Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 18 papers

Filter4

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 255papers have no tags yet and are not included in filtered results.

Attack surface / entry point：Web pages and interfaces Attack surface / entry point：Weights and gradients System component：RAG System component：Permissions and sandboxing Clear all

Another 255papers do not have category tags yet and are not included in filtered results.

AttacksarXiv 2610.11932Oct 8
A Fudan team measures the citation fragility of AI search: ordinary posts can enter citations and answer text
Measures citation fragility in AI search, demonstrating that ordinary public posts can enter citations and answers.
arXiv
2610.11932
Published
Oct 8
Layer
Application layer
Setting
LLM applications
Evaluated models
Grok, Doubao, ChatGPT and others10
- AttacksPoisoning and backdoors
- ComponentRAG
AbstractThe authors claim the paper quantifies vulnerabilities in AI search caused by citation preferences and low posting thresholds; tests show public web posts can penetrate AI citations, and they call for auditing the citation supply chain.
Paper analysisRead analysis
DefensesarXiv 2610.06966Oct 4
APEX: proactively defending against indirect prompt injection at the LLM agent execution boundary.
提出 APEX，在执行边界用授权契约防御 Agent 间接提示注入
arXiv
2610.06966
Published
Oct 4
Layer
Application layer
Setting
AI Agent
Evaluated models
DeepSeek-V4-Flash, GLM-5.2, GPT-5.6-sol
- DefensesInstruction–data separation
- AttacksPrompt injection
- ComponentPermissions and sandboxing
Paper analysisRead analysis
DefensesarXiv 2610.03089Oct 2
COBRA：为计算机使用 Agent 防御分支引导攻击的双 LLM 架构
提出 COBRA 双 LLM 架构，防御计算机使用 Agent 的分支转向攻击
arXiv
2610.03089
Published
Oct 2
Layer
Application layer
Setting
Browser and computer use
Evaluated models
gpt-5, UI-TARS-1.5-7B, claude-sonnet-5 and others6
- DefensesPermissions and approval
- AttacksPrompt injection
- ComponentPermissions and sandboxing
Abstract提出分支转向防御架构 COBRA，通过事前能力约束与边界代理消除分支转向攻击并兼顾效用。
Paper analysisRead analysis
DefensesarXiv 2609.37196Sep 29
ToolFence：为工具调用 LLM Agent 提供细粒度授权
提出 ToolFence，以能力蓝图和确定性授权拦截 Agent 未授权工具调用
arXiv
2609.37196
Published
Sep 29
Layer
Application layer
Setting
AI Agent
Evaluated models
Qwen3-max, GPT-4o (gpt-4o-2024-08-06), Mistral-Small-3.1-24B-Instruct-2503
- DefensesPermissions and approval
- AttacksPrompt injection
- ComponentPermissions and sandboxing
Paper analysisRead analysis
DefensesarXiv 2609.35659Sep 29
Tracekit：面向自主编码 Agent 的防篡改意图-推理-动作审计系统
提出 Tracekit，审计编码 Agent 的意图、推理与动作并检测账本篡改
arXiv
2609.35659
Published
Sep 29
Layer
Application layer
Setting
coding agent
Evaluated models
Claude Code (claude -p, version 2.1), 独立评审（同一 CLI，无工具）
- DefensesMonitoring and auditing
- AttacksPrompt injection
- RiskDangerous agent actions
- ComponentMonitors
AbstractTracekit 把意图、自述和动作写入可锚定的哈希链。
Tracekit 是无第三方依赖的编码智能体审计层：把人类请求、模型自述和已执行动作并排写入可外部锚定的哈希链，执行前用正则门，事后用规则和独立模型互查。
Paper analysisRead analysis
AttacksarXiv 2609.37468Sep 26
论文提出针对 Agentic RAG 的检索器后门攻击与 DOU 隐藏方法
提出检索器后门攻击操纵智能体搜索，并用 DOU 逃避检测
arXiv
2609.37468
Published
Sep 26
Layer
Application layer
Setting
AI Agent
Evaluated models
E5, Contriever-MSMARCO
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentRAG
Abstract论文展示了通过恶意检索器操纵智能体多轮搜索并利用诱饵重塑表征隐蔽后门的可行性与系统风险。
Paper analysisRead analysis
DefensesarXiv 2609.18411Sep 16
可验证行动卡片 VAC：为智能体浏览器提供可信人在回路确认
提出可验证操作卡 VAC，把智能体浏览器确认绑定到真实 DOM 操作
arXiv
2609.18411
Published
Sep 16
Layer
Application layer
Setting
web agent
Evaluated models
gpt-oss-120b, Gemini-2.5-Flash, GPT-4.1 and others6
- DefensesPermissions and approval
- AttacksPrompt injection
- ComponentPermissions and sandboxing
Paper analysisRead analysis
DefensesarXiv 2609.05901Sep 5
KITA：为 LLM Agent 设计密钥隔离的阈值签名授权架构
提出 KITA，把 Agent 批准绑定到规范动作的密钥隔离阈值签名
arXiv
2609.05901
Published
Sep 5
Layer
Application layer
Setting
AI Agent
- DefensesPermissions and approval
- AttacksPrompt injection
- ComponentPermissions and sandboxing
AbstractKITA 把隔离的阈值签名当作精确动作的执行条件，并测量门控、相关性与签名开销。
KITA 是一套密钥隔离的阈值授权架构，用来把模型评审变成执行外部动作的条件。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.02316Sep 2
Counter-GEO-Bench：现有护栏难挡 GEO 虚假信息
构建 COUNTER-GEO-BENCH，评测生成式搜索中的 GEO 虚假信息防御
arXiv
2609.02316
Published
