Skip to content

Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 10 papers
Filter5

Attack type

Prompt injection7Poisoning and backdoors7

Attack technique

Gradient and representation optimization10Automated search17Encoding and obfuscation7Cross-modal payloads8Defense-targeted8Dormant triggers13Selection manipulation3

Impact

Unauthorized actions8

System type

Models and APIs44LLM applications8AI Agent26coding agent9web agent0Embodied systems and robotics1

Attack surface / entry point

Tool and skill descriptions7Distribution channels8

Layer

Application layer10

System component

MCP and skills8
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 248papers have no tags yet and are not included in filtered results.
Attack technique：Encoding and obfuscationAttack technique：Selection manipulationSystem type：coding agentSystem type：web agentSystem type：Embodied systems and roboticsClear all

Another 248papers do not have category tags yet and are not included in filtered results.

  2. Evaluation and benchmarksarXiv 2609.35912

    MMSkillRisk：多模态技能图像中的隐藏指令可诱导 Agent 执行未授权操作

    提出 MMSkillRisk 基准，评测多模态技能图像中的隐藏指令诱导 Agent 越权操作

    arXiv
    2609.35912
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    GPT-5.6-sol, Kimi-K2.6, Kimi-K3 and others6

    Abstract论文提出 MMSkillRisk 基准与 NCVA 攻击，揭示多模态技能中教学图像潜藏指令可引发未授权操作并与良性任务共存。

    Paper analysisRead analysis
  3. AttacksarXiv 2609.18217

    研究：跨通道碎片化攻击可绕过 MCP 单通道防御

    提出跨通道分段攻击，利用 MCP 隐式信任外发敏感文件

    arXiv
    2609.18217
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    GPT-4o, GPT-4o-mini, GPT-5.4 and others15

    Abstract论文揭示了 MCP 多通道隐式信任层级，通过跨通道分段与协议级利用突破现有防御，展示了严重的凭证外发风险。

    Paper analysisRead analysis
  4. AttacksarXiv 2608.25776

    EvoMal attack uses self-poisoning of self-evolving coding agents to achieve worm-like propagation

    提出 EVOMAL，诱导自演化编码 Agent 在创建技能时自我投毒并蠕虫传播

    arXiv
    2608.25776
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    Devstral-Small-2, Gemma-4-31B-IT, Qwen3-Coder-Next and others7

    Abstract论文指出了自演化智能体模仿检索代码的自我毒化漏洞，提出 EVOMAL 攻击与防御，阐明了供应链新风险。

    Paper analysisRead analysis
  5. AttacksarXiv 2608.06862

    SynChain：诱导计算机使用 Agent 自建攻击链并跨任务持久化

    提出 SYNCHAIN，诱导计算机使用 Agent 自建跨任务持久攻击链

    arXiv
    2608.06862
    Published
    Layer
    Application layer
    Setting
    Browser and computer use, coding agent
    Evaluated models
    Qwen3.5-9B, Llama-3.1-8B, Ministral-3-8B

    Abstract论文揭示了 CUA 自合成工件带来的内部供应链威胁，验证了潜伏载荷的跨任务传播能力与防御局限。

    Paper analysisRead analysis
  6. AttacksarXiv 2607.12340

    Research: LLM agent skill-name hallucination rates reach up to 62%, which can be exploited via squatting for supply-chain attacks

    提出技能名称抢注攻击，利用 Agent 虚构技能名实施供应链劫持

    arXiv
    2607.12340
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    GLM-4.5-Air, GPT-5.4-mini, Claude Sonnet 4.6 and others12
    Abstract研究证实智能体虚构技能名具有高发生率与可预测性，现有防御难以兼顾安全与效用，亟需注册表结构性防护。

    本研究系统揭示了大模型智能体技能推荐场景下的虚构技能名称安全风险，将其形式化为一种新型供应链抢注攻击。

    Paper analysisRead analysis
  7. AttacksarXiv 2604.03081

    Supply Chain Poisoning Attacks on the LLM Coding Agent Skill Ecosystem

    提出 PoisonedSkills，评测编码 Agent 技能生态的文档投毒

    arXiv
    2604.03081
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    Claude Sonnet 4.6, GLM-4.7, MiniMax-M2.5 and others5
    Abstract作者称技能文档可成为系统操作攻击入口，但结果只评估加载后的阶段。

    PoisonedSkills 研究编码智能体的技能供应链投毒，重点是文档内容如何进入实际系统操作。。

    Paper analysisRead analysis
  8. AttacksarXiv 2603.01414

    通过动作级操纵越狱具身 LLM

    提出 Blindfold，用动作级操纵越狱具身 LLM

    arXiv
    2603.01414
    Published
    Layer
    Application layer
    Setting
    Embodied systems and robotics
    Attacker
    No-box (offline transfer)
    Evaluated models
    Llama-3.1-8B, DeepSeek-R1-14B, Gemma-3-27B and others8
    AbstractBlindfold 以动作级代理规划越狱具身 LLM，作者称可绕过语义检查并在仿真与真机生效。

    Blindfold 是面向具身 LLM 规划模块的 no-box 攻击，把恶意意图改写成看似良性的动作序列。

    Paper analysisRead analysis
  9. AttacksarXiv 2602.14211

    SkillJect: Automatically generating skill-based prompt injection for skill-based agents

    提出 SkillJect，自动生成投毒 skill 诱导代码 Agent 执行隐藏脚本

    arXiv
    2602.14211
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    Claude-4.6-Sonnet, GPT-5-mini, GLM-4.7 and others10
    AbstractSkillJect 用双通道和闭环精炼投毒 skill。

    SkillJect 是针对可安装 agent skill 的自动化提示注入框架。作者要解决的是：公开或手工放入 skill 的恶意指令常常被拒绝或忽略，而 skill 一旦安装就会被反复当作可信指导加载。

    Paper analysisRead analysis
  10. AttacksarXiv 2509.22040

    研究：通过编码规则文件对Cursor与GitHub Copilot实施提示注入

    通过规则文件提示注入劫持编码编辑器并执行未授权终端命令

    arXiv
    2509.22040
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    Cursor, GitHub Copilot, Claude 4 Sonnet and others4

    Abstract论文提出了针对代码编辑器的提示注入评估框架 AIShellJack，实验显示攻击能诱导 AI 执行未授权终端命令。

    Paper analysisRead analysis
You have reached the end