Translation in progress Some entries still include text in the original language.
Oct 12 · Monday
All papers Found 13 papers Another 240 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
提出 PyCache Trap，用字节码缓存替换绕过 Agent 技能扫描器
Published Oct 7
Evaluated models CISCO , HSS , AUDITOR and others8 Abstract 论文剖析智能体技能审查与执行脱节盲区，提出 PyCache Trap 攻击并构建基于可信复现的 EAV 防御。这篇论文研究了智能体技能（Agent Skills）安全扫描中的“审查–执行脱节”问题，并提出了对应的攻击验证与防御方案。
提出 CORSA，按任务簇优化技能注入的检索与执行
Published Oct 6
Evaluated models GPT-5.4 , DeepSeek-V4-Pro , Qwen3.8-27B and others5 提出 EviLLM，经账户指令或插件向代码生成流程注入漏洞
Published Oct 3
Evaluated models GPT-4o , Llama 3.2 (3B) 提出 A2A-TIBA，经 A2A 对等任务间接注入并植入常驻回调
Published Sep 30
Evaluated models MiniMax-M3 , deepseek-v4-pro , glm-5.3 and others8 Abstract A2A-TIBA 一次植入后绕过智能体，GDA 用四类结果定位防线，ELA-ITL 把信封标注列为第三层。A2A-TIBA 把间接提示注入和绕过放进 A2A：gray-box 攻击者已能投递任务，诱导目标部署常驻回调程序后，下令和外传不再经过智能体。
提出残余权限重放攻击，跨任务复用长期 Agent 的历史授权绕过确认
Published Sep 28
Evaluated models GPT-4.1 , Gemini-3.1-Flash-Lite , Qwen3-14B and others6 提出 SkillDRE，用预执行与运行时双阶段反馈演化恶意 Agent 技能
Published Sep 26
Evaluated models DeepSeek-V4-Pro , GLM-5.2 , Qwen3.5-397B-A17B and others4 提出跨通道分段攻击，利用 MCP 隐式信任外发敏感文件
Published Sep 16
Evaluated models GPT-4o , GPT-4o-mini , GPT-5.4 and others15 Abstract 论文揭示了 MCP 多通道隐式信任层级，通过跨通道分段与协议级利用突破现有防御，展示了严重的凭证外发风险。
提出隐蔽后门攻击 AKRASIA，在推理代码模型提示中植入触发器并伪装思维链
Published Sep 1
Evaluated models Claude-Sonnet-5 , GPT-5.5 , Gemini-3.5-flash and others7 Abstract 论文针对推理代码大模型提出了隐蔽推断期后门攻击 AKRASIA，揭示了模型思维链可被利用进行欺骗性伪装的安全隐患。
提出 EVOMAL，诱导自演化编码 Agent 在创建技能时自我投毒并蠕虫传播
Published Aug 26
Evaluated models Devstral-Small-2 , Gemma-4-31B-IT , Qwen3-Coder-Next and others7 Abstract 论文指出了自演化智能体模仿检索代码的自我毒化漏洞，提出 EVOMAL 攻击与防御，阐明了供应链新风险。
提出 ColluSkill，用跨技能组合绕过 Agent 技能扫描器
Published Aug 10
Evaluated models GPT-5.5 , DeepSeek-V4-Pro , GLM-5.2 Abstract 论文揭示了单技能孤立扫描的盲区，提出多技能链攻击 ColluSkill 与上下文防御 ChainGuard 并验证了有效性。
提出技能名称抢注攻击，利用 Agent 虚构技能名实施供应链劫持
Published Jul 14
Evaluated models GLM-4.5-Air , GPT-5.4-mini , Claude Sonnet 4.6 and others12 Abstract 研究证实智能体虚构技能名具有高发生率与可预测性，现有防御难以兼顾安全与效用，亟需注册表结构性防护。本研究系统揭示了大模型智能体技能推荐场景下的虚构技能名称安全风险，将其形式化为一种新型供应链抢注攻击。
提出工作流级越狱，让编程 Agent 在开发任务中写入有害示例
Published Jul 5
Evaluated models Claude Sonnet 4.6 , Claude Haiku 4.5 , Gemini 3.1 Pro and others4 Abstract 作者报告 Copilot 后端会在编码工作流中生成其在单轮条件下通常拒绝的有害答案。这是一项生产 IDE 编码智能体的工作流越狱研究 ，受测对象是 Copilot 的四个模型后端，而非评测流水线中的名义目标。
提出 TRACE 框架，用分解与可演化多轮策略诱导智能体执行有害工作流
Published May 29
Evaluated models Codex , Claude Code , GPT-5.5 and others6 You have reached the end