Skip to content

Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 6 papers
Filter3

Attack type

Prompt injection3

Impact

Unauthorized actions16Data and privacy leaks6Output manipulation12

System type

AI Agent5

Attack surface / entry point

User input31Web pages and interfaces3Documents and messages5Tool responses3Tool and skill descriptions5Code repositories and dependencies3Memory writes4Images, audio and video3Weights and gradients10Distribution channels6Inference services and hardware6

Layer

Application layer5
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 233papers have no tags yet and are not included in filtered results.
Impact：Data and privacy leaksAttack surface / entry point：Web pages and interfacesAttack surface / entry point：Code repositories and dependenciesClear all

Another 233papers do not have category tags yet and are not included in filtered results.

  1. AttacksarXiv 2610.12524

    An exploration of attacks on AI agent systems

    重测并扩展对 AI Agent 的提示注入，并用 Agent Card 欺骗操纵 A2A 选择

    arXiv
    2610.12524
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    Ollama Mistral 0.9.5, llama3-8b-8192, gemini-2.0-flash-lite and others5
    Abstract单智能体过滤与分类可被格式或措辞绕过，A2A 选卡还会偏向名称和描述。

    作者在自建的 LangChain、AutoGen 和 A2A 系统上重测提示注入，并改 Agent Card 看选择是否偏移。摘要称试验主要凸显单智能体弱点，同时把攻击扩到多智能体。

    Paper analysisRead analysis
  2. AttacksarXiv 2610.07510

    PersistBD: attackers can strengthen backdoors before release so that they maintain high attack success rates even after developer SFT and RL.

    提出 PERSISTBD，发布前强化供应链后门使其经良性 SFT 与 RL 后仍外发凭据

    arXiv
    2610.07510
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    Qwen2.5-Coder-3B-Instruct, Qwen2.5-Coder-7B-Instruct, Qwen3-Coder-30B-A3B-Instruct
    Abstract总结了论文关于后门在 SFT/RL 中存活的发现、两因子机制、PERSISTBD 方法与核心数字。

    本文研究第三方 LLM 智能体在开发者进行良性监督微调（SFT）和强化学习（RL）后训练时的后门持久性风险。

    Paper analysisRead analysis
  3. AttacksarXiv 2610.01768

    LLMLeak：借 LLM 合法网页抓取实施隐蔽数据外泄

    提出 LLMLeak，借合法网页抓取把 URL 中的秘密隐蔽外传

    arXiv
    2610.01768
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    Meta-Llama-3.3-70B-Instruct, Meta-Llama-4-Scout-17B-16E-Instruct, Meta-Llama-3.1-8B-Instruct and others18
    Abstract作者称第三方外传可发生于正常网页获取，防护需考虑工具请求而不只考虑提示注入。

    LLMLeak 是利用网页获取请求携带预先编码秘密的隐蔽通道攻击。它关注恶意软件已能读取数据、却因网络限制或监控无法直接外传的情形。

    Paper analysisRead analysis
  4. AttacksarXiv 2608.09867

    Researchers steal proprietary LLM inference chains via cross-model compatibility of encrypted inference blocks

    利用加密思维块的跨模型重放，诱导弱模型逐字转写专有推理链

    arXiv
    2608.09867
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    Claude Opus 4.8, Claude Sonnet 4.6, Claude Haiku 4.5 and others13

    Abstract论文揭示了客户端加密思维块跨模型互换漏洞，提出了低成本提取方法并给出防御方案。

    Paper analysisRead analysis
  5. AttacksarXiv 2608.04741

    LoginTrap：针对 LLM Web Agent 的任务无关钓鱼式间接提示注入攻击

    提出 LoginTrap，以网页弹窗诱导 Web Agent 提交敏感信息

    arXiv
    2608.04741
    Published
    Layer
    Application layer
    Setting
    web agent
    Evaluated models
    GPT-4o, Gemini 3 Flash, Claude Sonnet 4 and others7

    Abstract揭示网络智能体在黑盒网页下的登录诱导风险，利用模糊测试生成话术并跨骨干和架构验证了隐私泄露威胁。

    Paper analysisRead analysis
  6. AttacksarXiv 2605.05509

    研究者提出面向 Agent 浏览器的 Web 威胁模型，梳理 20 类攻击并在 4 个模型上复现

    提出面向智能体浏览器的 Web 威胁模型并复现混淆攻击

    arXiv
    2605.05509
    Published
    Layer
    Application layer
    Setting
    web agent
    Evaluated models
    GPT-5, Claude-Sonnet-4.6, Kimi-k2p5 and others8
    Abstract作者提出面向智能体浏览器的 Web 威胁模型与攻击分类，测试显示传统混淆攻击可复现且能绕过现有防御。

    这篇论文研究了智能体浏览器在面临传统 Web 攻击者时的安全性问题，指出当前针对提示词注入的安全假设无法抵御基于正常 Web 交互模式的混淆攻击。

    Paper analysisRead analysis
You have reached the end