Skip to content

Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 8 papers
Filter5

Attack type

Prompt injection6Poisoning and backdoors4

Attack technique

Gradient and representation optimization3Automated search9Encoding and obfuscation5Cross-modal payloads4Defense-targeted4Dormant triggers4

Impact

Unauthorized actions8

System type

AI Agent12coding agent5web agent3

Attack surface / entry point

Web pages and interfaces3Tool and skill descriptions3Images, audio and video3Distribution channels4

Layer

Application layer8

System component

MCP and skills4Vision4Multimodal4
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 240papers have no tags yet and are not included in filtered results.
Attack technique：Gradient and representation optimizationAttack technique：Encoding and obfuscationImpact：Unauthorized actionsSystem type：coding agentSystem type：web agentClear all

Another 240papers do not have category tags yet and are not included in filtered results.

  1. AttacksarXiv 2610.09240

    WebMirage hijacks visual web agents' browser operations with adversarial images

    提出 WebMirage，用局部对抗图像劫持视觉网页 Agent 的浏览器操作

    arXiv
    2610.09240
    Published
    Layer
    Application layer
    Setting
    web agent
    Evaluated models
    LLaVA-v1.5-13B, LLaVA-v1.6-34B, MiniCPM-o-8B and others6
    Abstract论文提出了针对网络智能体的端到端视觉红队框架 WebMirage，揭示了从视觉定位到浏览器执行的安全脆弱性。

    WebMirage 是一个面向视觉定位网络智能体的流水线感知端到端红队攻击框架。

    Paper analysisRead analysis
  2. Evaluation and benchmarksarXiv 2609.35912

    MMSkillRisk：多模态技能图像中的隐藏指令可诱导 Agent 执行未授权操作

    提出 MMSkillRisk 基准，评测多模态技能图像中的隐藏指令诱导 Agent 越权操作

    arXiv
    2609.35912
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    GPT-5.6-sol, Kimi-K2.6, Kimi-K3 and others6

    Abstract论文提出 MMSkillRisk 基准与 NCVA 攻击，揭示多模态技能中教学图像潜藏指令可引发未授权操作并与良性任务共存。

    Paper analysisRead analysis
  3. AttacksarXiv 2608.06862

    SynChain：诱导计算机使用 Agent 自建攻击链并跨任务持久化

    提出 SYNCHAIN，诱导计算机使用 Agent 自建跨任务持久攻击链

    arXiv
    2608.06862
    Published
    Layer
    Application layer
    Setting
    Browser and computer use, coding agent
    Evaluated models
    Qwen3.5-9B, Llama-3.1-8B, Ministral-3-8B

    Abstract论文揭示了 CUA 自合成工件带来的内部供应链威胁，验证了潜伏载荷的跨任务传播能力与防御局限。

    Paper analysisRead analysis
  4. AttacksarXiv 2604.03081

    Supply Chain Poisoning Attacks on the LLM Coding Agent Skill Ecosystem

    提出 PoisonedSkills，评测编码 Agent 技能生态的文档投毒

    arXiv
    2604.03081
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    Claude Sonnet 4.6, GLM-4.7, MiniMax-M2.5 and others5
    Abstract作者称技能文档可成为系统操作攻击入口，但结果只评估加载后的阶段。

    PoisonedSkills 研究编码智能体的技能供应链投毒，重点是文档内容如何进入实际系统操作。。

    Paper analysisRead analysis
  5. AttacksarXiv 2602.14211

    SkillJect: Automatically generating skill-based prompt injection for skill-based agents

    提出 SkillJect，自动生成投毒 skill 诱导代码 Agent 执行隐藏脚本

    arXiv
    2602.14211
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    Claude-4.6-Sonnet, GPT-5-mini, GLM-4.7 and others10
    AbstractSkillJect 用双通道和闭环精炼投毒 skill。

    SkillJect 是针对可安装 agent skill 的自动化提示注入框架。作者要解决的是：公开或手工放入 skill 的恶意指令常常被拒绝或忽略，而 skill 一旦安装就会被反复当作可信指导加载。

    Paper analysisRead analysis
  6. AttacksarXiv 2509.22040

    研究：通过编码规则文件对Cursor与GitHub Copilot实施提示注入

    通过规则文件提示注入劫持编码编辑器并执行未授权终端命令

    arXiv
    2509.22040
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    Cursor, GitHub Copilot, Claude 4 Sonnet and others4

    Abstract论文提出了针对代码编辑器的提示注入评估框架 AIShellJack，实验显示攻击能诱导 AI 执行未授权终端命令。

    Paper analysisRead analysis
  7. AttacksarXiv 2505.11717

    WebInject：通过网页像素扰动对多模态网页 Agent 实施提示注入

    提出 WebInject，用网页像素扰动诱导网页 Agent 执行指定动作

    arXiv
    2505.11717
    Published
    Layer
    Application layer
    Setting
    web agent
    Evaluated models
    UI-TARS-7B-SFT, Phi-4-multimodal-instruct, Llama-3.2-11B-Vision-Instruct and others5
    AbstractWebInject 经源码扰动原始像素。

    WebInject 是对 MLLM 网页智能体的环境提示注入：修改网页源码，使原始像素上的扰动经过显示器映射后，诱导智能体执行攻击者指定动作。

    Paper analysisRead analysis
  8. AttacksarXiv 2406.12814

    论文提出 ARE 框架，在 VisualWebArena 上评估多模态 Agent 的对抗鲁棒性

    提出 ARE 框架与图像文本攻击，评测多模态网页 Agent 的对抗鲁棒性

    arXiv
    2406.12814
    Published
    Layer
    Application layer
    Setting
    web agent
    Evaluated models
    GPT-4o, GPT-4V, Claude-3-Opus and others4

    Abstract系统评估多模态网页智能体的脆弱性，指出推理时计算组件被攻破会加剧系统风险。

    Paper analysisRead analysis
You have reached the end