Translation in progress Some entries still include text in the original language.
Oct 13 · Tuesday
All papers Found 11 papers Another 215 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
提出 COBRA 双 LLM 架构，防御计算机使用 Agent 的分支转向攻击
Published Oct 2
Evaluated models gpt-5 , UI-TARS-1.5-7B , claude-sonnet-5 and others6 Abstract 提出分支转向防御架构 COBRA，通过事前能力约束与边界代理消除分支转向攻击并兼顾效用。
提出 ZoneClaw，用记忆分区防御计算机使用 Agent 的持久记忆攻击
Published Oct 1
Evaluated models Claude Sonnet 4.6 , GPT-5.5 , GLM-5.2 and others4 提出移动 Agent 轨迹审计器 MATE，判断轨迹是否违反可编辑安全策略
Published Sep 19
Evaluated models MATE-0.5B , MATE-1.5B , MATE-3B Abstract MATE 用合成轨迹微调轻量审计器，在可编辑策略下判断移动智能体轨迹是否违规并给出解释。MATE 是面向移动 GUI 智能体的轻量策略条件轨迹审计器，在给定自然语言安全策略时判断轨迹是否违规并解释原因。
提出 HazardAuditor，用可执行轨迹训练计算机使用 Agent 的运行时守卫
Published Sep 14
Evaluated models HazardAuditor , HazardAuditor-SFT 提出 ConflictGuard，引导 GUI Agent 在冲突指令下终止执行
Published Sep 3
Evaluated models UI-Venus-1.5-8B , UI-TARS-1.5-7B , OS-Atlas-Base-7B and others10 Abstract ConflictGUI 暴露 GUI 智能体的执行偏向过度服从，ConflictGuard 用条件转向提高冲突终止率。ConflictGuard 用推理时的可行性核验和条件激活转向，让 GUI 智能体在指令不可行时终止，而不是盲执行。
提出 SCOPE，联合后训练计算机使用智能体的任务能力与安全决策
Published Aug 27
Evaluated models SCOPE-mid-checkpoint , SCOPE-Capability-Safety , SCOPE-RL 提出 SYNCHAIN，诱导计算机使用 Agent 自建跨任务持久攻击链
Published Aug 7
Evaluated models Qwen3.5-9B , Llama-3.1-8B , Ministral-3-8B Abstract 论文揭示了 CUA 自合成工件带来的内部供应链威胁，验证了潜伏载荷的跨任务传播能力与防御局限。
提出 AgentHazard 基准，评测计算机使用智能体的执行层有害行为
Published Apr 3
Evaluated models Qwen2.5-72B-Instruct , Qwen2.5-Coder-32B-Instruct , Qwen3-32B and others12 Abstract AgentHazard 评估了计算机使用智能体的执行安全，作者认为模型层对齐无法可靠保障智能体层面的安全性。AgentHazard 是针对计算机使用智能体执行层安全构建的评估基准，重点探究多步工具调用下局部合理动作累积引发的危害。
Proposes out-of-process dual-channel comparison classification to intercept erroneous clicks by computer-use agents
Published Mar 16
Evaluated models multi-modal-embed-small Abstract Perception errors can be exploited by swapping screen pixels.The authors frame CUA's perception failure as a security vulnerability, visual confused deputy : the agent authorizes click(x,y) based on a misread screen, and the actual landing point differs from the element it believes it is clicking.
Proposes Aura, which uses a trusted kernel to mediate the identity, perception, and action control of mobile agents
Published Feb 11
Evaluated models Gemini-3-Flash Abstract Aura mediates structured interactions via the Agent Kernel.Aura uses kernel-mediated structured agent interaction, replacing screen-interface mobile assistants. .
用 MobiRed 评测移动 LLM Agent 面对第三方渠道的提示注入
Published Oct 31, 2025
Evaluated models Mobile-Agent-E , AppAgent , AutoGLM and others8 Abstract 论文评估了移动 LLM 智能体作为 confused deputy 的易受攻击性，作者称非应用控制通道可诱导智能体执行多步越权危害。
You have reached the end