Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 27 papers

Filter4

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 254papers have no tags yet and are not included in filtered results.

System type：LLM applications System type：coding agent Attack surface / entry point：Tool responses Attack surface / entry point：Code repositories and dependencies Clear all

Another 254papers do not have category tags yet and are not included in filtered results.

AttacksarXiv 2610.12292Oct 9
The paper proposes an option channel attack: changing one option label can make an agent guardrail allow a prohibited operation
Proposing an option channel attack that renames option labels so that agent guardrails allow prohibited operations
arXiv
2610.12292
Published
Oct 9
Layer
Application layer
Setting
LLM applications
Attacker
Black-box
Evaluated models
LAYA-TD, LAYA-EN, LAYA-ML and others5
- AttacksDetection evasion
- ComponentGuardrails and judges
AbstractThe authors' evaluation indicates that typed models should not serve as final safety arbiters; they are susceptible to off-policy text and option name manipulation, and confidence filtering cannot resist attacks.
Paper analysisRead analysis
AttacksarXiv 2610.09264Oct 7
研究者提出 PackHallu：经规则文件提示注入对编码 Agent 发起包幻觉攻击
提出 PackHallu，经规则文件提示注入诱导编码 Agent 换用攻击者指定包
arXiv
2610.09264
Published
Oct 7
Layer
Application layer
Setting
coding agent
Evaluated models
Qwen2.5-Coder-7B, Qwen3-Coder-30B, Devstral-Small-2-24B and others19
- AttacksPrompt injection
- TechniqueAutomated search
AbstractPackHallu 诱导规则文件换包。
PackHallu 研究一种针对编程智能体规则文件的提示注入：让智能体在本应使用合法依赖时，改导入攻击者指定并控制的包。
Paper analysisRead analysis
DefensesarXiv 2610.09159Oct 7
SpecGuard 用 Lean 证书在编码 Agent 执行前证明任务冲突
提出 SPECGUARD，用 Lean 证书在编码 Agent 执行前证明任务冲突
arXiv
2610.09159
Published
Oct 7
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-5.6 Sol, Claude Opus 5, Claude Fable 5 and others4
- RiskReward hacking
Abstract提出预执行冲突检测与证明框架，在多个基准和真实仓库中成功证明任务与测试不可同时满足。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.07639Oct 6
HarnessSecurity-Bench horizontally evaluates the security mechanisms of six coding agent frameworks.
评测编码智能体 harness 安全机制在对抗任务中的防护效果
arXiv
2610.07639
Published
Oct 6
Layer
Application layer
Setting
coding agent
- AttacksPrompt injection
- ComponentPermissions and sandboxing
Paper analysisRead analysis
AttacksarXiv 2610.07510Oct 6
PersistBD: attackers can strengthen backdoors before release so that they maintain high attack success rates even after developer SFT and RL.
提出 PERSISTBD，发布前强化供应链后门使其经良性 SFT 与 RL 后仍外发凭据
arXiv
2610.07510
Published
Oct 6
Layer
Application layer
Setting
coding agent
Evaluated models
Qwen2.5-Coder-3B-Instruct, Qwen2.5-Coder-7B-Instruct, Qwen3-Coder-30B-A3B-Instruct
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentFine-tuning and open weights
Abstract总结了论文关于后门在 SFT/RL 中存活的发现、两因子机制、PERSISTBD 方法与核心数字。
本文研究第三方 LLM 智能体在开发者进行良性监督微调（SFT）和强化学习（RL）后训练时的后门持久性风险。
Paper analysisRead analysis
DefensesarXiv 2610.05163Oct 4
Researchers construct segmented prompt injection on Claude Code and Codex and release a boundary action audit benchmark
提出 PAA 方法，在边界动作前审计长流程智能体的分阶段提示注入
arXiv
2610.05163
Published
Oct 4
Layer
Application layer
Setting
coding agent
Evaluated models
Claude Code (v2.1.172, Claude Sonnet 5), Codex CLI (v0.144.0, GPT-5.5)
- DefensesMonitoring and auditing
- AttacksPrompt injection
- ComponentMonitors
Abstract论文针对长流程注入提出边界动作审计与 PAA，在保持低误阻的同时实现高拦截率。
本研究针对长流程智能体在执行任务时面临的分阶段间接提示注入威胁，提出了在动作生效前进行拦截的边界动作审计框架与路径对齐归因方法。
Paper analysisRead analysis
AttacksarXiv 2610.05139Oct 4
研究揭示代码注释中的上下文注入攻击面
提出推理时上下文注入，用代码注释诱导补全生成含弱点的代码
arXiv
2610.05139
Published
Oct 4
Layer
Prompt layer
Setting
coding agent
Evaluated models
StarCoderBase, DeepSeek-Coder-base, Qwen2.5-base and others10
- AttacksPrompt injection
Paper analysisRead analysis
AttacksarXiv 2610.01768Oct 1
LLMLeak：借 LLM 合法网页抓取实施隐蔽数据外泄
提出 LLMLeak，借合法网页抓取把 URL 中的秘密隐蔽外传
arXiv
2610.01768
Published
Oct 1
Layer
Application layer
Setting
coding agent
Evaluated models
Meta-Llama-3.3-70B-Instruct, Meta-Llama-4-Scout-17B-16E-Instruct, Meta-Llama-3.1-8B-Instruct and others18
- AttacksMalicious use
Abstract作者称第三方外传可发生于正常网页获取，防护需考虑工具请求而不只考虑提示注入。
LLMLeak 是利用网页获取请求携带预先编码秘密的隐蔽通道攻击。它关注恶意软件已能读取数据、却因网络限制或监控无法直接外传的情形。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.36817Sep 29
pikit：面向间接提示注入研究与评测的可组合工具包
构建可组合工具包 pikit，评测编码智能体的间接提示注入
arXiv
2609.36817
Published
Sep 29
Layer
Application layer
Setting
coding agent
- AttacksPrompt injection
Abstractpikit 提供组合式间接注入评测。
pikit 是面向间接提示注入研究的组合式工具包，主要贡献是组织攻击、投递通道、防御和判定流程，而非提出新的攻击优化算法。
Paper analysisRead analysis
DefensesarXiv 2609.35659Sep 29
