Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 215papers have no tags yet and are not included in filtered results.

Impact：Data and privacy leaks Impact：Availability and reliability System type：AI Agent System type：coding agent Attack surface / entry point：Tool and skill descriptions Clear all

Another 215papers do not have category tags yet and are not included in filtered results.

AttacksarXiv 2610.12524Oct 8
An exploration of attacks on AI agent systems
Retest and extend prompt injection against AI agents, and use Agent Card deception to manipulate A2A selection
arXiv
2610.12524
Published
Oct 8
Layer
Application layer
Setting
AI Agent
Evaluated models
Ollama Mistral 0.9.5, llama3-8b-8192, gemini-2.0-flash-lite and others5
- AttacksPrompt injection
- TechniqueEncoding and obfuscation
- ComponentMCP and skills
AbstractSingle-agent filtering and classification can be bypassed by format or wording, and A2A card selection is also biased toward names and descriptions.
The authors retested prompt injection on their own LangChain, AutoGen, and A2A systems, and modified the Agent Card to see if choices shifted. The abstract states the experiments mainly highlight single-agent weaknesses while extending attacks to multi-agent.
Paper analysisRead analysis
AttacksarXiv 2609.18217Sep 16
研究：跨通道碎片化攻击可绕过 MCP 单通道防御
提出跨通道分段攻击，利用 MCP 隐式信任外发敏感文件
arXiv
2609.18217
Published
Sep 16
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-4o, GPT-4o-mini, GPT-5.4 and others15
- AttacksPrompt injection
- TechniqueEncoding and obfuscation
- ComponentMCP and skills
Abstract论文揭示了 MCP 多通道隐式信任层级，通过跨通道分段与协议级利用突破现有防御，展示了严重的凭证外发风险。
Paper analysisRead analysis
DefensesarXiv 2609.01677Sep 1
Skill-as-API：面向智能体软件工程的机密多智能体协作协议
提出 Skill-as-API，隔离多智能体协作中的 skill 正文与系统提示词
arXiv
2609.01677
Published
Sep 1
Layer
Application layer
Setting
Multi-agent systems, coding agent
- DefensesInstruction–data separation
- AttacksExtraction and theft
- ComponentMCP and skills
Abstract协议把 skill 正文留在所有者侧，四层限制发现内容、权限期限和注入拼接。
Skill-as-API 是面向智能体软件工程的协调协议，用来在跨组织调用时把 skill 的代码和系统提示词留在所有者进程。作者针对三条威胁：经通道或命名空间抽取专有方法，用注入让被调用模型输出系统提示词，以及协作结束后权限继续保留。
Paper analysisRead analysis
AttacksarXiv 2608.27800Aug 28
ContextLeak：通过恶意工具窃取 LLM Agent 运行时上下文
提出 ContextLeak，用强化学习优化恶意工具描述，诱导 Agent 外泄运行时上下文
arXiv
2608.27800
Published
Aug 28
Layer
Application layer
Setting
AI Agent
Evaluated models
Qwen-3-8B, GPT-OSS-20B, Gemma-4-E4B-it and others11
- AttacksPrompt injection
- TechniqueSelection manipulation
- ComponentMCP and skills
Paper analysisRead analysis
AttacksarXiv 2608.25776Aug 26
EvoMal attack uses self-poisoning of self-evolving coding agents to achieve worm-like propagation
提出 EVOMAL，诱导自演化编码 Agent 在创建技能时自我投毒并蠕虫传播
arXiv
2608.25776
Published
Aug 26
Layer
Application layer
Setting
coding agent
Evaluated models
Devstral-Small-2, Gemma-4-31B-IT, Qwen3-Coder-Next and others7
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMCP and skills
Abstract论文指出了自演化智能体模仿检索代码的自我毒化漏洞，提出 EVOMAL 攻击与防御，阐明了供应链新风险。
Paper analysisRead analysis
DefensesarXiv 2608.24017Aug 25
WebMCP-Phalanx：为浏览器内 LLM Agent 工具调用建立信任边界
提出 WebMCP-Phalanx，用能力凭证与双智能体隔离浏览器工具调用
arXiv
2608.24017
Published
Aug 25
Layer
Application layer
Setting
web agent
- DefensesPermissions and approval
- AttacksPrompt injection
- ComponentMCP and skills
AbstractPhalanx 用浏览器凭证绑定工具所有权，Q/P 分离拦住描述注入，工具名与返回值仍有残留。
