Translation in progress Some entries still include text in the original language.

Oct 13 · Tuesday

All papers

Found 10 papers

Filter6

Attack type

Defense type

Inference-time intervention2 Detection and filtering13 Instruction–data separation8 Permissions and approval19 Monitoring and auditing16

Impact

Unauthorized actions5 Data and privacy leaks3

System type

LLM applications6 AI Agent54 coding agent6 science agent3 web agent6 Browser and computer use4 Multi-agent systems5 Embodied systems and robotics0

Attack surface / entry point

Tool responses3 Inter-agent messages5

Layer

Application layer10

System component

Permissions and sandboxing3

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 215papers have no tags yet and are not included in filtered results.

Defense type：Inference-time intervention Defense type：Instruction–data separation System type：coding agent System type：Multi-agent systems System type：Embodied systems and robotics Layer：Application layer Clear all

Another 215papers do not have category tags yet and are not included in filtered results.

DefensesarXiv 2610.05640Oct 5
Research reveals that the CaMeL defense fails in multi-agent systems and proposes multi-CaMeL
提出 multi-CaMeL，在智能体调用边界隔离可信指令与非可信数据
arXiv
2610.05640
Published
Oct 5
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
Claude Fable 5, GPT-5.5, GPT-4.1 and others6
- DefensesInstruction–data separation
- AttacksPrompt injection
Abstract论文针对多智能体中单体防御不组合的边界清洗问题，提出 multi-CaMeL 协议彻底阻断了 MultiAgentDojo 上的注入攻击。
Paper analysisRead analysis
Analysis and theoryarXiv 2610.04375Oct 3
Paper reveals that LLM agent tool calls are rewritten during execution paths, and proposes IntAct as a fix
提出 IEC 与 IntAct，测量并修复 Agent 工具调用的路径篡改
arXiv
2610.04375
Published
Oct 3
Layer
Application layer
Setting
coding agent
Evaluated models
qwen3-coder-plus, Qwen2.5-Coder-32B, Qwen2.5-72B and others4
- DefensesInstruction–data separation
- RiskDangerous agent actions
Abstract论文界定工具调用在执行路径中的意图偏离问题，提出无执行归因协议与跳级修复，为智能体工程提供评测与设计准则。
Paper analysisRead analysis
DefensesarXiv 2609.30824Sep 25
基于加密绑定身份验证能力令牌协调分布式 AI 智能体的提案
提出身份绑定且委托只衰减的能力令牌，用上下文外钱包约束智能体
arXiv
2609.30824
Published
Sep 25
Layer
Application layer
Setting
Multi-agent systems
- DefensesPermissions and approval
- AttacksPrompt injection
- ComponentPermissions and sandboxing
Abstract用只衰减的身份绑定令牌和上下文外钱包，约束代表人类行动的分布式智能体。
代表人类行动的分布式智能体，需要一种不把密钥放进语言模型上下文的授权方式。
Paper analysisRead analysis
DefensesarXiv 2609.22949Sep 19
多智能体系统提示注入威胁模型与防御架构：14 类攻击向量与四类防御
提出多智能体系统提示注入的威胁模型与四层架构防御
arXiv
2609.22949
Published
Sep 19
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
GPT-4o (2024-08-06), Claude 3.5 Sonnet, Llama 3 70B-Instruct
- DefensesInstruction–data separation
- AttacksPrompt injection
- ComponentPermissions and sandboxing
