Skip to content

Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 17 papers
Filter4

Attack type

Prompt injection13Poisoning and backdoors8

Attack technique

Automated search3Dormant triggers6

Impact

Unauthorized actions56Data and privacy leaks17Output manipulation32

System type

AI Agent16coding agent3

Attack surface / entry point

User input23Web pages and interfaces6Documents and messages9Tool responses9Tool and skill descriptions11Code repositories and dependencies3Memory writes9Inter-agent messages6Images, audio and video3Distribution channels7

Layer

Application layer17

System component

MCP and skills3Memory9
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 254papers have no tags yet and are not included in filtered results.
Impact：Data and privacy leaksAttack surface / entry point：Documents and messagesAttack surface / entry point：Memory writesLayer：Application layerClear all

Another 254papers do not have category tags yet and are not included in filtered results.

  2. AttacksarXiv 2610.04589

    StegoMemory red team testing: agent persistent memory can be used as a cross-session covert channel

    提出 StegoMemory，评测智能体持久记忆作为跨会话隐写信道

    arXiv
    2610.04589
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    Llama 3.1 405B, Claude 3.5 Sonnet, GPT-4o and others13

    Abstract研究揭示智能体持久记忆可作为隐蔽信道跨会话传输机密，写入持久化是主要防御瓶颈，呼吁建立记忆完整性防御。

    Paper analysisRead analysis
  4. DefensesarXiv 2610.00371

    FlowReview：以授权配对评测控制多智能体组合信息流

    提出 FlowReview，用授权配对与确定性提交门控控制多智能体组合信息流

    arXiv
    2610.00371
    Published
    Layer
    Application layer
    Setting
    Multi-agent systems
    Evaluated models
    Sonnet 4.5, Haiku 4.5, Qwen3-32B and others5
    Abstract配对标准要求拒绝禁止使用并完成授权使用，FlowReview 把三项审查接到执行。

    这篇工作把多智能体安全写成一件必须同时成立的事：拦住组合信息所启用的禁止使用，并完成同一场景里任务所需的授权使用。

    Paper analysisRead analysis
  6. AttacksarXiv 2609.27542

    Researchers use control token injection to delete gpt-oss-20b's reasoning chain and bypass chain-of-thought monitoring

    提出控制标记注入，清空工具 Agent 的思维链以绕过推理监控

    arXiv
    2609.27542
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    openai/gpt-oss-20b, google/gemma-4-26B-A4B-it, deepseek-ai/DeepSeek-R1-Distill-Qwen-7B and others4

    Abstract论文阐明控制标记注入可抑制 CoT 使监控失效并促成拒绝绕过，且工具执行受解析器宽容度影响。

    Paper analysisRead analysis
  7. AttacksarXiv 2609.13889

    PMPA：针对 OpenClaw 与 Claude Code 的持久记忆投毒攻击

    提出 PMPA，经外部源向 Agent 持久记忆投毒并跨会话泄露隐私

    arXiv
    2609.13889
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    DeepSeek-V4-Flash, DeepSeek-V4-Pro, Qwen3-Max

    Abstract论文提出了持久记忆投毒攻击 PMPA，报告了 harness 智能体在处理外部数据时易受跨会话记忆投毒与隐私泄露的风险。

    Paper analysisRead analysis
  8. AttacksarXiv 2609.12448

    GraphProfiler 用个人知识图谱推断敏感属性并溯源到具体帖子

    提出 GraphProfiler，用个人知识图谱从帖子历史推断敏感属性并溯源

    arXiv
    2609.12448
    Published
    Layer
    Application layer
    Setting
    LLM applications
    AbstractGraphProfiler 用源链接个人知识图谱做属性推断，准确率接近文本基线，并把证据定位到少量源帖。

    GraphProfiler 是一个可审计的 LLM 敏感属性画像器：用源链接个人知识图谱，把推断落到具体帖子。

    Paper analysisRead analysis
  9. DefensesarXiv 2609.04875

    Forgetting without restart: execution-state forgetting for stateful LLM agents

    Proposes execution-state forgetting, using provenance-guided selective replay to purify stateful agents

    arXiv
    2609.04875
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    Llama-3.1-8B-Instruct, Qwen2.5-7B-Instruct, Mistral-7B-Instruct-v0.3
    AbstractSelective replay concatenates the clean prefix with the sanitized suffix, and main-table metrics match full reset.

    This work defines forgetting in long-horizon agents as runtime counterfactual equivalence, rather than deleting a plaintext memory.

    Paper analysisRead analysis
  10. AttacksarXiv 2608.05563

    研究者提出 PoisonedEvolution 轨迹投毒攻击

    提出 PoisonedEvolution 轨迹投毒，诱导自演化技能系统固化恶意行为

    arXiv
    2608.05563
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    GPT-5.4, MiniMax-M2.5, DeepSeek-V3.2 and others6
    Abstract论文揭示自演化技能系统的证据晋升漏洞，提出并验证轨迹投毒攻击。

    这篇论文揭示了自演化技能系统在将交互经验转化为持久指令时的安全风险。

    Paper analysisRead analysis
  13. Evaluation and benchmarksarXiv 2607.14611

    论文评测 Claude Code 与 Codex 记忆文件中的提示注入风险

    评测编码 Agent 记忆文件中提示注入的跨会话影响

    arXiv
    2607.14611
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    Claude Haiku 4.5, Claude Opus 4.7, GPT-5.2 and others4
    Abstract已植入记忆文件的载荷可以跨会话影响 Claude Code 与 Codex，攻击成功与载荷是否留下是两种不同的失败。

    Bad Memory 在沙箱合成工作区里评测文件型持久记忆上的提示注入，比较载荷能否改变当前会话，以及能否在后续会话中留下或叠加。

    Paper analysisRead analysis
  14. AttacksarXiv 2606.09084

    研究者提出 Context-Fractured Decomposition 攻击

    提出 CFD 跨会话分解攻击，利用工件来源缺口绕过工具型 Agent 的本地检查

    arXiv
    2606.09084
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    GPT-4.1, GPT-5-nano, Claude-3.5-Sonnet and others6
    AbstractCFD 用无指令 artifact 把越狱拆到跨会话。

    CFD针对工具型 LLM 智能体：利用 artifact 来源不被跟踪这一部署失败模式，把有害目标拆开后延迟组合。

    Paper analysisRead analysis
  15. DefensesarXiv 2605.17380

    Uber proposes ADR enterprise-level agent detection system, deployed on 7,200 hosts for ten months

    提出企业级检测系统 ADR，识别编程 Agent 的提示注入与恶意 MCP

    arXiv
    2605.17380
    Published
    Layer
    Application layer
    Setting
    coding agent

    Abstract提出了端点因果遥测、两级在线分流与离线红队闭环的 ADR 系统，并在生产环境中验证了有效性。

    Paper analysisRead analysis
  16. Evaluation and benchmarksarXiv 2605.01970

    Trojan Hippo Bench: A Dynamic Benchmark for Persistent Memory Attacks and Defenses on LLM Agents

    构建 Trojan Hippo Bench，评测 Agent 持久记忆投毒与外泄

    arXiv
    2605.01970
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    Gemini 3.1 Pro, GPT-5-mini, GPT-5

    Abstract论文提出了评测智能体持久化记忆攻击与防御的 Trojan Hippo Bench，揭示了潜伏攻击威胁及内存防御的安全与效用权衡。

    Paper analysisRead analysis
You have reached the end