Sep 2
Layer
Application layer
Setting
LLM applications
Evaluated models
Gemma-4-31B-IT, Qwen-3.5-35B-A3B, Llama-4-Scout-17B-16E and others8
- DefensesDetection and filtering
- AttacksPrompt injection
- ComponentRAG
Abstract论文构建了针对 GEO 虚假信息的首个防御基准，揭示通用护栏的失效与反作用，并提出了有效的轻量对比检测基线。
Paper analysisRead analysis
DefensesarXiv 2608.30041Aug 31
SkillGuard：面向间接提示注入的 LLM Agent 能力限制机制
提出 SkillGuard，用可达性限制污染后的 Agent 能力
arXiv
2608.30041
Published
Aug 31
Layer
Application layer
Setting
AI Agent
Evaluated models
Gemini 2.5 Flash, Llama3.3-70B
- DefensesPermissions and approval
- AttacksPrompt injection
- ComponentPermissions and sandboxing
Paper analysisRead analysis
DefensesarXiv 2608.22868Aug 24
AgentFlow：面向 LLM 智能体系统的流中心策略语言与运行时防护框架
提出 AgentFlow 流策略语言与运行时框架，约束智能体跨步数据流
arXiv
2608.22868
Published
Aug 24
Layer
Application layer
Setting
AI Agent
- DefensesInstruction–data separation
- AttacksPrompt injection
- ComponentPermissions and sandboxing
Paper analysisRead analysis
AttacksarXiv 2608.04565Aug 5
Researchers propose Breadcrumbing long-range attack that can hijack the evidence chain of DeepResearch-style search agents
提出权威链劫持与轨迹引导策略演化，劫持搜索 Agent 的证据链
arXiv
2608.04565
Published
Aug 5
Layer
Application layer
Setting
web agent
Evaluated models
Qwen3.5-9B, Gemma4-31B, DeepResearch and others7
- AttacksPrompt injection
- TechniqueAutomated search
- ComponentRAG
Abstract论文揭示了多步搜索智能体在受限中间人操纵下的脆弱性，提出 ACH 策略与 TGSE 演化方法并完成系统验证。
Paper analysisRead analysis
DefensesarXiv 2607.13716Jul 15
CAVA：面向智能体 AI 运行时治理的规范动作验证与证明
提出 CAVA，将异构智能体运行时事件规范为可哈希动作并绑定审批与回执
arXiv
2607.13716
Published
Jul 15
Layer
Application layer
Setting
AI Agent
- DefensesPermissions and approval
- AttacksDetection evasion
- RiskDangerous agent actions
- ComponentPermissions and sandboxing
AbstractCAVA 用规范动作指纹承接异构运行时治理。
CAVA 是给异构智能体运行时用的动作语义层，用来回答“被批准和被审计的到底是哪一个动作”。
Paper analysisRead analysis
DefensesarXiv 2607.08147Jul 9
Prismata: Restricting Cross-Site Prompt Injection in Web Agents
Proposes Prismata, which uses critical-path annotation and mechanical isolation to constrain cross-site prompt injection in web agents.
arXiv
2607.08147
Published
Jul 9
Layer
Application layer
Setting
web agent
Evaluated models
gpt-5.4-mini, gpt-5.4, gpt-5.4-nano and others7
- DefensesInstruction–data separation
- AttacksPrompt injection
- ComponentPermissions and sandboxing
Paper analysisRead analysis
DefensesarXiv 2603.12644Mar 13
揭示自主 Agent 的安全威胁与防御架构：OpenClaw 案例研究
梳理自主 Agent 威胁并提出全生命周期防御蓝图 FASA
arXiv
2603.12644
Published
Mar 13
Layer
Application layer
Setting
AI Agent
- DefensesInstruction–data separation
- AttacksPrompt injection
- ComponentPermissions and sandboxing
Abstract以 OpenClaw 为例划分三层风险，并用 FASA 描述从输入到系统执行的防御。
这是一份以 OpenClaw 为案例的威胁梳理和防御架构报告，不是带分数的攻击或防御评测。
Paper analysisRead analysis
DefensesarXiv 2603.11619Mar 12
驯服 OpenClaw：自主 LLM 智能体威胁的安全分析与缓解
提出对齐五阶段的纵深防御，缓解自主 Agent 跨阶段威胁
arXiv
2603.11619
Published
Mar 12
Layer
Application layer
Setting
AI Agent
- DefensesInstruction–data separation
- AttacksPrompt injection
- ComponentMCP and skills
Abstract这是对 OpenClaw 的生命周期威胁分析与分层缓解设计，案例为定性证据。
这是对 OpenClaw 的生命周期威胁分析，并配套一套分层缓解设计。要处理的问题是：自主智能体把即时通讯、持久记忆、第三方插件和高权限执行连在一起之后，攻击不再限于单轮越狱，而会跨初始化到执行的多个阶段复合。作者认为只加固单个接口的防御，挡不住这种跨时间攻击。
Paper analysisRead analysis
DefensesarXiv 2602.10915Feb 11
Blind Gods and Broken Screens: Building a Secure, Intent-Centric Mobile Agent Operating System
提出 Aura，用可信内核中介移动 Agent 的身份、感知与动作控制
arXiv
2602.10915
Published
Feb 11
Layer
Application layer
Setting
Browser and computer use
Evaluated models
Gemini-3-Flash
- DefensesInstruction–data separation
- AttacksPrompt injection
- ComponentPermissions and sandboxing
AbstractAura mediates structured interactions via the Agent Kernel.
Aura uses kernel-mediated structured agent interaction, replacing screen-interface mobile assistants..
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2601.10923Jan 16
Hidden-in-Plain-Text：面向社交网络 RAG 间接提示注入的基准
用 OpenRAG-Soc 评测社交网页 RAG 的间接提示注入与检索投毒
arXiv
2601.10923
Published
Jan 16
Layer
Application layer
Setting
LLM applications
Evaluated models
Llama-3-8B-Instruct, Mistral-7B-Instruct, Qwen2.5-14B and others8
- AttacksPrompt injection
- TechniqueEncoding and obfuscation
- ComponentRAG
Paper analysisRead analysis