Paper analysisRead analysis
DefensesarXiv 2609.19587Sep 17
红队测试 Auto Mode：用注入与多上下文攻击绕过编码 Agent 阻断监控器
提出 Auto Mode ++，加固编码 Agent 阻断监视器
arXiv
2609.19587
Published
Sep 17
Layer
Application layer
Setting
coding agent
Evaluated models
Opus 5, Opus 4.8, Opus 4.7 and others8
- DefensesMonitoring and auditing
- RiskDeception and scheming
- ComponentMonitors
Abstract系统评估生产阻断监视器在面对持续恶意智能体时的表现，提出加固防御并指明多上下文防御挑战。
Paper analysisRead analysis
DefensesarXiv 2609.01487Sep 2
Defense-as-Skill：为技能增强型 Agent 演化运行时护栏技能
提出 SkillSonar，把运行时防护做成可演化技能以拦截恶意技能
arXiv
2609.01487
Published
Sep 2
Layer
Application layer
Setting
coding agent
Evaluated models
GLM-5, GPT-5.4, Claude Haiku 4.5 and others4
- DefensesInstruction–data separation
- AttacksPoisoning and backdoors
- ComponentMCP and skills
Paper analysisRead analysis
DefensesarXiv 2609.01677Sep 1
Skill-as-API：面向智能体软件工程的机密多智能体协作协议
提出 Skill-as-API，隔离多智能体协作中的 skill 正文与系统提示词
arXiv
2609.01677
Published
Sep 1
Layer
Application layer
Setting
Multi-agent systems, coding agent
- DefensesInstruction–data separation
- AttacksExtraction and theft
- ComponentMCP and skills
Abstract协议把 skill 正文留在所有者侧，四层限制发现内容、权限期限和注入拼接。
Skill-as-API 是面向智能体软件工程的协调协议，用来在跨组织调用时把 skill 的代码和系统提示词留在所有者进程。作者针对三条威胁：经通道或命名空间抽取专有方法，用注入让被调用模型输出系统提示词，以及协作结束后权限继续保留。
Paper analysisRead analysis
DefensesarXiv 2606.22673Jun 22
Agent MechSuits：面向多轮 CLI Agent 的机制子空间安全引导
提出 Agent MechSuits，对多轮 CLI Agent 做步级检测与子空间转向
arXiv
2606.22673
Published
Jun 22
Layer
Application layer
Setting
coding agent
Evaluated models
LLaMA-3.1-8B, Qwen-2.5-7B, Gemma-2-9B
- DefensesInference-time intervention
- AttacksMalicious use
- ComponentMonitors
Abstract白盒步级探针加稀疏转向可压低三模型恶意动作，同时提高生成崩溃率。
Agent MechSuits 是面向多轮 CLI 智能体的白盒、步级表示防御，并配有可执行轨迹基准 MAS。
Paper analysisRead analysis
DefensesarXiv 2606.08234Jun 6
SciTrace：面向科学发现智能体的轨迹感知安全推理框架
提出 SciTrace，为科学发现智能体加入跨阶段安全推理与工具轨迹核验
arXiv
2606.08234
Published
Jun 6
Layer
Application layer
Setting
science agent, Multi-agent systems
Evaluated models
Llama-3.1-70B-Instruct, Qwen2.5-72B-Instruct, DeepSeek-V3 and others4
- DefensesInference-time intervention
- AttacksPrompt injection
- RiskDangerous capabilities
- ComponentGuardrails and judges
AbstractSciTrace 把安全推理织入科学智能体各阶段，在 SciSafetyBench 上提高安全指标并保持输出质量。
SciTrace 是加在科学发现智能体流水线上的安全框架，不是再在各阶段出口放一个独立过滤器。
Paper analysisRead analysis
DefensesarXiv 2605.08382May 9
SecureForge 通过提示词优化发现并减少 LLM 生成代码漏洞
提出 SecureForge，在推理时优化系统提示以减少编码智能体的代码弱点
arXiv
2605.08382
Published
May 9
Layer
Application layer
Setting
coding agent
Evaluated models
Qwen 2.5 Coder 7B, Qwen 2.5 Coder 14B, Qwen3 30B-A3B and others10
- DefensesInstruction–data separation
AbstractSecureForge 审计良性 CWE 失败并优化系统提示词。
SecureForge是一条只用 API 和静态分析、在推理时加固编码模型的流水线。
Paper analysisRead analysis

You have reached the end

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop