Translation in progress Some entries still include text in the original language.
Oct 12 · Monday
Another 232 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
重测并扩展对 AI Agent 的提示注入，并用 Agent Card 欺骗操纵 A2A 选择
Published Oct 8
Evaluated models Ollama Mistral 0.9.5 , llama3-8b-8192 , gemini-2.0-flash-lite and others5 Abstract 单智能体过滤与分类可被格式或措辞绕过，A2A 选卡还会偏向名称和描述。作者在自建的 LangChain、AutoGen 和 A2A 系统上重测提示注入，并改 Agent Card 看选择是否偏移。摘要称试验主要凸显单智能体弱点，同时把攻击扩到多智能体。
提出跨通道分段攻击，利用 MCP 隐式信任外发敏感文件
Published Sep 16
Evaluated models GPT-4o , GPT-4o-mini , GPT-5.4 and others15 Abstract 论文揭示了 MCP 多通道隐式信任层级，通过跨通道分段与协议级利用突破现有防御，展示了严重的凭证外发风险。
提出 ContextLeak，用强化学习优化恶意工具描述，诱导 Agent 外泄运行时上下文
Published Aug 28
Evaluated models Qwen-3-8B , GPT-OSS-20B , Gemma-4-E4B-it and others11 提出 EVOMAL，诱导自演化编码 Agent 在创建技能时自我投毒并蠕虫传播
Published Aug 26
Evaluated models Devstral-Small-2 , Gemma-4-31B-IT , Qwen3-Coder-Next and others7 Abstract 论文指出了自演化智能体模仿检索代码的自我毒化漏洞，提出 EVOMAL 攻击与防御，阐明了供应链新风险。
提出 CompoSkill，将逐个通过扫描的技能编排为攻击链
Published Aug 17
Evaluated models GPT-5.4 , Gemini-3.1-flash , DeepSeek-V4 and others4 Abstract 论文分析了智能体技能组合风险，指出单包安全认证状态不具备可组合性，需转向路径级防护。
提出 CFD 跨会话分解攻击，利用工件来源缺口绕过工具型 Agent 的本地检查
Published Jun 8
Evaluated models GPT-4.1 , GPT-5-nano , Claude-3.5-Sonnet and others6 Abstract CFD 用无指令 artifact 把越狱拆到跨会话。CFD 针对工具型 LLM 智能体：利用 artifact 来源不被跟踪这一部署失败模式，把有害目标拆开后延迟组合。
Propose WebWeaver, which compromises only a single agent and recovers the multi-agent communication topology from conversation context.
Published Mar 12
Evaluated models Llama 3.1 8B , Qwen 2.5 7B , Mistral NeMo 12B and others6 Abstract WebWeaver infers topology from context.WebWeaver is an inference attack against the confidentiality of LLM-MAS communication topology: it controls only one arbitrary agent and recovers the full graph from dialogue context, rather than querying agent IDs.
You have reached the end