Translation in progress Some entries still include text in the original language.

Oct 13 · Tuesday

All papers

Found 9 papers

Filter4

Attack type

Prompt injection7 Poisoning and backdoors6

Defense type

Permissions and approval3

Impact

Unauthorized actions4 Output manipulation4

System type

LLM applications8 AI Agent99 coding agent7 science agent1 web agent22 Browser and computer use7 Multi-agent systems8

Attack surface / entry point

User input13 Web pages and interfaces3 Documents and messages6 Tool responses5 Tool and skill descriptions3 Retrieval corpus3 Memory writes6 Inter-agent messages25

Layer

Application layer9

System component

Memory5 Permissions and sandboxing3

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 227papers have no tags yet and are not included in filtered results.

System type：science agent System type：Multi-agent systems Attack surface / entry point：Web pages and interfaces Attack surface / entry point：Memory writes Clear all

Another 227papers do not have category tags yet and are not included in filtered results.

DefensesarXiv 2610.07657Oct 6
DEFER1 多智能体防御研究报告受控测试中的攻击成功率下降
实现 DEFER，以确定性检查优先拦截多智能体流水线的内容攻击
arXiv
2610.07657
Published
Oct 6
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
Qwen3-235B-A22B-Instruct-2507, gpt-oss-120b, Llama-4-Scout-17B-16E-Instruct and others5
- DefensesPermissions and approval
- AttacksPrompt injection
- ComponentGuardrails and judges
AbstractDEFER 把确定性检查放在 judge 之前。
DEFER 用来测量多智能体授权流水线里，确定性规则在何处结束、LLM judge 从何处开始。
Paper analysisRead analysis
DefensesarXiv 2610.05640Oct 5
Research reveals that the CaMeL defense fails in multi-agent systems and proposes multi-CaMeL
提出 multi-CaMeL，在智能体调用边界隔离可信指令与非可信数据
arXiv
2610.05640
Published
Oct 5
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
Claude Fable 5, GPT-5.5, GPT-4.1 and others6
- DefensesInstruction–data separation
- AttacksPrompt injection
Abstract论文针对多智能体中单体防御不组合的边界清洗问题，提出 multi-CaMeL 协议彻底阻断了 MultiAgentDojo 上的注入攻击。
Paper analysisRead analysis
DefensesarXiv 2610.00371Sep 30
FlowReview：以授权配对评测控制多智能体组合信息流
提出 FlowReview，用授权配对与确定性提交门控控制多智能体组合信息流
arXiv
2610.00371
Published
Sep 30
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
Sonnet 4.5, Haiku 4.5, Qwen3-32B and others5
- DefensesPermissions and approval
- AttacksPrompt injection
- ComponentPermissions and sandboxing
Abstract配对标准要求拒绝禁止使用并完成授权使用，FlowReview 把三项审查接到执行。
这篇工作把多智能体安全写成一件必须同时成立的事：拦住组合信息所启用的禁止使用，并完成同一场景里任务所需的授权使用。
Paper analysisRead analysis
DefensesarXiv 2609.17648Sep 15
多智能体 LLM 流水线中的信任传播与结构隔离
用任务绑定令牌和策略预言机拦住多智能体流水线的未授权执行
arXiv
2609.17648
Published
Sep 15
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
gemma4:31b-cloud
- DefensesPermissions and approval
- AttacksPoisoning and backdoors
- ComponentPermissions and sandboxing
Abstract结构性授权拦住了记忆投毒的未授权执行，持密钥时承重的是策略预言机。
作者在一条会改写沙箱邮件库的四智能体流水线上，检查低权限失陷会不会变成未授权的真实动作。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2608.03272Aug 4
多智能体协同过滤系统的连接性攻击与防御研究
复现 AgentCF 上的多智能体攻防并刻画连通性作用
arXiv
2608.03272
Published
Aug 4
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
Qwen3-235B-A22B, Claude Haiku 4.5, Mixtral 8×7B and others4
- AttacksPoisoning and backdoors
- ComponentMemory
Abstract连通性沿 k 与ρ改变攻防，且用户/物品与早期/稳态需要分开看。
作者在 AgentCF 上研究连通性如何改变多智能体协同过滤的攻防，复现已有方法而不是提出新载荷。
Paper analysisRead analysis
AttacksarXiv 2608.00718Aug 1
研究揭示多智能体 LLM 流水线的结构性漏洞
提出多智能体流水线的边界攻击，使对抗内容作为可信输入跨层传播
arXiv
2608.00718
Published
Aug 1
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
GPT-5-mini, Claude Sonnet 4.5, Kimi K2.5
- AttacksPrompt injection
Abstract缺边界校验使对抗内容跨智能体传播，作者称这是架构属性而非模型能力。
作者把多智能体 LLM 流水线的对抗问题定义为缺少边界校验，并用生产轨迹和受控实验检查脆弱性来自架构还是骨干模型。中间输出未经验证就传给下游。作者认为，一旦某级接受对抗内容，后续智能体会把它当作可信输入。
Paper analysisRead analysis
AttacksarXiv 2607.10712Jul 12
研究提出间接数据投毒攻击，可操纵 Claude、Codex 与 Gemini 的科研结论
提出间接数据投毒攻击，操纵科研智能体得出虚假结论
arXiv
2607.10712
Published
Jul 12
Layer
Application layer
Setting
science agent
Evaluated models
Claude Code with Claude Opus 4.7, Codex with GPT-5.5, Gemini CLI with Gemini 3.1 Pro
- DefensesInstruction–data separation
- AttacksPoisoning and backdoors
Paper analysisRead analysis
AttacksarXiv 2605.08460May 9
论文建模多智能体网络中的子智能体继承攻击面
建模并利用多智能体网络中子智能体生成时的记忆继承漏洞
arXiv
2605.08460
Published
May 9
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
MiniMax M2.5, Llama-4-Maverick-17B-128E-Instruct-FP8, Qwen3.5-Plus and others5
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMemory
Abstract形式化子智能体继承，在 OpenClaw 上演示四类编排层漏洞并提出防御。
作者对多智能体网络里的子智能体继承做形式化分析，并用开源框架上的 PoC 演示编排层如何让单点妥协继续扩散。
Paper analysisRead analysis
AttacksarXiv 2601.00240Jan 1
When agents view humans as out-group: belief-dependent bias in LLM-driven agents
提出 BPA 改写 profile 与记忆，重新诱发智能体对人类的外群体偏向
arXiv
2601.00240
Published
Jan 1
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
gpt-4o-mini
- AttacksPoisoning and backdoors
- RiskBias and discrimination
- TechniqueDormant triggers
- ComponentMemory
Abstract最小群体线索下出现内群体偏向。
作者考察 LLM 智能体在任意群体边界下会不会把人类当外群体，并用信念投毒检验面向人类的抑制是否依赖身份信念。
Paper analysisRead analysis

You have reached the end

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop