Translation in progress Some entries still include text in the original language.

Oct 13 · Tuesday

All papers

Found 7 papers

Filter6

Attack type

Prompt injection5

Attack technique

Reasoning-chain manipulation3

Impact

Unauthorized actions4

System type

AI Agent7 coding agent0

Attack surface / entry point

User input4 Web pages and interfaces11 Documents and messages5 Tool responses5 Memory writes2 Images, audio and video16

Layer

Application layer7

System component

MCP and skills14 Memory46 RAG3 Guardrails and judges8 Monitors8 Reasoning chains4 Permissions and sandboxing16 Vision3 Multimodal3

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 227papers have no tags yet and are not included in filtered results.

System type：AI Agent System type：coding agent Attack surface / entry point：Documents and messages Attack surface / entry point：Memory writes System component：Reasoning chains System component：Vision Clear all

Another 227papers do not have category tags yet and are not included in filtered results.

DefensesarXiv 2609.36121Sep 29
Render Before Reading：把不可信内容渲染成图像以防御提示注入
提出 Pictionary，将不可信文本渲染成图像以防御提示注入
arXiv
2609.36121
Published
Sep 29
Layer
Application layer
Setting
AI Agent
Evaluated models
Claude Opus 4.7, Claude Haiku 4.5, GPT-5.5 and others12
- DefensesInstruction–data separation
- AttacksPrompt injection
- ComponentVision
Paper analysisRead analysis
AttacksarXiv 2609.27542Sep 23
Researchers use control token injection to delete gpt-oss-20b's reasoning chain and bypass chain-of-thought monitoring
提出控制标记注入，清空工具 Agent 的思维链以绕过推理监控
arXiv
2609.27542
Published
Sep 23
Layer
Application layer
Setting
AI Agent
Evaluated models
openai/gpt-oss-20b, google/gemma-4-26B-A4B-it, deepseek-ai/DeepSeek-R1-Distill-Qwen-7B and others4
- AttacksPrompt injection
- TechniqueConversation structure manipulation
- ComponentReasoning chains
Abstract论文阐明控制标记注入可抑制 CoT 使监控失效并促成拒绝绕过，且工具执行受解析器宽容度影响。
Paper analysisRead analysis
OtherarXiv 2609.12413Sep 11
SoK 综述：智能体 AI 时代的越狱攻击、防御与实践考量
系统梳理智能体执行链路中的越狱攻击与防御并比较推理时防御
arXiv
2609.12413
Published
Sep 11
Layer
Application layer
Setting
AI Agent
Evaluated models
Qwen3.5-4B, Llama-3.1-8B-Instruct
- AttacksJailbreaks
- ComponentMemory
AbstractSoK 将越狱重放到智能体流水线，并用两种模型检验回复层防御的边际与代价。
Mia 等人把越狱安全从单轮回复扩展到智能体的规划、记忆、工具和智能体间通信，并问既有结论在更强原生对齐下是否还成立。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.09404Sep 9
MMPIBench：多模态提示注入对六种 Agent 框架的跨框架评测
用 MMPIBench 评测多模态提示注入对 Agent 框架的影响
arXiv
2609.09404
Published
Sep 9
Layer
Application layer
Setting
AI Agent
Evaluated models
Claude Opus 4.8, GPT-5.4, Gemini 3.1 Pro and others6
- AttacksPrompt injection
- TechniqueCross-modal payloads
- ComponentVision
Abstract论文提出 MMPIBench 评测多模态提示注入对智能体的影响，发现模型主导行为、尝试远超完成，音频通道缺乏防护。
Paper analysisRead analysis
AttacksarXiv 2606.14517Jun 12
Researchers disclose a reasoning-amplified denial-of-service attack against LLM agent guardrails
提出针对 Agent 护栏的推理扩展拒绝服务攻击
arXiv
2606.14517
Published
Jun 12
Layer
Application layer
Setting
AI Agent
Attacker
Black-box
Evaluated models
TS-Guard-8B, Qwen3.5-9B, DeepSeek-V3.2 and others11
- AttacksDenial of service
- TechniqueReasoning-chain manipulation
- ComponentGuardrails and judges
Paper analysisRead analysis
AttacksarXiv 2604.05549Apr 7
Stop obsessing over prompts: reasoning hijacking and constraint tightening for red-teaming LLM agents
提出 JailAgent，不改用户提示，经推理劫持与记忆投毒操纵 Agent 动作
arXiv
2604.05549
Published
Apr 7
Layer
Application layer
Setting
AI Agent
Evaluated models
GPT-3.5-turbo, GPT-4o, GPT-5 and others7
- AttacksPoisoning and backdoors
- TechniqueReasoning-chain manipulation
- ComponentMemory
AbstractJailAgent 不改提示词，用三阶段操纵推理与检索。
JailAgent 是不修改用户原始提示词的 LLM 智能体红队框架。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2510.01354Oct 2, 2025
WAInjectBench 系统评测网页 Agent 的提示注入检测方法
提出 WAInjectBench 评测网页 Agent 的提示注入检测
arXiv
2510.01354
Published
Oct 2, 2025
Layer
Application layer
Setting
web agent
Evaluated models
GPT-4o, Mistral-7B-Instruct-v0.1, Llama-Prompt-Guard-2-86M and others8
- DefensesDetection and filtering
- AttacksPrompt injection
- ComponentGuardrails and judges
AbstractWAInjectBench 比较网页智能体的提示注入检测：显式线索可被部分检出，隐蔽攻击大多漏检。
WAInjectBench 是网页智能体提示注入检测的基准。作者要看现有检测器能否发现这类攻击：攻击者改网页，使智能体执行目标动作，而不是用户任务。作者称这是首个此类综合基准。
Paper analysisRead analysis

You have reached the end

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop

All papers

Attack type

Attack technique

Impact

System type

Attack surface / entry point

Layer

System component

Render Before Reading：把不可信内容渲染成图像以防御提示注入

Researchers use control token injection to delete gpt-oss-20b's reasoning chain and bypass chain-of-thought monitoring

SoK 综述：智能体 AI 时代的越狱攻击、防御与实践考量

MMPIBench：多模态提示注入对六种 Agent 框架的跨框架评测

Researchers disclose a reasoning-amplified denial-of-service attack against LLM agent guardrails

Stop obsessing over prompts: reasoning hijacking and constraint tightening for red-teaming LLM agents

WAInjectBench 系统评测网页 Agent 的提示注入检测方法