Skip to content

Translation in progress Some entries still include text in the original language.

Oct 13 · Tuesday

All papers

Found 8 papers
Filter5

Attack type

Prompt injection6Poisoning and backdoors5

Impact

Unauthorized actions3

System type

Models and APIs2LLM applications3AI Agent32coding agent6web agent3Multi-agent systems4Embodied systems and robotics0

Attack surface / entry point

User input66Documents and messages5Tool responses4Tool and skill descriptions5Code repositories and dependencies7Memory writes3Images, audio and video17Training data5Weights and gradients3Distribution channels6

Layer

Application layer6

System component

Monitors3
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 215papers have no tags yet and are not included in filtered results.
System type：Models and APIsSystem type：coding agentSystem type：Embodied systems and roboticsAttack surface / entry point：Documents and messagesAttack surface / entry point：Memory writesClear all

Another 215papers do not have category tags yet and are not included in filtered results.

  1. Evaluation and benchmarksarXiv 2609.36817

    pikit：面向间接提示注入研究与评测的可组合工具包

    构建可组合工具包 pikit，评测编码智能体的间接提示注入

    arXiv
    2609.36817
    Published
    Layer
    Application layer
    Setting
    coding agent
    Abstractpikit 提供组合式间接注入评测。

    pikit 是面向间接提示注入研究的组合式工具包，主要贡献是组织攻击、投递通道、防御和判定流程，而非提出新的攻击优化算法。

    Paper analysisRead analysis
  2. Evaluation and benchmarksarXiv 2609.32616

    Cave-Bench：虚假指控下 LLM 智能体最高 60.06% 的运行会破坏正确工作

    提出 CAVE-BENCH，评测智能体在虚假指责下破坏已完成的正确工作

    arXiv
    2609.32616
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    Claude-Sonnet-5, Claude-Opus-5, GPT-5.6-Sol and others14

    Abstract论文提出了评估智能体在虚假指责下破坏已有正确成果的 CAVE-BENCH，发现强模型易推翻已知证据，提出了门控缓解方案。

    Paper analysisRead analysis
  3. Evaluation and benchmarksarXiv 2609.28915

    研究提出 ACE 语料库，评估内核级证据对 Agent 安全检测的有效性

    构建 ACE 语料，评测内核级证据对 Agent 攻击检测的有效性

    arXiv
    2609.28915
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    AdaBoost, XGBoost, TabPFN and others10
    AbstractACE 用配对的内核与应用层证据表明，syscall 痕迹可判别智能体攻击，两层组合通常更好。

    ACE 是一份把智能体会话的内核 syscall 痕迹与应用层清单、转录配对起来的检测语料和基准。。

    Paper analysisRead analysis
  5. Evaluation and benchmarksarXiv 2607.24177

    EXE-Bench：为真实可用性对 AI Windows 恶意软件检测器进行权衡排名

    提出 EXE-Bench 比较 Windows 恶意软件检测器的可用性权衡

    arXiv
    2607.24177
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    EmberGBDT, BBDnn, BBDnnFDRS and others15
    Abstract统一四指标后，手工特征的 EmberGBDT 综合居首，只看准确率会误导部署。

    EXE-Bench 用同一设置给 AI Windows 恶意软件检测器做四指标排序，而不是只比一次测试集准确率。。

    Paper analysisRead analysis
  6. Evaluation and benchmarksarXiv 2607.14611

    论文评测 Claude Code 与 Codex 记忆文件中的提示注入风险

    评测编码 Agent 记忆文件中提示注入的跨会话影响

    arXiv
    2607.14611
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    Claude Haiku 4.5, Claude Opus 4.7, GPT-5.2 and others4
    Abstract已植入记忆文件的载荷可以跨会话影响 Claude Code 与 Codex，攻击成功与载荷是否留下是两种不同的失败。

    Bad Memory 在沙箱合成工作区里评测文件型持久记忆上的提示注入，比较载荷能否改变当前会话，以及能否在后续会话中留下或叠加。

    Paper analysisRead analysis
  7. Evaluation and benchmarksarXiv 2605.17380

    Uber proposes ADR enterprise-level agent detection system, deployed on 7,200 hosts for ten months

    提出企业级检测系统 ADR，识别编程 Agent 的提示注入与恶意 MCP

    arXiv
    2605.17380
    Published
    Layer
    Application layer
    Setting
    coding agent

    Abstract提出了端点因果遥测、两级在线分流与离线红队闭环的 ADR 系统，并在生产环境中验证了有效性。

    Paper analysisRead analysis
  8. Evaluation and benchmarksarXiv 2602.14161

    When benchmarks lie: evaluating malicious prompt classifiers under real-world distribution shift

    提出 LODO 评测恶意提示探针的跨数据集泛化

    arXiv
    2602.14161
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    Llama-3.1-8B-Instruct, Gemma-3-27B, Qwen-3.5-4B and others5
    Abstract作者称 LODO 露出 CV 高估，数据集身份与安全方向部分重叠，标准域泛化干预关不上。

    LODO 用来检查恶意提示词分类器换成没见过的数据集后，还剩多少检测能力。。

    Paper analysisRead analysis
You have reached the end