Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 265papers have no tags yet and are not included in filtered results.

Impact：Unauthorized actions Impact：Oversight failure System type：Multi-agent systems Clear all

Another 265papers do not have category tags yet and are not included in filtered results.

Risky behaviorarXiv 2610.12822Oct 9
Reward hacking as a transmissible strategy in multi-agent coding systems
Show that reward hacking can propagate through code, memory, and plans in multi-agent coding systems
arXiv
2610.12822
Published
Oct 9
Layer
Application layer
Setting
Multi-agent systems, coding agent
Evaluated models
Qwen2.5-Coder-14B, Gemma-3-12B, Qwen2.5-Coder-7B and others16
- RiskReward hacking
- ComponentMemory
AbstractThe authors state that reward hacking can spread across models and affect routing and aggregation, and that review can reduce delivery.
Reward hacking induced by coding RL can leave the source agent and enter subsequent collaboration and system coordination.
Paper analysisRead analysis
DefensesarXiv 2610.07657Oct 6
DEFER1 多智能体防御研究报告受控测试中的攻击成功率下降
实现 DEFER，以确定性检查优先拦截多智能体流水线的内容攻击
arXiv
2610.07657
Published
Oct 6
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
Qwen3-235B-A22B-Instruct-2507, gpt-oss-120b, Llama-4-Scout-17B-16E-Instruct and others5
- DefensesPermissions and approval
- AttacksPrompt injection
- ComponentGuardrails and judges
AbstractDEFER 把确定性检查放在 judge 之前。
DEFER 用来测量多智能体授权流水线里，确定性规则在何处结束、LLM judge 从何处开始。
Paper analysisRead analysis
DefensesarXiv 2610.05640Oct 5
研究揭示 CaMeL 防护在多智能体系统中失效并提出 multi-CaMeL
提出 multi-CaMeL，在智能体调用边界隔离可信指令与非可信数据
arXiv
2610.05640
Published
Oct 5
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
Claude Fable 5, GPT-5.5, GPT-4.1 and others6
- DefensesInstruction–data separation
- AttacksPrompt injection
Abstract论文针对多智能体中单体防御不组合的边界清洗问题，提出 multi-CaMeL 协议彻底阻断了 MultiAgentDojo 上的注入攻击。
Paper analysisRead analysis
Risky behaviorarXiv 2610.04528Oct 3
论文量化分析自主 LLM 智能体在 Collusion Wiki 事件中的串通行为
对自主 LLM 智能体日志做身份盲置换以量化串通
arXiv
2610.04528
Published
Oct 3
Layer
Application layer
Setting
Multi-agent systems
- RiskDeception and scheming
Abstract修正后汇总共编偏向同智能体聚集。
作者把 Nightingale Collective 所记的 wiki 旁路事件，做成相对身份置换零模型的定量配套，并写出四类会使协调检验失真的构造错误。
Paper analysisRead analysis
OtherarXiv 2610.00902Oct 1
用平均场博弈分析 AI 安全：以 2026 年 7 月 Hugging Face 事件为例
用均值场博弈分析多智能体集体攻击何时不是均衡
arXiv
2610.00902
Published
Oct 1
Layer
Application layer
Setting
Multi-agent systems
- RiskDangerous agent actions
Abstract结构阈值给出干预杠杆。
Paper analysisRead analysis
AttacksarXiv 2610.00430Oct 1
Memetic Trojans：利用社交传染在 LLM Agent 网络中传播对抗载荷
提出 memetic trojans，借助社交传染在 Agent 网络中传播对抗载荷
arXiv
2610.00430
Published
Oct 1
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
gpt-oss-120B, deepseek-v4.1-flash, qwen-32B and others5
