Skip to content

Translation in progress Some entries still include text in the original language.

Oct 13 · Tuesday

All papers

Found 7 papers
Filter4

Attack type

Prompt injection5

Attack technique

Reasoning-chain manipulation3

System type

AI Agent6

Attack surface / entry point

User input28Web pages and interfaces3Documents and messages3Tool responses4Code repositories and dependencies3Images, audio and video6Training data4

Layer

Application layer7

System component

MCP and skills22Memory29RAG10Guardrails and judges26Monitors18Reasoning chains7Permissions and sandboxing31Vision14Multimodal14
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 215papers have no tags yet and are not included in filtered results.
Attack surface / entry point：Web pages and interfacesAttack surface / entry point：Documents and messagesAttack surface / entry point：Tool responsesSystem component：Reasoning chainsClear all

Another 215papers do not have category tags yet and are not included in filtered results.

  1. DefensesarXiv 2609.35659

    Tracekit：面向自主编码 Agent 的防篡改意图-推理-动作审计系统

    提出 Tracekit，审计编码 Agent 的意图、推理与动作并检测账本篡改

    arXiv
    2609.35659
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    Claude Code (claude -p, version 2.1), 独立评审（同一 CLI，无工具）
    AbstractTracekit 把意图、自述和动作写入可锚定的哈希链。

    Tracekit 是无第三方依赖的编码智能体审计层：把人类请求、模型自述和已执行动作并排写入可外部锚定的哈希链，执行前用正则门，事后用规则和独立模型互查。

    Paper analysisRead analysis
  2. AttacksarXiv 2609.27542

    Researchers use control token injection to delete gpt-oss-20b's reasoning chain and bypass chain-of-thought monitoring

    提出控制标记注入，清空工具 Agent 的思维链以绕过推理监控

    arXiv
    2609.27542
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    openai/gpt-oss-20b, google/gemma-4-26B-A4B-it, deepseek-ai/DeepSeek-R1-Distill-Qwen-7B and others4

    Abstract论文阐明控制标记注入可抑制 CoT 使监控失效并促成拒绝绕过，且工具执行受解析器宽容度影响。

    Paper analysisRead analysis
  3. OtherarXiv 2609.12413

    SoK 综述：智能体 AI 时代的越狱攻击、防御与实践考量

    系统梳理智能体执行链路中的越狱攻击与防御并比较推理时防御

    arXiv
    2609.12413
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    Qwen3.5-4B, Llama-3.1-8B-Instruct
    AbstractSoK 将越狱重放到智能体流水线，并用两种模型检验回复层防御的边际与代价。

    Mia 等人把越狱安全从单轮回复扩展到智能体的规划、记忆、工具和智能体间通信，并问既有结论在更强原生对齐下是否还成立。

    Paper analysisRead analysis
  5. AttacksarXiv 2603.12277

    Prompt injection is role confusion

    提出 CoT Forgery，经用户消息或工具输出注入伪造推理

    arXiv
    2603.12277
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Attacker
    Black-box
    Evaluated models
    gpt-oss-20b, gpt-oss-120b, o4-mini and others11
    Abstract提示注入被作者解释为角色感知失败：听起来像某角色，就在表示里成为该角色。

    作者把提示注入解释成角色感知失败：标签划出的权限没有进入模型的内部几何。

    Paper analysisRead analysis
  6. AttacksarXiv 2602.18514

    招聘中的特洛伊木马：标准模型与推理模型间接提示注入的红队测试案例研究

    用简历中的不可见指令做间接提示注入，操纵招聘推荐

    arXiv
    2602.18514
    Published
    Layer
    Application layer
    Setting
    LLM applications
    Evaluated models
    Qwen 3 30B A3B Instruct 2507, Qwen 3 30B A3B Thinking 2507

    Abstract作者称推理在简单注入下会帮攻击圆谎，在不合逻辑的复杂注入下又会把欺骗漏出来。

    Paper analysisRead analysis
  7. AttacksarXiv 2406.12814

    论文提出 ARE 框架，在 VisualWebArena 上评估多模态 Agent 的对抗鲁棒性

    提出 ARE 框架与图像文本攻击，评测多模态网页 Agent 的对抗鲁棒性

    arXiv
    2406.12814
    Published
    Layer
    Application layer
    Setting
    web agent
    Evaluated models
    GPT-4o, GPT-4V, Claude-3-Opus and others4

    Abstract系统评估多模态网页智能体的脆弱性，指出推理时计算组件被攻破会加剧系统风险。

    Paper analysisRead analysis
You have reached the end