Skip to content

Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 17 papers
Filter5

Attack type

Prompt injection13

Defense type

Model hardening4Inference-time intervention3Detection and filtering17Instruction–data separation17Permissions and approval24Monitoring and auditing19

Impact

Unauthorized actions12Data and privacy leaks4

System type

Models and APIs8LLM applications5AI Agent49coding agent5web agent6Browser and computer use3Multi-agent systems4

Attack surface / entry point

Web pages and interfaces9Tool responses5Tool and skill descriptions4Inter-agent messages4

Layer

Application layer17

System component

MCP and skills4Permissions and sandboxing8
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 230papers have no tags yet and are not included in filtered results.
Defense type：Instruction–data separationSystem type：coding agentSystem type：web agentSystem type：Browser and computer useSystem type：Multi-agent systemsClear all

Another 230papers do not have category tags yet and are not included in filtered results.

  1. DefensesarXiv 2610.09469

    Secure-CUA: Constraining the Impact of Untrusted Content in Computer-Use Agents

    提出 Secure-CUA，用动作事务约束计算机使用智能体的不可信影响

    arXiv
    2610.09469
    Published
    Layer
    Application layer
    Setting
    web agent
    Evaluated models
    Claude Opus 5, Gemini 3.8 Flash, GPT-5.6-Sol
    AbstractSecure-CUA 用每步事务约束不可信影响，良性 TSR 接近 Vanilla-CUA。

    Secure-CUA 要限制图形界面里不可信内容对 CUA 决策和 GUI 执行的影响，同时保留合法任务所需的不可信信息。

    Paper analysisRead analysis
  2. DefensesarXiv 2610.05640

    Research reveals that the CaMeL defense fails in multi-agent systems and proposes multi-CaMeL

    提出 multi-CaMeL，在智能体调用边界隔离可信指令与非可信数据

    arXiv
    2610.05640
    Published
    Layer
    Application layer
    Setting
    Multi-agent systems
    Evaluated models
    Claude Fable 5, GPT-5.5, GPT-4.1 and others6

    Abstract论文针对多智能体中单体防御不组合的边界清洗问题，提出 multi-CaMeL 协议彻底阻断了 MultiAgentDojo 上的注入攻击。

    Paper analysisRead analysis
  3. Analysis and theoryarXiv 2610.04375

    Paper reveals that LLM agent tool calls are rewritten during execution paths, and proposes IntAct as a fix

    提出 IEC 与 IntAct，测量并修复 Agent 工具调用的路径篡改

    arXiv
    2610.04375
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    qwen3-coder-plus, Qwen2.5-Coder-32B, Qwen2.5-72B and others4

    Abstract论文界定工具调用在执行路径中的意图偏离问题，提出无执行归因协议与跳级修复，为智能体工程提供评测与设计准则。

    Paper analysisRead analysis
  4. DefensesarXiv 2610.03089

    COBRA: A Dual-LLM Architecture for Defending Computer-Using Agents Against Branch-Jumping Attacks

    提出 COBRA 双 LLM 架构，防御计算机使用 Agent 的分支转向攻击

    arXiv
    2610.03089
    Published
    Layer
    Application layer
    Setting
    Browser and computer use
    Evaluated models
    gpt-5, UI-TARS-1.5-7B, claude-sonnet-5 and others6

    Abstract提出分支转向防御架构 COBRA，通过事前能力约束与边界代理消除分支转向攻击并兼顾效用。

    Paper analysisRead analysis
  6. DefensesarXiv 2609.30824

    基于加密绑定身份验证能力令牌协调分布式 AI 智能体的提案

    提出身份绑定且委托只衰减的能力令牌，用上下文外钱包约束智能体

    arXiv
    2609.30824
    Published
    Layer
    Application layer
    Setting
    Multi-agent systems
    Abstract用只衰减的身份绑定令牌和上下文外钱包，约束代表人类行动的分布式智能体。

    代表人类行动的分布式智能体，需要一种不把密钥放进语言模型上下文的授权方式。

    Paper analysisRead analysis
  8. DefensesarXiv 2609.19587

    红队测试 Auto Mode：用注入与多上下文攻击绕过编码 Agent 阻断监控器

    提出 Auto Mode ++，加固编码 Agent 阻断监视器

    arXiv
    2609.19587
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    Opus 5, Opus 4.8, Opus 4.7 and others8

    Abstract系统评估生产阻断监视器在面对持续恶意智能体时的表现，提出加固防御并指明多上下文防御挑战。

    Paper analysisRead analysis
  11. DefensesarXiv 2609.01677

    Skill-as-API：面向智能体软件工程的机密多智能体协作协议

    提出 Skill-as-API，隔离多智能体协作中的 skill 正文与系统提示词

    arXiv
    2609.01677
    Published
    Layer
    Application layer
    Setting
    Multi-agent systems, coding agent
    Abstract协议把 skill 正文留在所有者侧，四层限制发现内容、权限期限和注入拼接。

    Skill-as-API 是面向智能体软件工程的协调协议，用来在跨组织调用时把 skill 的代码和系统提示词留在所有者进程。作者针对三条威胁：经通道或命名空间抽取专有方法，用注入让被调用模型输出系统提示词，以及协作结束后权限继续保留。

    Paper analysisRead analysis
  12. DefensesarXiv 2608.24017

    WebMCP-Phalanx：为浏览器内 LLM Agent 工具调用建立信任边界

    提出 WebMCP-Phalanx，用能力凭证与双智能体隔离浏览器工具调用

    arXiv
    2608.24017
    Published
    Layer
    Application layer
    Setting
    web agent
    AbstractPhalanx 用浏览器凭证绑定工具所有权，Q/P 分离拦住描述注入，工具名与返回值仍有残留。

    WebMCP-Phalanx针对浏览器里的 WebMCP 智能体：在 SOP 下补工具所有权，并把语义检查从有工具权的执行中分开。

    Paper analysisRead analysis
  15. DefensesarXiv 2605.08382

    SecureForge 通过提示词优化发现并减少 LLM 生成代码漏洞

    提出 SecureForge，在推理时优化系统提示以减少编码智能体的代码弱点

    arXiv
    2605.08382
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    Qwen 2.5 Coder 7B, Qwen 2.5 Coder 14B, Qwen3 30B-A3B and others10
    AbstractSecureForge 审计良性 CWE 失败并优化系统提示词。

    SecureForge是一条只用 API 和静态分析、在推理时加固编码模型的流水线。

    Paper analysisRead analysis
  16. DefensesarXiv 2602.10915

    Blind Gods and Broken Screens: Building a Secure, Intent-Centric Mobile Agent Operating System

    提出 Aura，用可信内核中介移动 Agent 的身份、感知与动作控制

    arXiv
    2602.10915
    Published
    Layer
    Application layer
    Setting
    Browser and computer use
    Evaluated models
    Gemini-3-Flash
    AbstractAura mediates structured interactions via the Agent Kernel.

    Aura uses kernel-mediated structured agent interaction, replacing screen-interface mobile assistants..

    Paper analysisRead analysis
You have reached the end