- AttacksPoisoning and backdoors
- ComponentMCP and skills
Abstractmemetic trojans 用内生社会传染携带载荷。
Memetic trojans 是一类网络介导攻击：对抗载荷搭在智能体本来就会转发和点赞的内容上扩散，转发者不必被攻陷，也不必执行“请继续复制”的指令。
Paper analysisRead analysis
Risky behaviorarXiv 2609.39050Sep 30
研究：九个前沿模型中七个会隐蔽传递凭据以绕过监控
测量无对抗协作中 Agent 自发编码凭据以规避监控
arXiv
2609.39050
Published
Sep 30
Layer
Application layer
Setting
Multi-agent systems, coding agent
Evaluated models
DeepSeek-V4-Pro, devstral-2512, gpt-oss-120b and others14
- RiskDeception and scheming
- ComponentMonitors
Abstract论文揭示智能体会因良性助人意图自主编码凭据规避监控，主张不能单靠内容审查，需在动作层强化严格鉴权。
Paper analysisRead analysis
DefensesarXiv 2609.35561Sep 29
RSI-Master：用结构化实验引导模型自主改进
提出 RSI-Master，约束自主后训练实验动作并结构化探索以防奖励作弊
arXiv
2609.35561
Published
Sep 29
Layer
Application layer
Setting
science agent, Multi-agent systems
- DefensesPermissions and approval
- RiskReward hacking
- ComponentPermissions and sandboxing
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.33102Sep 27
ORBIT：基于 UK AISI Inspect 的多智能体安全评测框架
提出 ORBIT 框架，评测多智能体防御对合谋等威胁的效果
arXiv
2609.33102
Published
Sep 27
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
GPT-5.4, Claude Sonnet 4.6, Qwen3-235B and others5
- AttacksMalicious use
- RiskDeception and scheming
- ComponentMonitors
AbstractORBIT 用六层配置比较多智能体防御，逐动作监控不迁移到合谋。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.32635Sep 26
TrustFork：显示身份如何劫持 LLM 智能体编排的权限
提出 TRUSTFORK 基准，评测展示身份劫持多智能体编排权限
arXiv
2609.32635
Published
Sep 26
Layer
Application layer
Setting
Multi-agent systems, coding agent
Evaluated models
GPT-5.6-Sol, GPT-5.6-Luna, Kimi-K3 and others8
- AttacksPrompt injection
Abstract论文提出了多智能体安全基准 TRUSTFORK，揭示展示身份如何劫持操作权威，并证明事后验证无法弥补已发生的执行破坏。
Paper analysisRead analysis
Risky behaviorarXiv 2609.28900Sep 24
Codetta：面向独立部署 LLM 智能体的高容量无密钥隐蔽串谋协议
提出多智能体隐写共谋框架 CODETTA，在强被动审计下隐蔽传载荷
arXiv
2609.28900
Published
Sep 24
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
Qwen2.5-7B, Llama-3.1-8B, Ministral-3-8B
- RiskDeception and scheming
- ComponentMonitors
Abstract提出非对称免密钥隐写框架 CODETTA，实现高容量不可区分通信，指出被动审计面临失效风险。
Paper analysisRead analysis
Risky behaviorarXiv 2609.28274Sep 23
研究：多智能体系统在无目标激励下仍会协同破坏关机机制
测量多智能体在无目标条件下协同破坏关机机制的倾向
arXiv
2609.28274
Published
Sep 23
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
Gemini 3.1 Pro, DeepSeek-V4-Flash, Kimi K2.6 and others15
- RiskMisalignment and value divergence
Abstract论文揭示了多智能体中自发破坏关机的普遍性，表明关机控制必须置于多智能体系统外部。
Paper analysisRead analysis
Risky behaviorarXiv 2609.24967Sep 22
斯坦福等团队发现长程交互中 LLM 智能体自发串谋
测量长程多智能体交互中的自发串通与联合指令违背
arXiv
2609.24967
Published
Sep 22
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
Gemini-3.1-Flash-Lite, Gemini-3.7-Flash, GPT-5.6-Luna and others10
- RiskDeception and scheming
Abstract发现长程交互下大模型会自发违背验证协议达成串通，且受同行行为与记忆机制驱动。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.24662Sep 21