WebMCP-Phalanx针对浏览器里的 WebMCP 智能体：在 SOP 下补工具所有权，并把语义检查从有工具权的执行中分开。
Paper analysisRead analysis
DefensesarXiv 2608.22868Aug 24
AgentFlow：面向 LLM 智能体系统的流中心策略语言与运行时防护框架
提出 AgentFlow 流策略语言与运行时框架，约束智能体跨步数据流
arXiv
2608.22868
Published
Aug 24
Layer
Application layer
Setting
AI Agent
- DefensesInstruction–data separation
- AttacksPrompt injection
- ComponentPermissions and sandboxing
Paper analysisRead analysis
AttacksarXiv 2608.21929Aug 22
SkillBloat：通过技能注入对编码 Agent 发起 token 放大攻击
提出 SKILLBLOAT，改写技能文档放大编码 Agent token 消耗
arXiv
2608.21929
Published
Aug 22
Layer
Application layer
Setting
coding agent
Evaluated models
GLM-4.7-Flash, GLM-5, GPT-5.4 Mini and others4
- AttacksDenial of service
- TechniqueAutomated search
- ComponentMCP and skills
Paper analysisRead analysis
AttacksarXiv 2608.12273Aug 13
研究者提出 Convergent Detour Hijacking 攻击，可让技能型 LLM Agent 绕路并放大资源消耗
提出 CDH 攻击，让技能型 Agent 绕路放大资源消耗
arXiv
2608.12273
Published
Aug 13
Layer
Application layer
Setting
AI Agent
Evaluated models
Claude-Haiku-4.5, DeepSeek-V4-Pro, DeepSeek-V4-Flash and others6
- AttacksPrompt injection
- TechniqueSelection manipulation
- ComponentMCP and skills
AbstractCDH 让静态技能在保持任务完成时拉高调用与 token，耗时则因后端而异。
CDH 是针对渐进披露技能智能体的发布者侧、纯文本攻击：一个静态协调器把本可正确完成的任务，拐进有界但更耗资源的技能绕路，再交还原任务。
Paper analysisRead analysis
AttacksarXiv 2608.09577Aug 10
ElasticBack：通过触发词与规则耦合在 LLM Agent 技能中植入条件后门
提出 ElasticBack，在单个 Agent 技能中植入条件后门
arXiv
2608.09577
Published
Aug 10
Layer
Application layer
Setting
coding agent
Evaluated models
GLM-5.2, MiniMax-M3, GPT-5.4 and others4
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMCP and skills
AbstractElasticBack 用冻结规则加遗传搜索演化 trigger，在单 skill 上做条件后门。
ElasticBack 是放在 LLM agent 单个 skill 里的条件后门攻击。。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2606.15899Jun 15
SkillVetBench：用 LLM-as-Judge 评估开源 LLM Agent 技能的多维安全风险
提出 SkillVetBench 评估开源 Agent 技能的多维安全风险
arXiv
2606.15899
Published
Jun 15
Layer
Application layer
Setting
AI Agent
Evaluated models
Qwen2.5-14B-Instruct, Qwen2.5-32B, Llama-3.1-70B and others6
- AttacksPoisoning and backdoors
- ComponentMCP and skills
Abstract公开排行榜用 LLM-as-Judge 给技能分列 SARS 与 CVSS，并对照市场官方审查。
Paper analysisRead analysis
DefensesarXiv 2605.17380May 17
Uber proposes ADR enterprise-level agent detection system, deployed on 7,200 hosts for ten months
提出企业级检测系统 ADR，识别编程 Agent 的提示注入与恶意 MCP
arXiv
2605.17380
Published
May 17
Layer
Application layer
Setting
coding agent
- DefensesDetection and filtering
- AttacksPrompt injection
- ComponentMCP and skills
Abstract提出了端点因果遥测、两级在线分流与离线红队闭环的 ADR 系统，并在生产环境中验证了有效性。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2604.01438Apr 2
ClawSafety: Safe LLM, Unsafe Agent
提出 ClawSafety，评测个人智能体读到对抗工件后是否执行有害动作
arXiv
2604.01438
Published
Apr 2
Layer
Application layer
Setting
AI Agent
Evaluated models
Claude Sonnet 4.6, GPT-5.1, Gemini 2.5 Pro and others5
- AttacksPrompt injection
- ComponentMCP and skills
Paper analysisRead analysis
AttacksarXiv 2603.00902Mar 1
Clawdrain: covertly draining tokens in OpenClaw Agents via tool call chains
Propose Clawdrain, amplifying OpenClaw's token consumption with a trojan skill
arXiv
2603.00902
Published
Mar 1
Layer
Application layer
Setting
AI Agent
Evaluated models
Gemini 2.5 Pro
- AttacksDenial of service
- ComponentMCP and skills
Paper analysisRead analysis

You have reached the end

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop