Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 19 papers

Filter4

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 233papers have no tags yet and are not included in filtered results.

Impact：Data and privacy leaks Impact：Availability and reliability Attack surface / entry point：Web pages and interfaces Attack surface / entry point：Tool responses Clear all

Another 233papers do not have category tags yet and are not included in filtered results.

AttacksarXiv 2610.12524Oct 8
An exploration of attacks on AI agent systems
重测并扩展对 AI Agent 的提示注入，并用 Agent Card 欺骗操纵 A2A 选择
arXiv
2610.12524
Published
Oct 8
Layer
Application layer
Setting
AI Agent
Evaluated models
Ollama Mistral 0.9.5, llama3-8b-8192, gemini-2.0-flash-lite and others5
- AttacksPrompt injection
- TechniqueEncoding and obfuscation
- ComponentMCP and skills
Abstract单智能体过滤与分类可被格式或措辞绕过，A2A 选卡还会偏向名称和描述。
作者在自建的 LangChain、AutoGen 和 A2A 系统上重测提示注入，并改 Agent Card 看选择是否偏移。摘要称试验主要凸显单智能体弱点，同时把攻击扩到多智能体。
Paper analysisRead analysis
DefensesarXiv 2610.08773Oct 7
AdvSim2Real 用任务与注入对手共同演化训练网页智能体
提出 AdvSim2Real，协同训练网页智能体抵御页面注入
arXiv
2610.08773
Published
Oct 7
Layer
Application layer
Setting
web agent
Evaluated models
Qwen3.5-4B
- DefensesModel hardening
- AttacksPrompt injection
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.08871Oct 6
CredLeak-Bench
提出 CredLeak-Bench，评测 Agent 面对钓鱼的凭据泄露与恢复
arXiv
2610.08871
Published
Oct 6
Layer
Application layer
Setting
web agent
Evaluated models
Claude Sonnet 5, Claude Opus 4.8, Gemini 3.6 Flash and others7
- AttacksPrompt injection
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.03448Oct 2
Study retests 15 prompt injection detectors: benchmark scores poorly predict agent deployment performance
重测提示注入检测器在 Agent 工具输出上的检出与任务阻断
arXiv
2610.03448
Published
Oct 2
Layer
Application layer
Setting
AI Agent
Evaluated models
Horizon-Labs, Wolf Defender, Prismor-1.5B and others15
- DefensesDetection and filtering
- AttacksPrompt injection
- ComponentGuardrails and judges
Abstract论文揭示公开基准无法反映智能体检测器表现，检测能力源于输入格式相似而非通用防御，建议基于工具输出与低误报评测。
Paper analysisRead analysis
DefensesarXiv 2609.33371Sep 27
论文提出保险库中介执行边界，评估 LLM Agent 的 API 凭据处理风险
提出并评测保险库中介执行边界，隔离 Agent 的 API 凭据
arXiv
2609.33371
Published
Sep 27
Layer
Application layer
Setting
AI Agent
Evaluated models
Corvic Security Vault
- DefensesInstruction–data separation
- AttacksPrompt injection
- ComponentPermissions and sandboxing
Abstract作者称，凭据分离可减少披露路径，但权限、操作授权和配置验证仍需独立控制。
这是一项智能体 API 凭据威胁分析及 Vault 执行边界的功能评测。作者关心的不是模型能否承诺保密，而是认证材料是否会进入模型、日志、记忆和执行代码。
Paper analysisRead analysis
AttacksarXiv 2609.28585Sep 23
论文提出持久计费状态概念，揭示工具调用 LLM Agent 的拒绝钱包攻击与防御
定义工具调用 Agent 的持久计费状态，提出拒绝钱包攻击与防御
arXiv
2609.28585
Published
Sep 23
Layer
Application layer
Setting
AI Agent
Evaluated models
GPT-4o, GPT-4o-mini, Mistral-Large and others7
- DefensesInstruction–data separation
- AttacksDenial of service
Abstract已准入工具返回的跨轮保留会重复计费。
这篇工作把工具调用智能体里跨轮保留、并被提供商反复计费的外部工具返回定义为 persistent billable state，并把它的主机侧再次送入决定当作控制点。。
Paper analysisRead analysis
AttacksarXiv 2609.27542Sep 23
Researchers use control token injection to delete gpt-oss-20b's reasoning chain and bypass chain-of-thought monitoring
提出控制标记注入，清空工具 Agent 的思维链以绕过推理监控
arXiv
2609.27542
Published
Sep 23
Layer
Application layer
Setting
AI Agent
Evaluated models
openai/gpt-oss-20b, google/gemma-4-26B-A4B-it, deepseek-ai/DeepSeek-R1-Distill-Qwen-7B and others4
- AttacksPrompt injection
- TechniqueConversation structure manipulation
- ComponentReasoning chains
Abstract论文阐明控制标记注入可抑制 CoT 使监控失效并促成拒绝绕过，且工具执行受解析器宽容度影响。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.19140Sep 17
AgentLSD：在对抗性任务污染下评测 AI 安全 Agent
评测安全 Agent 在对抗性任务污染下的解题成功与开销
arXiv
2609.19140
Published
Sep 17
Layer
Application layer
Setting
web agent
Evaluated models
Gemma-4 31B, DeepSeek-V4 Flash, GPT-OSS 120B and others6
- AttacksPrompt injection
AbstractAgentLSD 用配对 web CTF 表明，欺骗性环境证据会改变安全智能体的解题率与工作量。
AgentLSD 是一个对照框架，用来测量安全智能体在任务本身不变时，对对抗性任务污染的反应。
Paper analysisRead analysis
AttacksarXiv 2609.18217Sep 16
研究：跨通道碎片化攻击可绕过 MCP 单通道防御
提出跨通道分段攻击，利用 MCP 隐式信任外发敏感文件
arXiv
2609.18217
Published
Sep 16
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-4o, GPT-4o-mini, GPT-5.4 and others15
- AttacksPrompt injection
- TechniqueEncoding and obfuscation
- ComponentMCP and skills
