retrieval corpus30Memory writes9Inter-agent messages8Distribution channels8

Layer

Application layer23

System component

MCP and skills8Memory10RAG5Guardrails and judges9Monitors5Reasoning chains4Permissions and sandboxing18Vision10Multimodal10
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 240papers have no tags yet and are not included in filtered results.
Attack surface / entry point：Web pages and interfacesAttack surface / entry point：Code repositories and dependenciesSystem component：RAGSystem component：Permissions and sandboxingClear all

Another 240papers do not have category tags yet and are not included in filtered results.

  1. AttacksarXiv 2610.11932

    A Fudan team measures the citation fragility of AI search: ordinary posts can enter citations and answer text

    Measures citation fragility in AI search, demonstrating that ordinary public posts can enter citations and answers.

    arXiv
    2610.11932
    Published
    Layer
    Application layer
    Setting
    LLM applications
    Evaluated models
    Grok, Doubao, ChatGPT and others10

    AbstractThe authors claim the paper quantifies vulnerabilities in AI search caused by citation preferences and low posting thresholds; tests show public web posts can penetrate AI citations, and they call for auditing the citation supply chain.

    Paper analysisRead analysis
  4. DefensesarXiv 2610.03089

    COBRA: A Dual-LLM Architecture for Defending Computer-Using Agents Against Branch-Jumping Attacks

    提出 COBRA 双 LLM 架构，防御计算机使用 Agent 的分支转向攻击

    arXiv
    2610.03089
    Published
    Layer
    Application layer
    Setting
    Browser and computer use
    Evaluated models
    gpt-5, UI-TARS-1.5-7B, claude-sonnet-5 and others6

    Abstract提出分支转向防御架构 COBRA，通过事前能力约束与边界代理消除分支转向攻击并兼顾效用。

    Paper analysisRead analysis
  5. DefensesarXiv 2610.02569

    Pincer：用数字分身学习用户偏好并执行动态最小权限

    为 Agent 提出资源层授权系统 Pincer，用数字分身执行动态最小权限

    arXiv
    2610.02569
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    Claude Haiku 4.5, Muse Spark 1.2 Contributor
    AbstractPincer 在资源层以三票合取做授权。

    Pincer 是加在现成 coding agent 上的资源层授权防御：用只受用户侧信息影响的 digital twin 做动态最小权限，并与 tool-call 层防御并存。要处理的是用户维护策略带来的权限蠕变和授权疲劳，以及不学习用户策略的 tool-call 分类器。作者引述工作称 auto mode 会放行多数不安全操作，并认为推理代码或复杂 shell 的效果在这一层不实际。

    Paper analysisRead analysis
  7. DefensesarXiv 2609.35659

    Tracekit：面向自主编码 Agent 的防篡改意图-推理-动作审计系统

    提出 Tracekit，审计编码 Agent 的意图、推理与动作并检测账本篡改

    arXiv
    2609.35659
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    Claude Code (claude -p, version 2.1), 独立评审（同一 CLI，无工具）
    AbstractTracekit 把意图、自述和动作写入可锚定的哈希链。

    Tracekit 是无第三方依赖的编码智能体审计层：把人类请求、模型自述和已执行动作并排写入可外部锚定的哈希链，执行前用正则门，事后用规则和独立模型互查。

    Paper analysisRead analysis
  9. DefensesarXiv 2609.31282

    基于区块链的 Agentic AI 框架：面向安全软件供应链的资源优化与能耗感知

    提出 AttestChain，将供应链安全智能体报告签名上链并据此控制发布

    arXiv
    2609.31282
    Published
    Layer
    Application layer
    Setting
    Multi-agent systems
    Evaluated models
    GPT-class LLM
    AbstractAttestChain 将智能体报告与链上发布门控结合，现有证据来自受控合成构建的总体结果。

    AttestChain 是一个把 LLM 安全检查、智能体身份验证和许可链发布策略连接起来的软件供应链防御框架。。

    Paper analysisRead analysis
  11. DefensesarXiv 2609.05901

    KITA：为 LLM Agent 设计密钥隔离的阈值签名授权架构

    提出 KITA，把 Agent 批准绑定到规范动作的密钥隔离阈值签名

    arXiv
    2609.05901
    Published
    Layer
    Application layer
    Setting
    AI Agent
    AbstractKITA 把隔离的阈值签名当作精确动作的执行条件，并测量门控、相关性与签名开销。

    KITA 是一套密钥隔离的阈值授权架构，用来把模型评审变成执行外部动作的条件。

    Paper analysisRead analysis
  12. AttacksarXiv 2609.02774

    CodePoisonRAG：针对检索增强代码生成的知识投毒攻击

    提出 CodePoisonRAG，对检索增强代码生成的知识库投毒以植入漏洞

    arXiv
    2609.02774
    Published
    Layer
    Application layer
    Setting
    LLM applications
    Evaluated models
    Qwen 3.5 9B, Code Llama 13B, DeepSeek-Coder-V2 16B

    AbstractCodePoisonRAG 展示了 RACG 外部知识库的新攻击面，在较低投毒率下可定向诱发指定漏洞并部分抵御防御。

    Paper analysisRead analysis
  13. Evaluation and benchmarksarXiv 2609.02316

    Counter-GEO-Bench：现有护栏难挡 GEO 虚假信息

    构建 COUNTER-GEO-BENCH，评测生成式搜索中的 GEO 虚假信息防御

    arXiv
    2609.02316
    Published
    Layer
    Application layer
    Setting
    LLM applications
    Evaluated models
    Gemma-4-31B-IT, Qwen-3.5-35B-A3B, Llama-4-Scout-17B-16E and others8

    Abstract论文构建了针对 GEO 虚假信息的首个防御基准，揭示通用护栏的失效与反作用，并提出了有效的轻量对比检测基线。

    Paper analysisRead analysis
  16. AttacksarXiv 2608.04565

    Researchers propose Breadcrumbing long-range attack that can hijack the evidence chain of DeepResearch-style search agents

    提出权威链劫持与轨迹引导策略演化，劫持搜索 Agent 的证据链

    arXiv
    2608.04565
    Published
    Layer
    Application layer
    Setting
    web agent
    Evaluated models
    Qwen3.5-9B, Gemma4-31B, DeepResearch and others7

    Abstract论文揭示了多步搜索智能体在受限中间人操纵下的脆弱性，提出 ACH 策略与 TGSE 演化方法并完成系统验证。

    Paper analysisRead analysis
  17. DefensesarXiv 2607.13716

    CAVA：面向智能体 AI 运行时治理的规范动作验证与证明

    提出 CAVA，将异构智能体运行时事件规范为可哈希动作并绑定审批与回执

    arXiv
    2607.13716
    Published
    Layer
    Application layer
    Setting
    AI Agent
    AbstractCAVA 用规范动作指纹承接异构运行时治理。

    CAVA 是给异构智能体运行时用的动作语义层，用来回答“被批准和被审计的到底是哪一个动作”。

    Paper analysisRead analysis
  19. AttacksarXiv 2605.12673

    UC Berkeley proposes BenchJack, which automatically audits 10 agent benchmarks and finds 219 reward hacking defects.

    提出 BENCHJACK，审计 Agent 基准中的奖励作弊缺陷

    arXiv
    2605.12673
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Abstract论文系统揭示了智能体基准的奖励作弊隐患，提出自动化红队审计与迭代修补系统 BENCHJACK。

    论文系统研究了主流 AI 智能体基准评测中的奖励作弊问题，提出了首个针对基准缺陷的自动化红队审计与生成对抗式迭代修补系统 BENCHJACK。

    Paper analysisRead analysis
  20. DefensesarXiv 2603.12644

    Revealing security threats and defense architectures for autonomous agents: an OpenClaw case study

    Reviews threats to autonomous agents and proposes a full-lifecycle defense blueprint, FASA

    arXiv
    2603.12644
    Published
    Layer
    Application layer
    Setting
    AI Agent
    AbstractUsing OpenClaw as an example, it divides risks into three layers and uses FASA to describe defense from input to system execution.

    This is a threat review and defense architecture report using OpenClaw as a case study, not a scored attack or defense evaluation.

    Paper analysisRead analysis
Load more