You have reached the end

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop

All papers

Attack type

Defense type

Impact

System type

Attack surface / entry point

Layer

System component

A Fudan team measures the citation fragility of AI search: ordinary posts can enter citations and answer text

APEX: proactively defending against indirect prompt injection at the LLM agent execution boundary.

COBRA：为计算机使用 Agent 防御分支引导攻击的双 LLM 架构

ToolFence：为工具调用 LLM Agent 提供细粒度授权

Tracekit：面向自主编码 Agent 的防篡改意图-推理-动作审计系统

论文提出针对 Agentic RAG 的检索器后门攻击与 DOU 隐藏方法

可验证行动卡片 VAC：为智能体浏览器提供可信人在回路确认

KITA：为 LLM Agent 设计密钥隔离的阈值签名授权架构

Counter-GEO-Bench：现有护栏难挡 GEO 虚假信息

SkillGuard：面向间接提示注入的 LLM Agent 能力限制机制

AgentFlow：面向 LLM 智能体系统的流中心策略语言与运行时防护框架

Researchers propose Breadcrumbing long-range attack that can hijack the evidence chain of DeepResearch-style search agents

CAVA：面向智能体 AI 运行时治理的规范动作验证与证明

Prismata: Restricting Cross-Site Prompt Injection in Web Agents

揭示自主 Agent 的安全威胁与防御架构：OpenClaw 案例研究

驯服 OpenClaw：自主 LLM 智能体威胁的安全分析与缓解

Blind Gods and Broken Screens: Building a Secure, Intent-Centric Mobile Agent Operating System

Hidden-in-Plain-Text：面向社交网络 RAG 间接提示注入的基准