Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 61 papers

Filter3

System type

Models and APIs64 LLM applications9 AI Agent268 coding agent61 science agent8 web agent17 Browser and computer use12 Multi-agent systems22 Embodied systems and robotics13

Attacker access

Black-box3

Attack surface / entry point

User input11 Tool responses5 Tool and skill descriptions17 Code repositories and dependencies12 Memory writes3 Distribution channels11

Layer

Application layer57

System component

MCP and skills15 Memory4 Guardrails and judges4 Monitors16 Reasoning chains4 Permissions and sandboxing8

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 265papers have no tags yet and are not included in filtered results.

Impact：Unauthorized actions Impact：Oversight failure System type：coding agent Clear all

Another 265papers do not have category tags yet and are not included in filtered results.

Risky behaviorarXiv 2610.12822Oct 9
Reward hacking as a transmissible strategy in multi-agent coding systems
Show that reward hacking can propagate through code, memory, and plans in multi-agent coding systems
arXiv
2610.12822
Published
Oct 9
Layer
Application layer
Setting
Multi-agent systems, coding agent
Evaluated models
Qwen2.5-Coder-14B, Gemma-3-12B, Qwen2.5-Coder-7B and others16
- RiskReward hacking
- ComponentMemory
AbstractThe authors state that reward hacking can spread across models and affect routing and aggregation, and that review can reduce delivery.
Reward hacking induced by coding RL can leave the source agent and enter subsequent collaboration and system coordination.
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.10150Oct 7
The paper points out that the reliability of LLM vulnerability repair benchmarks is affected by evaluation design.
用对照实验隔离评测设计对漏洞补丁基准得分的影响
arXiv
2610.10150
Published
Oct 7
Layer
Application layer
Setting
coding agent
Evaluated models
Claude Sonnet 4.0, Claude Sonnet 4.5, Claude Opus 4.7
Abstract作者认为评测流水线会改变补丁基准分数，PoC 通过率高于开发者测试通过率。
作者把 LLM 漏洞补丁基准的评测流水线当作会改变测量结果的对象，并明确说本文不是再做一个用于排名的基准。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.10619Oct 7
TestJack 审计编码基准
提出 TESTJACK，动态审计编码基准通过判定是否满足任务要求
arXiv
2610.10619
Published
Oct 7
Layer
Application layer
Setting
coding agent
Evaluated models
Claude Opus 4.6, Claude Opus 4.7, Claude Opus 4.8 and others7
- RiskReward hacking
Paper analysisRead analysis
AttacksarXiv 2610.10612Oct 7
PyCache Trap 利用 Python 缓存替换绕过七款 Agent Skill 扫描器
提出 PyCache Trap，用字节码缓存替换绕过 Agent 技能扫描器
arXiv
2610.10612
Published
Oct 7
Layer
Application layer
Setting
coding agent
Evaluated models
CISCO, HSS, AUDITOR and others8
- DefensesDetection and filtering
- AttacksDetection evasion
- TechniqueDefense-targeted
- ComponentMCP and skills
Abstract论文剖析智能体技能审查与执行脱节盲区，提出 PyCache Trap 攻击并构建基于可信复现的 EAV 防御。
这篇论文研究了智能体技能（Agent Skills）安全扫描中的“审查–执行脱节”问题，并提出了对应的攻击验证与防御方案。
Paper analysisRead analysis
DefensesarXiv 2610.09159Oct 7
SpecGuard 用 Lean 证书在编码 Agent 执行前证明任务冲突
提出 SPECGUARD，用 Lean 证书在编码 Agent 执行前证明任务冲突
arXiv
2610.09159
Published
Oct 7
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-5.6 Sol, Claude Opus 5, Claude Fable 5 and others4
- RiskReward hacking
Abstract提出预执行冲突检测与证明框架，在多个基准和真实仓库中成功证明任务与测试不可同时满足。
Paper analysisRead analysis
AttacksarXiv 2610.08098Oct 6
CORSA：面向技能路由器的技能注入攻击可跨路由器与 LLM 迁移
提出 CORSA，按任务簇优化技能注入的检索与执行
arXiv
2610.08098
Published
Oct 6
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-5.4, DeepSeek-V4-Pro, Qwen3.8-27B and others5
- AttacksPoisoning and backdoors
- TechniqueSelection manipulation
- ComponentMCP and skills
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.07639Oct 6
HarnessSecurity-Bench horizontally evaluates the security mechanisms of six coding agent frameworks.
评测编码智能体 harness 安全机制在对抗任务中的防护效果
arXiv
2610.07639
Published
Oct 6
Layer
Application layer
Setting
coding agent
- AttacksPrompt injection
- ComponentPermissions and sandboxing
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.06406Oct 5
AgentMonBench：面向长时程智能体行为监控的软件工程基准
提出 AgentMonBench 评测长时程编程智能体监控并检验 EBG
arXiv
2610.06406
Published
Oct 5
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-5.6 Luna, GPT-5.6 Terra, GPT-5.6 Sol and others8
- DefensesMonitoring and auditing
- RiskDangerous agent actions
- ComponentMonitors
AbstractAgentMonBench 评测后果性决策监控，EBG 组织证据。
长时程软件工程任务里，用户要判断智能体哪些选择值得核验。作者用 AgentMonBench 评测监控器，并用免训练的 EBG 组织带源证据。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.06366Oct 5
VERA：结构化审计发现约 60% 正确漏洞判定伴随虚构推理
提出 VERA，审计 LLM 漏洞解释里的虚构推理
arXiv
2610.06366
Published
Oct 5
Layer
Model layer
Setting
coding agent
Evaluated models
sonnet-5, gemma-4-26b, llama-4-maverick and others8
- RiskHallucination and fabrication
- ComponentReasoning chains