Abstract论文揭示了 MCP 多通道隐式信任层级，通过跨通道分段与协议级利用突破现有防御，展示了严重的凭证外发风险。
Paper analysisRead analysis
DefensesarXiv 2609.07529Sep 7
CoER：用对抗协同演化与精炼防御自适应间接提示注入
提出 CoER，用对抗共进化与精炼训练工具智能体抵御自适应间接提示注入
arXiv
2609.07529
Published
Sep 7
Layer
Application layer
Setting
AI Agent
Evaluated models
Qwen3.5-9B
- DefensesModel hardening
- AttacksPrompt injection
Paper analysisRead analysis
DefensesarXiv 2609.04875Sep 4
Forgetting without restart: execution-state forgetting for stateful LLM agents
Proposes execution-state forgetting, using provenance-guided selective replay to purify stateful agents
arXiv
2609.04875
Published
Sep 4
Layer
Application layer
Setting
AI Agent
Evaluated models
Llama-3.1-8B-Instruct, Qwen2.5-7B-Instruct, Mistral-7B-Instruct-v0.3
- AttacksPrompt injection
- ComponentMemory
AbstractSelective replay concatenates the clean prefix with the sanitized suffix, and main-table metrics match full reset.
This work defines forgetting in long-horizon agents as runtime counterfactual equivalence, rather than deleting a plaintext memory.
Paper analysisRead analysis
DefensesarXiv 2608.24017Aug 25
WebMCP-Phalanx：为浏览器内 LLM Agent 工具调用建立信任边界
提出 WebMCP-Phalanx，用能力凭证与双智能体隔离浏览器工具调用
arXiv
2608.24017
Published
Aug 25
Layer
Application layer
Setting
web agent
- DefensesPermissions and approval
- AttacksPrompt injection
- ComponentMCP and skills
AbstractPhalanx 用浏览器凭证绑定工具所有权，Q/P 分离拦住描述注入，工具名与返回值仍有残留。
WebMCP-Phalanx针对浏览器里的 WebMCP 智能体：在 SOP 下补工具所有权，并把语义检查从有工具权的执行中分开。
Paper analysisRead analysis
DefensesarXiv 2608.22868Aug 24
AgentFlow：面向 LLM 智能体系统的流中心策略语言与运行时防护框架
提出 AgentFlow 流策略语言与运行时框架，约束智能体跨步数据流
arXiv
2608.22868
Published
Aug 24
Layer
Application layer
Setting
AI Agent
- DefensesInstruction–data separation
- AttacksPrompt injection
- ComponentPermissions and sandboxing
Paper analysisRead analysis
AttacksarXiv 2608.04741Aug 5
LoginTrap：针对 LLM Web Agent 的任务无关钓鱼式间接提示注入攻击
提出 LoginTrap，以网页弹窗诱导 Web Agent 提交敏感信息
arXiv
2608.04741
Published
Aug 5
Layer
Application layer
Setting
web agent
Evaluated models
GPT-4o, Gemini 3 Flash, Claude Sonnet 4 and others7
- AttacksPrompt injection
- TechniqueAutomated search
Abstract揭示网络智能体在黑盒网页下的登录诱导风险，利用模糊测试生成话术并跨骨干和架构验证了隐私泄露威胁。
Paper analysisRead analysis
AttacksarXiv 2607.26115Jul 29
OpenAI releases GPT-Red: training automated red-teaming agents through self-play
训练自博弈红队智能体 GPT-Red，规模化生成提示注入与越狱攻击
arXiv
2607.26115
Published
Jul 29
Layer
Application layer
Setting
AI Agent
Attacker
Black-box
Evaluated models
GPT-5.6, GPT-5.5, GPT-5.4 and others8
- AttacksPrompt injection
- TechniqueAutomated search
Paper analysisRead analysis
AttacksarXiv 2606.14517Jun 12
Researchers disclose a reasoning-amplified denial-of-service attack against LLM agent guardrails
提出针对 Agent 护栏的推理扩展拒绝服务攻击
arXiv
2606.14517
Published
Jun 12
Layer
Application layer
Setting
AI Agent
Attacker
Black-box
Evaluated models
TS-Guard-8B, Qwen3.5-9B, DeepSeek-V3.2 and others11
- AttacksDenial of service
- TechniqueReasoning-chain manipulation
- ComponentGuardrails and judges
Paper analysisRead analysis
AttacksarXiv 2605.05509May 7
研究者提出面向 Agent 浏览器的 Web 威胁模型，梳理 20 类攻击并在 4 个模型上复现
提出面向智能体浏览器的 Web 威胁模型并复现混淆攻击
arXiv
2605.05509
Published
May 7
Layer
Application layer
Setting
web agent
Evaluated models
GPT-5, Claude-Sonnet-4.6, Kimi-k2p5 and others8
- AttacksPrompt injection
Abstract作者提出面向智能体浏览器的 Web 威胁模型与攻击分类，测试显示传统混淆攻击可复现且能绕过现有防御。
这篇论文研究了智能体浏览器在面临传统 Web 攻击者时的安全性问题，指出当前针对提示词注入的安全假设无法抵御基于正常 Web 交互模式的混淆攻击。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2605.01970May 4
Trojan Hippo Bench: A Dynamic Benchmark for Persistent Memory Attacks and Defenses on LLM Agents
构建 Trojan Hippo Bench，评测 Agent 持久记忆投毒与外泄
arXiv
2605.01970
Published
May 4
Layer
Application layer
Setting
AI Agent
Evaluated models
Gemini 3.1 Pro, GPT-5-mini, GPT-5
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMemory
Abstract论文提出了评测智能体持久化记忆攻击与防御的 Trojan Hippo Bench，揭示了潜伏攻击威胁及内存防御的安全与效用权衡。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2604.01438Apr 2
ClawSafety: Safe LLM, Unsafe Agent
提出 ClawSafety，评测个人智能体读到对抗工件后是否执行有害动作
arXiv
2604.01438
Published
Apr 2
Layer
Application layer
Setting
AI Agent
Evaluated models
Claude Sonnet 4.6, GPT-5.1, Gemini 2.5 Pro and others5
- AttacksPrompt injection
- ComponentMCP and skills
Paper analysisRead analysis