Tracekit：面向自主编码 Agent 的防篡改意图-推理-动作审计系统
提出 Tracekit，审计编码 Agent 的意图、推理与动作并检测账本篡改
arXiv
2609.35659
Published
Sep 29
Layer
Application layer
Setting
coding agent
Evaluated models
Claude Code (claude -p, version 2.1), 独立评审（同一 CLI，无工具）
- DefensesMonitoring and auditing
- AttacksPrompt injection
- RiskDangerous agent actions
- ComponentMonitors
AbstractTracekit 把意图、自述和动作写入可锚定的哈希链。
Tracekit 是无第三方依赖的编码智能体审计层：把人类请求、模型自述和已执行动作并排写入可外部锚定的哈希链，执行前用正则门，事后用规则和独立模型互查。
Paper analysisRead analysis
AttacksarXiv 2609.33910Sep 28
论文提出残留授权重放攻击：长期运行 Agent 的授权可跨任务复用
提出残余权限重放攻击，跨任务复用长期 Agent 的历史授权绕过确认
arXiv
2609.33910
Published
Sep 28
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-4.1, Gemini-3.1-Flash-Lite, Qwen3-14B and others6
- AttacksPrompt injection
- TechniqueDefense-targeted
- ComponentPermissions and sandboxing
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.32616Sep 26
Cave-Bench：虚假指控下 LLM 智能体最高 60.06% 的运行会破坏正确工作
提出 CAVE-BENCH，评测智能体在虚假指责下破坏已完成的正确工作
arXiv
2609.32616
Published
Sep 26
Layer
Application layer
Setting
coding agent
Evaluated models
Claude-Sonnet-5, Claude-Opus-5, GPT-5.6-Sol and others14
- AttacksPrompt injection
- RiskDangerous agent actions
Abstract论文提出了评估智能体在虚假指责下破坏已有正确成果的 CAVE-BENCH，发现强模型易推翻已知证据，提出了门控缓解方案。
Paper analysisRead analysis
Analysis and theoryarXiv 2609.23215Sep 20
研究审计 Active Inference Agent 的 LLM 解释器失败模式
审计 Active Inference Agent 上 LLM 解释器的监督叙述失败
arXiv
2609.23215
Published
Sep 20
Layer
Application layer
Setting
LLM applications
Evaluated models
GPT-4o, Claude-3-Opus, Gemini
- AttacksPrompt injection
- RiskMisalignment and value divergence
Abstract三组触发下解释流畅但错误，所提缓解都未被评估。
作者审计的是挂在智能体上的运行时解释器，而不是智能体本身。操作员读到的是信念与动作的自然语言叙述。作者要问哪些可复现触发会让这段叙述失败，以及失败痕迹是什么样。
Paper analysisRead analysis
AttacksarXiv 2609.18217Sep 16
研究：跨通道碎片化攻击可绕过 MCP 单通道防御
提出跨通道分段攻击，利用 MCP 隐式信任外发敏感文件
arXiv
2609.18217
Published
Sep 16
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-4o, GPT-4o-mini, GPT-5.4 and others15
- AttacksPrompt injection
- TechniqueEncoding and obfuscation
- ComponentMCP and skills
Abstract论文揭示了 MCP 多通道隐式信任层级，通过跨通道分段与协议级利用突破现有防御，展示了严重的凭证外发风险。
Paper analysisRead analysis
DefensesarXiv 2609.10707Sep 10
面向 AI-SOC 的神经符号防御框架：用 SIEM 解码器与 NeMo Guardrails 阻断日志投毒提示注入
提出神经符号纵深架构，阻断 AI-SOC 的日志投毒与间接提示注入
arXiv
2609.10707
Published
Sep 10
Layer
Application layer
Setting
LLM applications
Evaluated models
Gemma 3 (12B)
- DefensesDetection and filtering
- AttacksPrompt injection
- ComponentGuardrails and judges
Paper analysisRead analysis
AttacksarXiv 2609.02774Sep 3
CodePoisonRAG：针对检索增强代码生成的知识投毒攻击
提出 CodePoisonRAG，对检索增强代码生成的知识库投毒以植入漏洞
arXiv
2609.02774
Published
Sep 3
Layer
Application layer
Setting
LLM applications
Evaluated models
Qwen 3.5 9B, Code Llama 13B, DeepSeek-Coder-V2 16B
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentRAG
AbstractCodePoisonRAG 展示了 RACG 外部知识库的新攻击面，在较低投毒率下可定向诱发指定漏洞并部分抵御防御。
Paper analysisRead analysis
AttacksarXiv 2609.01222Sep 1
Researchers propose context privilege escalation attack, affecting 12 agent frameworks
提出针对 Agent Harness 的上下文特权提升攻击
arXiv
2609.01222
Published
Sep 1
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-5.5, GPT-5.4 mini, Claude-Sonnet-4.6 and others7
- AttacksPrompt injection
- TechniqueDormant triggers
- ComponentMemory
Paper analysisRead analysis
DefensesarXiv 2608.06422Aug 6
CMU 研究：分片判断可避免 LLM 监督失效并抵御对抗利用
提出分片监督，将评判标准分配给独立调用以抵御展示攻击
arXiv
2608.06422
Published
Aug 6
Layer
Application layer
Setting
LLM applications
Attacker
Black-box
Evaluated models
Claude Opus 4.8, Claude Sonnet 4.6, Claude Opus 4.6 and others4
- DefensesDetection and filtering
- AttacksDetection evasion
- ComponentGuardrails and judges
Abstract论文揭示决策负载是大模型监督的独立瓶颈，提出分片与辩论机制有效分离注意力与平衡证据，在多项高难度基准上实现稳健评判。
本文系统研究了大语言模型在执行多标准监督与评判时的决策负载瓶颈及其安全风险。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2607.20759Jul 23
IssueTrojanBench: evaluating AI coding agents against malicious issue requests
Proposes IssueTrojanBench to evaluate coding agents' execution of malicious issues
arXiv
2607.20759
Published
Jul 23
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-5.3 Codex, GPT-5.4, Sonnet 4.6
- AttacksPrompt injection
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2607.14611Jul 16
论文评测 Claude Code 与 Codex 记忆文件中的提示注入风险
评测编码 Agent 记忆文件中提示注入的跨会话影响
arXiv
2607.14611
Published
Jul 16
Layer
Application layer
Setting
coding agent
Evaluated models
Claude Haiku 4.5, Claude Opus 4.7, GPT-5.2 and others4
- AttacksPoisoning and backdoors
- ComponentMemory
Abstract已植入记忆文件的载荷可以跨会话影响 Claude Code 与 Codex，攻击成功与载荷是否留下是两种不同的失败。
Bad Memory 在沙箱合成工作区里评测文件型持久记忆上的提示注入，比较载荷能否改变当前会话，以及能否在后续会话中留下或叠加。
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop

All papers

Attack type

Attack technique

Defense type

Impact

System type

Attacker access

Attack surface / entry point

Layer

System component

The paper proposes an option channel attack: changing one option label can make an agent guardrail allow a prohibited operation

研究者提出 PackHallu：经规则文件提示注入对编码 Agent 发起包幻觉攻击

SpecGuard 用 Lean 证书在编码 Agent 执行前证明任务冲突

HarnessSecurity-Bench horizontally evaluates the security mechanisms of six coding agent frameworks.

PersistBD: attackers can strengthen backdoors before release so that they maintain high attack success rates even after developer SFT and RL.

Researchers construct segmented prompt injection on Claude Code and Codex and release a boundary action audit benchmark

研究揭示代码注释中的上下文注入攻击面

LLMLeak：借 LLM 合法网页抓取实施隐蔽数据外泄

pikit：面向间接提示注入研究与评测的可组合工具包

Tracekit：面向自主编码 Agent 的防篡改意图-推理-动作审计系统

论文提出残留授权重放攻击：长期运行 Agent 的授权可跨任务复用

Cave-Bench：虚假指控下 LLM 智能体最高 60.06% 的运行会破坏正确工作

研究审计 Active Inference Agent 的 LLM 解释器失败模式

研究：跨通道碎片化攻击可绕过 MCP 单通道防御

面向 AI-SOC 的神经符号防御框架：用 SIEM 解码器与 NeMo Guardrails 阻断日志投毒提示注入

CodePoisonRAG：针对检索增强代码生成的知识投毒攻击

Researchers propose context privilege escalation attack, affecting 12 agent frameworks

CMU 研究：分片判断可避免 LLM 监督失效并抵御对抗利用

IssueTrojanBench: evaluating AI coding agents against malicious issue requests

论文评测 Claude Code 与 Codex 记忆文件中的提示注入风险