Translation in progress Some entries still include text in the original language.

Oct 13 · Tuesday

All papers

Found 9 papers

Filter6

Attack type

Prompt injection7 Poisoning and backdoors4

Attack technique

Dormant triggers4

Impact

Unauthorized actions4

System type

LLM applications3 AI Agent9 coding agent1

Attack surface / entry point

User input8 Web pages and interfaces5 Documents and messages3 Tool responses6 Retrieval corpus5 Memory writes5

Layer

Application layer9

System component

MCP and skills12 Memory44 RAG4 Guardrails and judges7 Monitors6 Reasoning chains5 Permissions and sandboxing19 Vision9 Multimodal9

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 201papers have no tags yet and are not included in filtered results.

System type：AI Agent System type：coding agent Attack surface / entry point：Web pages and interfaces Attack surface / entry point：Memory writes System component：RAG System component：Reasoning chains Clear all

Another 201papers do not have category tags yet and are not included in filtered results.

DefensesarXiv 2609.35659Sep 29
Tracekit: A tamper-proof intent-reasoning-action audit system for autonomous coding agents
提出 Tracekit，审计编码 Agent 的意图、推理与动作并检测账本篡改
arXiv
2609.35659
Published
Sep 29
Layer
Application layer
Setting
coding agent
Evaluated models
Claude Code (claude -p, version 2.1), 独立评审（同一 CLI，无工具）
- DefensesMonitoring and auditing
- AttacksPrompt injection
- RiskDangerous agent actions
- ComponentMonitors
AbstractTracekit 把意图、自述和动作写入可锚定的哈希链。
Tracekit 是无第三方依赖的编码智能体审计层：把人类请求、模型自述和已执行动作并排写入可外部锚定的哈希链，执行前用正则门，事后用规则和独立模型互查。
Paper analysisRead analysis
OtherarXiv 2609.12413Sep 11
SoK 综述：智能体 AI 时代的越狱攻击、防御与实践考量
系统梳理智能体执行链路中的越狱攻击与防御并比较推理时防御
arXiv
2609.12413
Published
Sep 11
Layer
Application layer
Setting
AI Agent
Evaluated models
Qwen3.5-4B, Llama-3.1-8B-Instruct
- AttacksJailbreaks
- ComponentMemory
AbstractSoK 将越狱重放到智能体流水线，并用两种模型检验回复层防御的边际与代价。
Mia 等人把越狱安全从单轮回复扩展到智能体的规划、记忆、工具和智能体间通信，并问既有结论在更强原生对齐下是否还成立。
Paper analysisRead analysis
AttacksarXiv 2608.04565Aug 5
Researchers propose Breadcrumbing long-range attack that can hijack the evidence chain of DeepResearch-style search agents
提出权威链劫持与轨迹引导策略演化，劫持搜索 Agent 的证据链
arXiv
2608.04565
Published
Aug 5
Layer
Application layer
Setting
web agent
Evaluated models
Qwen3.5-9B, Gemma4-31B, DeepResearch and others7
- AttacksPrompt injection
- TechniqueAutomated search
- ComponentRAG
Abstract论文揭示了多步搜索智能体在受限中间人操纵下的脆弱性，提出 ACH 策略与 TGSE 演化方法并完成系统验证。
Paper analysisRead analysis
AttacksarXiv 2606.14517Jun 12
Researchers disclose a reasoning-amplified denial-of-service attack against LLM agent guardrails
提出针对 Agent 护栏的推理扩展拒绝服务攻击
arXiv
2606.14517
Published
Jun 12
Layer
Application layer
Setting
AI Agent
Attacker
Black-box
Evaluated models
TS-Guard-8B, Qwen3.5-9B, DeepSeek-V3.2 and others11
- AttacksDenial of service
- TechniqueReasoning-chain manipulation
- ComponentGuardrails and judges
Paper analysisRead analysis
AttacksarXiv 2604.05549Apr 7
Stop obsessing over prompts: reasoning hijacking and constraint tightening for red-teaming LLM agents
提出 JailAgent，不改用户提示，经推理劫持与记忆投毒操纵 Agent 动作
arXiv
2604.05549
Published
Apr 7
Layer
Application layer
Setting
AI Agent
Evaluated models
GPT-3.5-turbo, GPT-4o, GPT-5 and others7
- AttacksPoisoning and backdoors
- TechniqueReasoning-chain manipulation
- ComponentMemory
AbstractJailAgent 不改提示词，用三阶段操纵推理与检索。
JailAgent 是不修改用户原始提示词的 LLM 智能体红队框架。
Paper analysisRead analysis
AttacksarXiv 2603.17239Mar 18
LAAF: A Systematic Red-Teaming Method and Automated Attack Framework for LPCI Vulnerabilities in Agentic LLM Systems
Proposes LAAF, which automatically attacks LPCI vulnerabilities in agent systems in stages
arXiv
2603.17239
Published
Mar 18
Layer
Application layer
Setting
AI Agent
Evaluated models
gemini-2.0-flash-001, claude-3-haiku-20240307, meta-llama/llama-3.1-70b-instruct and others5
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMemory
AbstractLAAF does LPCI red teaming with taxonomy plus stage seeding.
The authors state that LAAF is an automated red-teaming framework built specifically for LPCI in agentic LLMs. The issue to address is that encoded, delayed, and conditionally triggered payloads can persist in memory or RAG and re-enter across sessions, whereas Garak and PyRIT do not use the previous round's breakthrough results to seed the next stage across the six stages.
Paper analysisRead analysis
AttacksarXiv 2602.15654Feb 17
Zombie Agent: Persistent Control of Self-Evolving LLM Agents via Self-Reinforcing Injection
提出 Zombie Agent 攻击，经网页间接注入将载荷写入长期记忆并跨会话触发
arXiv
2602.15654
Published
Feb 17
Layer
Application layer
Setting
AI Agent
Evaluated models
Gemini-2.5-Flash, GLM-4.7-Flash
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMemory
Abstract记忆写入把一次网页间接注入变成跨会话控制。
Zombie Agent 把自进化 LLM 智能体的跨会话记忆当成攻击面：攻击者只发布网页，良性任务读入后，正常记忆更新留下载荷，并在以后无关会话里触发未授权工具行为。
Paper analysisRead analysis
AttacksarXiv 2507.10457Jul 15, 2025
论文提出 LPCI：针对 Agent 逻辑层与持久记忆的提示控制注入攻击
提出 LPCI，把延迟条件载荷写入记忆与检索库以跨会话触发
arXiv
2507.10457
Published
Jul 15, 2025
Layer
Application layer
Setting
AI Agent
Evaluated models
ChatGPT, Claude, LLaMA3 and others8
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMemory
Abstract作者定义 LPCI。
作者把LPCI定义为针对智能体逻辑执行、记忆留存和工具集成的跨阶段漏洞类，而不是单次输入上的提示改写。
Paper analysisRead analysis
AttacksarXiv 2406.12814Jun 19, 2024
论文提出 ARE 框架，在 VisualWebArena 上评估多模态 Agent 的对抗鲁棒性
提出 ARE 框架与图像文本攻击，评测多模态网页 Agent 的对抗鲁棒性
arXiv
2406.12814
Published
Jun 19, 2024
Layer
Application layer
Setting
web agent
Evaluated models
GPT-4o, GPT-4V, Claude-3-Opus and others4
- AttacksPrompt injection
- TechniqueGradient and representation optimization
- ComponentVision
Abstract系统评估多模态网页智能体的脆弱性，指出推理时计算组件被攻破会加剧系统风险。
Paper analysisRead analysis

You have reached the end

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop