Translation in progress Some entries still include text in the original language.
Oct 13 · Tuesday
All papers Found 12 papers Another 201 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
提出 WebMirage，用局部对抗图像劫持视觉网页 Agent 的浏览器操作
Published Oct 7
Evaluated models LLaVA-v1.5-13B , LLaVA-v1.6-34B , MiniCPM-o-8B and others6 Abstract 论文提出了针对网络智能体的端到端视觉红队框架 WebMirage，揭示了从视觉定位到浏览器执行的安全脆弱性。WebMirage 是一个面向视觉定位网络智能体的流水线感知端到端红队攻击框架。
提出 CredLeak-Bench，评测 Agent 面对钓鱼的凭据泄露与恢复
Published Oct 6
Evaluated models Claude Sonnet 5 , Claude Opus 4.8 , Gemini 3.6 Flash and others7 提出 ZoneClaw，用记忆分区防御计算机使用 Agent 的持久记忆攻击
Published Oct 1
Evaluated models Claude Sonnet 4.6 , GPT-5.5 , GLM-5.2 and others4 用 DIBench 评测移动 GUI 智能体被 UI 注入后的决策完整性
Published Sep 29
Evaluated models Qwen2.5-VL(32B) , Qwen3-VL(32B) , GUI-Owl(32B) and others7 Abstract 论文提出移动智能体决策完整性基准 DIBench，发现欺诈 UI 注入诱导目标选择并推高完成率，通用防御收益不稳定。
提出 WebTrap 三阶段陷阱，中途劫持浏览器 Agent 完成攻击后再返回用户任务
Published May 8
Evaluated models DeepSeek-V3.1-Terminus , Gemini-2.5-Flash , GLM-4.5-Air and others5 Abstract WebTrap 把攻击目标嵌进用户流程中途执行再返回。WebTrap 是针对长程网页与文件导航的中途劫持注入，目标是在完成攻击动作后仍回到用户任务。
Conduct adversarial attacks on product images for open-source visual shopping agents and induce wrong purchases
Published Mar 17
Evaluated models LLaVA-v1.5-7B , Qwen2.5-VL-7B Abstract The authors state that LLaVA is easily induced by three attacks to buy the wrong item, while Qwen's correct purchase rate remains close to its clean condition.The authors compare the robustness of two open-source VLM shopping agents against image adversarial perturbations in a self-built e-commerce environment.
Proposes out-of-process dual-channel comparison classification to intercept erroneous clicks by computer-use agents
Published Mar 16
Evaluated models multi-modal-embed-small Abstract Perception errors can be exploited by swapping screen pixels.The authors frame CUA's perception failure as a security vulnerability, visual confused deputy : the agent authorizes click(x,y) based on a misread screen, and the actual landing point differs from the element it believes it is clicking.
Proposes Aura, which uses a trusted kernel to mediate the identity, perception, and action control of mobile agents
Published Feb 11
Evaluated models Gemini-3-Flash Abstract Aura mediates structured interactions via the Agent Kernel.Aura uses kernel-mediated structured agent interaction, replacing screen-interface mobile assistants. .
构建 TRAP 基准，评测网页 Agent 被界面提示注入劫持任务的情况
Published Dec 29, 2025
Evaluated models GPT-5 , Claude Sonnet 3.7 , Gemini 2.5 Flash and others6 Abstract 论文提出了基于五维模块化攻击空间的 TRAP 基准，评估了六个模型在真实网页环境中的注入风险。研究定位 ：针对网页自主智能体易受外部界面提示注入攻击的问题，构建了基于真实网站克隆的模块化评测基准 TRAP。
用 MobiRed 评测移动 LLM Agent 面对第三方渠道的提示注入
Published Oct 31, 2025
Evaluated models Mobile-Agent-E , AppAgent , AutoGLM and others8 Abstract 论文评估了移动 LLM 智能体作为 confused deputy 的易受攻击性，作者称非应用控制通道可诱导智能体执行多步越权危害。
提出 WAInjectBench 评测网页 Agent 的提示注入检测
Published Oct 2, 2025
Evaluated models GPT-4o , Mistral-7B-Instruct-v0.1 , Llama-Prompt-Guard-2-86M and others8 Abstract WAInjectBench 比较网页智能体的提示注入检测：显式线索可被部分检出，隐蔽攻击大多漏检。WAInjectBench 是网页智能体提示注入检测的基准。作者要看现有检测器能否发现这类攻击：攻击者改网页，使智能体执行目标动作，而不是用户任务。作者称这是首个此类综合基准。
Attacks arXiv 2406.12814 · Jun 19, 2024 提出 ARE 框架与图像文本攻击，评测多模态网页 Agent 的对抗鲁棒性
Published Jun 19, 2024
Evaluated models GPT-4o , GPT-4V , Claude-3-Opus and others4 Abstract 系统评估多模态网页智能体的脆弱性，指出推理时计算组件被攻破会加剧系统风险。
You have reached the end