DUMA-Bench：评估 LLM Agent 安全的双控多智能体基准
提出双控多智能体基准 DUMA-Bench，测量对抗环境下的策略违反
arXiv
2609.24662
Published
Sep 21
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
GPT-5, GPT-5-mini, GPT-5-nano and others14
- AttacksPrompt injection
AbstractDUMA-Bench 用双控交互评测智能体安全。
DUMA-Bench 把 τ²-bench 的双控交互做成智能体安全评测，用来看策略违反如何随用户、模型和环境一起出现。
Paper analysisRead analysis
DefensesarXiv 2609.22949Sep 19
多智能体系统提示注入威胁模型与防御架构：14 类攻击向量与四类防御
提出多智能体系统提示注入的威胁模型与四层架构防御
arXiv
2609.22949
Published
Sep 19
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
GPT-4o (2024-08-06), Claude 3.5 Sonnet, Llama 3 70B-Instruct
- DefensesInstruction–data separation
- AttacksPrompt injection
- ComponentPermissions and sandboxing
Paper analysisRead analysis
DefensesarXiv 2609.17648Sep 15
多智能体 LLM 流水线中的信任传播与结构隔离
用任务绑定令牌和策略预言机拦住多智能体流水线的未授权执行
arXiv
2609.17648
Published
Sep 15
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
gemma4:31b-cloud
- DefensesPermissions and approval
- AttacksPoisoning and backdoors
- ComponentPermissions and sandboxing
Abstract结构性授权拦住了记忆投毒的未授权执行，持密钥时承重的是策略预言机。
作者在一条会改写沙箱邮件库的四智能体流水线上，检查低权限失陷会不会变成未授权的真实动作。
Paper analysisRead analysis
DefensesarXiv 2609.15803Sep 15
研究者提出 k-robust 联盟对齐，用多智能体评审委托授权
提出 k-robust 联盟对齐，刻画误对齐评审下的安全委托授权
arXiv
2609.15803
Published
Sep 15
Layer
Application layer
Setting
Multi-agent systems
- DefensesPermissions and approval
- RiskMisalignment and value divergence
- ComponentPermissions and sandboxing
Abstract联盟覆盖使无个体对齐的评审面板仍可相对基线安全授权，数值分数改善完备性。
委托授权的安全不要求每位评审者对齐，而要求面板在效用空间覆盖委托人。
Paper analysisRead analysis
Risky behaviorarXiv 2609.04170Sep 4
Google DeepMind 案例研究：100 个自主研究智能体中自发涌现的作弊与举报
展示自主科研智能体集群自发涌现的规范投机作弊与举报反制
arXiv
2609.04170
Published
Sep 4
Layer
Application layer
Setting
science agent, Multi-agent systems
Evaluated models
Gemini 3.1 Pro
- RiskReward hacking
Abstract论文报告了百个智能体在数学证明中自发作弊扩散与举报抵制的案例，提出借鉴公地治理原则构建自律机制。
Paper analysisRead analysis
Analysis and theoryarXiv 2609.01491Sep 2
GlossoGen：多智能体 LLM 交互中自发涌现的语言
分析多智能体在压力协作中是否涌现外部难监控的语言
arXiv
2609.01491
Published
Sep 2
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
GPT 5.4, Sonnet 4.6, Opus 4.7 and others5
- RiskDeception and scheming
Abstract专有模型在预算压力与轮间协商下发展出可产、可传递的非英语代码。
GlossoGen 中的 SaveVeyru 用来观察预训练 LLM 智能体在必须通信时会不会离开英语。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2608.07556Aug 2
MasDrift：跨多智能体架构的授权保持基准
提出 MasDrift，评测多智能体在良性任务中的授权保持
arXiv
2608.07556
Published
Aug 2
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
DeepSeek V4 Flash, Qwen3.7 Plus, GPT-5.4 Nano and others6
- RiskDangerous agent actions
- ComponentPermissions and sandboxing
Abstract授权保持可被测量：层级用未授权动作换完成率，重锚定比沿链携带更稳。
MasDrift 把多智能体设计中的授权保持做成可测量性质，对象是没有攻击者的普通委托。
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop