Skip to content

Translation in progress Some entries still include text in the original language.

Oct 13 · Tuesday

All papers

Found 5 papers
Filter5

Attack type

Prompt injection4

Attack technique

Reasoning-chain manipulation3

System type

AI Agent5

Attack surface / entry point

User input3Web pages and interfaces3Documents and messages3Tool responses4Memory writes2Weights and gradients0

Layer

Application layer5

System component

MCP and skills21Memory48RAG5Guardrails and judges12Monitors14Reasoning chains5Permissions and sandboxing29Fine-tuning and open weights3
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 203papers have no tags yet and are not included in filtered results.
Attack surface / entry point：Tool responsesAttack surface / entry point：Memory writesAttack surface / entry point：Weights and gradientsLayer：Application layerSystem component：Reasoning chainsClear all

Another 203papers do not have category tags yet and are not included in filtered results.

  1. DefensesarXiv 2609.35659

    Tracekit: A tamper-proof intent-reasoning-action audit system for autonomous coding agents

    提出 Tracekit，审计编码 Agent 的意图、推理与动作并检测账本篡改

    arXiv
    2609.35659
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    Claude Code (claude -p, version 2.1), 独立评审（同一 CLI，无工具）
    AbstractTracekit 把意图、自述和动作写入可锚定的哈希链。

    Tracekit 是无第三方依赖的编码智能体审计层：把人类请求、模型自述和已执行动作并排写入可外部锚定的哈希链，执行前用正则门，事后用规则和独立模型互查。

    Paper analysisRead analysis
  2. AttacksarXiv 2609.27542

    Researchers use control token injection to delete gpt-oss-20b's reasoning chain and bypass chain-of-thought monitoring

    提出控制标记注入，清空工具 Agent 的思维链以绕过推理监控

    arXiv
    2609.27542
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    openai/gpt-oss-20b, google/gemma-4-26B-A4B-it, deepseek-ai/DeepSeek-R1-Distill-Qwen-7B and others4

    Abstract论文阐明控制标记注入可抑制 CoT 使监控失效并促成拒绝绕过，且工具执行受解析器宽容度影响。

    Paper analysisRead analysis
  3. OtherarXiv 2609.12413

    SoK 综述：智能体 AI 时代的越狱攻击、防御与实践考量

    系统梳理智能体执行链路中的越狱攻击与防御并比较推理时防御

    arXiv
    2609.12413
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    Qwen3.5-4B, Llama-3.1-8B-Instruct
    AbstractSoK 将越狱重放到智能体流水线，并用两种模型检验回复层防御的边际与代价。

    Mia 等人把越狱安全从单轮回复扩展到智能体的规划、记忆、工具和智能体间通信，并问既有结论在更强原生对齐下是否还成立。

    Paper analysisRead analysis
  4. AttacksarXiv 2604.05549

    Stop obsessing over prompts: reasoning hijacking and constraint tightening for red-teaming LLM agents

    提出 JailAgent，不改用户提示，经推理劫持与记忆投毒操纵 Agent 动作

    arXiv
    2604.05549
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    GPT-3.5-turbo, GPT-4o, GPT-5 and others7
    AbstractJailAgent 不改提示词，用三阶段操纵推理与检索。

    JailAgent 是不修改用户原始提示词的 LLM 智能体红队框架。

    Paper analysisRead analysis
  5. AttacksarXiv 2603.12277

    Prompt injection is role confusion

    提出 CoT Forgery，经用户消息或工具输出注入伪造推理

    arXiv
    2603.12277
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Attacker
    Black-box
    Evaluated models
    gpt-oss-20b, gpt-oss-120b, o4-mini and others11
    Abstract提示注入被作者解释为角色感知失败：听起来像某角色，就在表示里成为该角色。

    作者把提示注入解释成角色感知失败：标签划出的权限没有进入模型的内部几何。

    Paper analysisRead analysis
You have reached the end