You have reached the end

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop

All papers

Attack type

Attack technique

Defense type

Impact

System type

Attack surface / entry point

Layer

System component

An exploration of attacks on AI agent systems

AdvSim2Real 用任务与注入对手共同演化训练网页智能体

CredLeak-Bench

Study retests 15 prompt injection detectors: benchmark scores poorly predict agent deployment performance

论文提出保险库中介执行边界，评估 LLM Agent 的 API 凭据处理风险

论文提出持久计费状态概念，揭示工具调用 LLM Agent 的拒绝钱包攻击与防御

Researchers use control token injection to delete gpt-oss-20b's reasoning chain and bypass chain-of-thought monitoring

AgentLSD：在对抗性任务污染下评测 AI 安全 Agent

研究：跨通道碎片化攻击可绕过 MCP 单通道防御

CoER：用对抗协同演化与精炼防御自适应间接提示注入

Forgetting without restart: execution-state forgetting for stateful LLM agents

WebMCP-Phalanx：为浏览器内 LLM Agent 工具调用建立信任边界

AgentFlow：面向 LLM 智能体系统的流中心策略语言与运行时防护框架

LoginTrap：针对 LLM Web Agent 的任务无关钓鱼式间接提示注入攻击

OpenAI releases GPT-Red: training automated red-teaming agents through self-play

Researchers disclose a reasoning-amplified denial-of-service attack against LLM agent guardrails

研究者提出面向 Agent 浏览器的 Web 威胁模型，梳理 20 类攻击并在 4 个模型上复现

Trojan Hippo Bench: A Dynamic Benchmark for Persistent Memory Attacks and Defenses on LLM Agents

ClawSafety: Safe LLM, Unsafe Agent