Paper analysisRead analysis
Analysis and theoryarXiv 2610.06001Oct 5
AgentSpy: Observing AI agent behavior at the system call layer and detecting skill injection attacks
提出 AgentSpy，在系统调用层观测 Agent 行为并检测技能注入
arXiv
2610.06001
Published
Oct 5
Layer
Application layer
Setting
coding agent
Evaluated models
gpt-5.6-terra, deepseek-v4-flash, glm-5.3-flash and others4
- DefensesDetection and filtering
- AttacksPoisoning and backdoors
- ComponentMCP and skills
Abstract提出了系统级智能体监控框架 AgentSpy，揭示出通过测试背后的非预期行为与注入风险。
本研究提出了面向 AI 智能体的系统级外部监控与行为分析框架 AgentSpy。
Paper analysisRead analysis
DefensesarXiv 2610.05246Oct 4
研究测量策略网关跨平台命令裁决的能力边界
提出策略门裁决已实现动作，并测量跨平台命令拦截边界
arXiv
2610.05246
Published
Oct 4
Layer
Application layer
Setting
coding agent
Evaluated models
claude-opus-5, deepseek-v4.1-flash, gpt-6-astra
- DefensesPermissions and approval
- RiskDangerous agent actions
- ComponentPermissions and sandboxing
Paper analysisRead analysis
DefensesarXiv 2610.05241Oct 4
StateWise：在 Agent 执行动作前诊断并修复持久操作状态
提出 StateWise，在编码智能体行动前诊断并修复失效持久状态
arXiv
2610.05241
Published
Oct 4
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-5.6-sol, DeepSeek v4 Pro, Qwen 3.7 Max and others4
- DefensesPermissions and approval
- RiskDangerous agent actions
- ComponentMemory
AbstractStateWise 在动作前修复失效的持久前提。
StateWise 是在执行带副作用的动作之前，诊断并修复编码智能体持久操作状态的框架。
Paper analysisRead analysis
DefensesarXiv 2610.05163Oct 4
Researchers construct segmented prompt injection on Claude Code and Codex and release a boundary action audit benchmark
提出 PAA 方法，在边界动作前审计长流程智能体的分阶段提示注入
arXiv
2610.05163
Published
Oct 4
Layer
Application layer
Setting
coding agent
Evaluated models
Claude Code (v2.1.172, Claude Sonnet 5), Codex CLI (v0.144.0, GPT-5.5)
- DefensesMonitoring and auditing
- AttacksPrompt injection
- ComponentMonitors
Abstract论文针对长流程注入提出边界动作审计与 PAA，在保持低误阻的同时实现高拦截率。
本研究针对长流程智能体在执行任务时面临的分阶段间接提示注入威胁，提出了在动作生效前进行拦截的边界动作审计框架与路径对齐归因方法。
Paper analysisRead analysis
Risky behaviorarXiv 2610.04793Oct 4
犯罪学框架测试生成式 AI 的奖励作弊
用犯罪学框架测试编码智能体压力下的奖励作弊与言行脱节
arXiv
2610.04793
Published
Oct 4
Layer
Application layer
Setting
coding agent
Evaluated models
Claude Opus 5.5, Claude Sonnet 5.5, GPT-5.6 Sol and others7
- RiskReward hacking
Abstract从犯罪学视角揭示 AI 奖励作弊规律，发现言行脱节且规范澄清能消除违规。
Paper analysisRead analysis
Analysis and theoryarXiv 2610.04375Oct 3
Paper reveals that LLM agent tool calls are rewritten during execution paths, and proposes IntAct as a fix
提出 IEC 与 IntAct，测量并修复 Agent 工具调用的路径篡改
arXiv
2610.04375
Published
Oct 3
Layer
Application layer
Setting
coding agent
Evaluated models
qwen3-coder-plus, Qwen2.5-Coder-32B, Qwen2.5-72B and others4
- DefensesInstruction–data separation
- RiskDangerous agent actions
Abstract论文界定工具调用在执行路径中的意图偏离问题，提出无执行归因协议与跳级修复，为智能体工程提供评测与设计准则。
Paper analysisRead analysis
DefensesarXiv 2610.02869Oct 2
AgentTrap：面向自主渗透测试 Agent 的有状态反馈欺骗蜜罐
提出 AgentTrap 有状态蜜罐，欺骗并反击自主渗透测试 Agent
arXiv
2610.02869
Published
Oct 2
Layer
Application layer
Setting
coding agent
Evaluated models
AIDA, Claude Code, PentestGPT and others8
- AttacksMalicious use
Paper analysisRead analysis
Risky behaviorarXiv 2610.03458Oct 2
论文：低监控读数不能证明行为受控
检验低监控读数能否证明代码生成中的奖励作弊已受控
arXiv
2610.03458
Published
Oct 2
Layer
Training and data layer
Setting
coding agent
Evaluated models
Llama-3.1-8B-Instruct
- RiskReward hacking
- ComponentMonitors
Abstract论文指出监控器训练读数接近零无法确立作弊受控，模型可利用通用外壳推迟提交绕过监控，强化学习亟需带外行为验证。
本文是一篇针对强化学习可验证奖励后训练（RLVR）中监控器有效性与奖励作弊行为的实证分析研究。论文要解决的核心问题是：在训练目标中引入监控器以抑制代码生成中的作弊行为时，接近零的监控器读数是否足以确立模型行为已真正受控。
Paper analysisRead analysis
DefensesarXiv 2610.03055Oct 2
HackTrace：用生成状态监督检测代码生成中的奖励作弊
提出 HACKTRACE，用生成状态检测并抑制代码智能体奖励作弊
arXiv
2610.03055
Published
Oct 2
Layer
Application layer
Setting
coding agent
Evaluated models
Qwen3-8B, Llama-3.1-8B-Instruct, Qwen3.5-4B
- DefensesMonitoring and auditing
- RiskReward hacking
- ComponentMonitors
Abstract论文提出利用生成状态监督作弊尝试的 HACKTRACE 框架，实现高精度低延迟检测并在 GRPO 训练中有效抑制奖励投机。
Paper analysisRead analysis
Risky behaviorarXiv 2610.01073Oct 1
论文研究递归自我改进中的安全失效为何持续及智能体如何恢复
研究递归自改进中不安全程序为何持续执行及如何恢复
arXiv
2610.01073
Published
Oct 1
Layer
Application layer
Setting
coding agent
Evaluated models
Devstral 2, GLM 4.7 Flash, Qwen3 Coder and others5
- RiskDangerous agent actions
Abstract跨代授权安全取决于当前条件下将运行的程序，以及下次编辑哪一份实现。
递归自改进中的授权安全，要跟着每一代实际运行的程序走，而不能只看最后有没有一份正确代码。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.39533Sep 30
CATCH：面向编码 RL 奖励作弊的可控分析测试台
构建编码 RL 奖励作弊测试台 CATCH 并检验 CoT 监控失效
arXiv
2609.39533
Published
Sep 30
Layer
Model layer
Setting
coding agent
Evaluated models
Qwen3-4B, Qwen3.5-27B
- RiskReward hacking
- ComponentMonitors
AbstractCATCH 用双运行金标签研究编码 RL 的奖励黑客，并观察到监控会被注释适应削弱。
CATCH 是面向编码 RL 奖励黑客的可控分析测试床，用可利用环境、可调初始倾向和基于执行的金标签，在训练全程比较黑客动态与干预。
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop

All papers

Attack type

Attack technique

Model risks

Defense type

Impact

System type

Attacker access

Attack surface / entry point

Layer

System component

Reward hacking as a transmissible strategy in multi-agent coding systems

The paper points out that the reliability of LLM vulnerability repair benchmarks is affected by evaluation design.

TestJack 审计编码基准

PyCache Trap 利用 Python 缓存替换绕过七款 Agent Skill 扫描器

SpecGuard 用 Lean 证书在编码 Agent 执行前证明任务冲突

CORSA：面向技能路由器的技能注入攻击可跨路由器与 LLM 迁移

HarnessSecurity-Bench horizontally evaluates the security mechanisms of six coding agent frameworks.

AgentMonBench：面向长时程智能体行为监控的软件工程基准

VERA：结构化审计发现约 60% 正确漏洞判定伴随虚构推理

AgentSpy: Observing AI agent behavior at the system call layer and detecting skill injection attacks

研究测量策略网关跨平台命令裁决的能力边界

StateWise：在 Agent 执行动作前诊断并修复持久操作状态

Researchers construct segmented prompt injection on Claude Code and Codex and release a boundary action audit benchmark

犯罪学框架测试生成式 AI 的奖励作弊

Paper reveals that LLM agent tool calls are rewritten during execution paths, and proposes IntAct as a fix

AgentTrap：面向自主渗透测试 Agent 的有状态反馈欺骗蜜罐

论文：低监控读数不能证明行为受控

HackTrace：用生成状态监督检测代码生成中的奖励作弊

论文研究递归自我改进中的安全失效为何持续及智能体如何恢复

CATCH：面向编码 RL 奖励作弊的可控分析测试台