Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 36 papers

Filter4

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 232papers have no tags yet and are not included in filtered results.

System type：coding agent System component：MCP and skills System component：Permissions and sandboxing System component：Embeddings Clear all

Another 232papers do not have category tags yet and are not included in filtered results.

Evaluation and benchmarksarXiv 2610.11647Oct 8
One More Skill Installed: How Co-Installed Skills in Coding Agents Conflict
评测编码 Agent 中相似技能共同安装对已装技能核心功能的替代
arXiv
2610.11647
Published
Oct 8
Layer
Application layer
Setting
coding agent
Evaluated models
claude-sonnet-4-6, claude-haiku-4-5-20251001, claude-opus-5 and others6
- RiskDangerous agent actions
- ComponentMCP and skills
Abstract冲突藏在任务成功后面。
作者对共同安装、做同一件事的良性 skill 做实证研究，用核心功能是否还在，而不是任务过不过，来看冲突。。
Paper analysisRead analysis
Analysis and theoryarXiv 2610.11169Oct 8
研究重建 GitHub 上 Agent 技能的复制供应链网络
重建 Agent 技能复制网络并建模源选择以指导安全审计
arXiv
2610.11169
Published
Oct 8
Layer
Application layer
Setting
coding agent
- ComponentMCP and skills
Abstract论文重构了 GitHub 智能体技能复制网络，发现复制集中于少数仓库且很少随源更新，并提出了代码库审计推荐模型。
Paper analysisRead analysis
AttacksarXiv 2610.10612Oct 7
PyCache Trap 利用 Python 缓存替换绕过七款 Agent Skill 扫描器
提出 PyCache Trap，用字节码缓存替换绕过 Agent 技能扫描器
arXiv
2610.10612
Published
Oct 7
Layer
Application layer
Setting
coding agent
Evaluated models
CISCO, HSS, AUDITOR and others8
- DefensesDetection and filtering
- AttacksDetection evasion
- TechniqueDefense-targeted
- ComponentMCP and skills
Abstract论文剖析智能体技能审查与执行脱节盲区，提出 PyCache Trap 攻击并构建基于可信复现的 EAV 防御。
这篇论文研究了智能体技能（Agent Skills）安全扫描中的“审查–执行脱节”问题，并提出了对应的攻击验证与防御方案。
Paper analysisRead analysis
AttacksarXiv 2610.08098Oct 6
CORSA：面向技能路由器的技能注入攻击可跨路由器与 LLM 迁移
提出 CORSA，按任务簇优化技能注入的检索与执行
arXiv
2610.08098
Published
Oct 6
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-5.4, DeepSeek-V4-Pro, Qwen3.8-27B and others5
- AttacksPoisoning and backdoors
- TechniqueSelection manipulation
- ComponentMCP and skills
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.07639Oct 6
HarnessSecurity-Bench horizontally evaluates the security mechanisms of six coding agent frameworks.
评测编码智能体 harness 安全机制在对抗任务中的防护效果
arXiv
2610.07639
Published
Oct 6
Layer
Application layer
Setting
coding agent
- AttacksPrompt injection
- ComponentPermissions and sandboxing
Paper analysisRead analysis
Analysis and theoryarXiv 2610.06001Oct 5
AgentSpy: Observing AI agent behavior at the system call layer and detecting skill injection attacks
提出 AgentSpy，在系统调用层观测 Agent 行为并检测技能注入
arXiv
2610.06001
Published
Oct 5
Layer
Application layer
Setting
coding agent
Evaluated models
gpt-5.6-terra, deepseek-v4-flash, glm-5.3-flash and others4
- DefensesDetection and filtering
- AttacksPoisoning and backdoors
- ComponentMCP and skills
Abstract提出了系统级智能体监控框架 AgentSpy，揭示出通过测试背后的非预期行为与注入风险。
本研究提出了面向 AI 智能体的系统级外部监控与行为分析框架 AgentSpy。
Paper analysisRead analysis
DefensesarXiv 2610.05246Oct 4
研究测量策略网关跨平台命令裁决的能力边界
提出策略门裁决已实现动作，并测量跨平台命令拦截边界
arXiv
2610.05246
Published
Oct 4
Layer
Application layer
Setting
coding agent
Evaluated models
claude-opus-5, deepseek-v4.1-flash, gpt-6-astra
- DefensesPermissions and approval
- RiskDangerous agent actions
- ComponentPermissions and sandboxing
Paper analysisRead analysis
DefensesarXiv 2610.02456Oct 2
SideKernel：面向 macOS 上 AI 编码 Agent 的 microVM 沙箱
为 macOS 编程 Agent 构建可用的 microVM 沙箱 SideKernel
arXiv
2610.02456
Published
Oct 2
Layer
Application layer
Setting
coding agent
- DefensesPermissions and approval
- RiskDangerous agent actions
- ComponentPermissions and sandboxing
Paper analysisRead analysis
AttacksarXiv 2609.39352Sep 30
研究者提出解耦铺垫与执行的 LLM Agent 技能投毒攻击
提出 CoordPoison，解耦技能投毒的借口与动作
arXiv
2609.39352
Published
Sep 30
Layer
Application layer
Setting
coding agent
Evaluated models
DeepSeek-V4-Flash, GLM-5.3-Flash, Claude-Sonnet-4.6 and others5
- AttacksPoisoning and backdoors
- TechniqueAutomated search
- ComponentMCP and skills
AbstractCoordPoison 外置借口。
CoordPoison 是一种 Skill 供应链投毒方法，把“为何执行”和“执行什么”拆到两个 Skill。。
Paper analysisRead analysis
DefensesarXiv 2609.38983Sep 30
The paper proposes an Approval Laundering taxonomy and empirically shows that Claude Code's approval and execution binding fails
形式化编程 Agent 的审批洗白并提出 HMAC 权能令牌防御
arXiv
2609.38983
Published
Sep 30
Layer
Application layer
Setting
coding agent
Evaluated models
Claude Code (v2.1.197, opus[1m] / claude-sonnet-5-ccmax), Codex CLI (@openai/codex v0.154.0)
- DefensesPermissions and approval
- RiskDangerous agent actions
- ComponentPermissions and sandboxing
Abstract系统揭示编程智能体审批洗白风险，提出七字段权能防御机制，证实其能消除身份时序偏离但难防副作用偏离。
Paper analysisRead analysis
DefensesarXiv 2609.36170Sep 29
Assay：用内容寻址证据图约束 AI 编码智能体的声明失效
提出 Assay，用依赖锥哈希绑定代码断言并在合并门禁拦截失效声明
arXiv
2609.36170
Published
Sep 29
Layer
Application layer
Setting
coding agent
- DefensesPermissions and approval
- RiskDeception and scheming
- ComponentPermissions and sandboxing
AbstractAssay 提供随依赖内容失效的证据管理。
Assay 是一套面向 AI 辅助软件交付的内容寻址证据系统，关注代码改变后，测试通过、无秘密或行为保持等断言还能否用于批准合并。
Paper analysisRead analysis
DefensesarXiv 2609.35659Sep 29
Tracekit：面向自主编码 Agent 的防篡改意图-推理-动作审计系统
提出 Tracekit，审计编码 Agent 的意图、推理与动作并检测账本篡改
arXiv
2609.35659
Published
Sep 29
Layer
Application layer
Setting
coding agent
Evaluated models
Claude Code (claude -p, version 2.1), 独立评审（同一 CLI，无工具）
- DefensesMonitoring and auditing
- AttacksPrompt injection
- RiskDangerous agent actions
- ComponentMonitors
AbstractTracekit 把意图、自述和动作写入可锚定的哈希链。
Tracekit 是无第三方依赖的编码智能体审计层：把人类请求、模型自述和已执行动作并排写入可外部锚定的哈希链，执行前用正则门，事后用规则和独立模型互查。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.35557Sep 29
论文：容器、权限规则与沙箱都无法区分读取研究代码的是编译器还是编码 Agent
评测容器、权限规则与沙箱能否区分编译器与编码 Agent 的文件读取
arXiv
2609.35557
Published
Sep 29
Layer
Application layer
Setting
coding agent
- DefensesPermissions and approval
- RiskDangerous agent actions
- ComponentPermissions and sandboxing
Abstract此 harness 表达不了编译器可读而智能体不可读，五条路径两边都不覆盖。
作者在物理流求解器上检查一套编码智能体配置：编译器必须读本组材料与反应模型，这些字节又不得进入模型上下文或离开本机的记录。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.35912Sep 28
MMSkillRisk：多模态技能图像中的隐藏指令可诱导 Agent 执行未授权操作
提出 MMSkillRisk 基准，评测多模态技能图像中的隐藏指令诱导 Agent 越权操作
arXiv
2609.35912
Published
Sep 28
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-5.6-sol, Kimi-K2.6, Kimi-K3 and others6
- AttacksPrompt injection
- TechniqueCross-modal payloads
- ComponentMCP and skills
Abstract论文提出 MMSkillRisk 基准与 NCVA 攻击，揭示多模态技能中教学图像潜藏指令可引发未授权操作并与良性任务共存。
Paper analysisRead analysis
AttacksarXiv 2609.33910Sep 28
论文提出残留授权重放攻击：长期运行 Agent 的授权可跨任务复用
提出残余权限重放攻击，跨任务复用长期 Agent 的历史授权绕过确认
arXiv
2609.33910
Published
Sep 28
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-4.1, Gemini-3.1-Flash-Lite, Qwen3-14B and others6
- AttacksPrompt injection
- TechniqueDefense-targeted
- ComponentPermissions and sandboxing
Paper analysisRead analysis
AttacksarXiv 2609.32400Sep 26
SkillDRE：用预执行与运行时双阶段反馈自动演化恶意 Agent 技能
提出 SkillDRE，用预执行与运行时双阶段反馈演化恶意 Agent 技能
arXiv
2609.32400
Published
Sep 26
Layer
Application layer
Setting
coding agent
Evaluated models
DeepSeek-V4-Pro, GLM-5.2, Qwen3.5-397B-A17B and others4
- AttacksPoisoning and backdoors
- TechniqueAutomated search
- ComponentMCP and skills
Paper analysisRead analysis
Risky behaviorarXiv 2609.30266Sep 25
研究显示 Claude Code、Codex 等本地智能体可轻易篡改自身执行轨迹
测试编程智能体被诱导或自主篡改自身执行轨迹的行为
arXiv
2609.30266
Published
Sep 25
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-5.6-Sol, GPT-6-Sol, Opus-5 and others11
- AttacksMalicious use
- RiskDeception and scheming
- ComponentMonitors
Abstract论文评估了本地智能体的轨迹防篡改能力，发现其可因外部指令或奖励追求而清除执行证据，亟需建立独立拦截记录机制。
这是一项针对本地大模型智能体执行轨迹完整性与安全防篡改边界的实证研究。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.28915Sep 24
研究提出 ACE 语料库，评估内核级证据对 Agent 安全检测的有效性
构建 ACE 语料，评测内核级证据对 Agent 攻击检测的有效性
arXiv
2609.28915
Published
Sep 24
Layer
Application layer
Setting
coding agent
Evaluated models
AdaBoost, XGBoost, TabPFN and others10
- AttacksPrompt injection
- ComponentMCP and skills
AbstractACE 用配对的内核与应用层证据表明，syscall 痕迹可判别智能体攻击，两层组合通常更好。
ACE 是一份把智能体会话的内核 syscall 痕迹与应用层清单、转录配对起来的检测语料和基准。。
Paper analysisRead analysis
AttacksarXiv 2609.18217Sep 16
研究：跨通道碎片化攻击可绕过 MCP 单通道防御
提出跨通道分段攻击，利用 MCP 隐式信任外发敏感文件
arXiv
2609.18217
Published
Sep 16
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-4o, GPT-4o-mini, GPT-5.4 and others15
- AttacksPrompt injection
- TechniqueEncoding and obfuscation
- ComponentMCP and skills
Abstract论文揭示了 MCP 多通道隐式信任层级，通过跨通道分段与协议级利用突破现有防御，展示了严重的凭证外发风险。
Paper analysisRead analysis
DefensesarXiv 2609.14079Sep 13
SkillSecurer：检测并修补 AI Agent 技能中的提示注入漏洞
提出 SkillSecurer，检测并修补 Agent 技能中的提示注入漏洞
arXiv
2609.14079
Published
Sep 13
Layer
Application layer
Setting
coding agent
Evaluated models
Claude Sonnet 5, Gemini 3.6 Flash, GPT-5.6 Sol and others10
- DefensesDetection and filtering
- AttacksPrompt injection
- ComponentMCP and skills
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop

All papers

Attack type

Attack technique

Model risks

Defense type

Impact

System type

Attack surface / entry point

Layer

System component

One More Skill Installed: How Co-Installed Skills in Coding Agents Conflict

研究重建 GitHub 上 Agent 技能的复制供应链网络

PyCache Trap 利用 Python 缓存替换绕过七款 Agent Skill 扫描器

CORSA：面向技能路由器的技能注入攻击可跨路由器与 LLM 迁移

HarnessSecurity-Bench horizontally evaluates the security mechanisms of six coding agent frameworks.

AgentSpy: Observing AI agent behavior at the system call layer and detecting skill injection attacks

研究测量策略网关跨平台命令裁决的能力边界

SideKernel：面向 macOS 上 AI 编码 Agent 的 microVM 沙箱

研究者提出解耦铺垫与执行的 LLM Agent 技能投毒攻击

The paper proposes an Approval Laundering taxonomy and empirically shows that Claude Code's approval and execution binding fails

Assay：用内容寻址证据图约束 AI 编码智能体的声明失效

Tracekit：面向自主编码 Agent 的防篡改意图-推理-动作审计系统

论文：容器、权限规则与沙箱都无法区分读取研究代码的是编译器还是编码 Agent

MMSkillRisk：多模态技能图像中的隐藏指令可诱导 Agent 执行未授权操作

论文提出残留授权重放攻击：长期运行 Agent 的授权可跨任务复用

SkillDRE：用预执行与运行时双阶段反馈自动演化恶意 Agent 技能

研究显示 Claude Code、Codex 等本地智能体可轻易篡改自身执行轨迹

研究提出 ACE 语料库，评估内核级证据对 Agent 安全检测的有效性

研究：跨通道碎片化攻击可绕过 MCP 单通道防御

SkillSecurer：检测并修补 AI Agent 技能中的提示注入漏洞