Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 37 papers

Filter3

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 254papers have no tags yet and are not included in filtered results.

Attack surface / entry point：Tool responses Attack surface / entry point：Weights and gradients Layer：Application layer Clear all

Another 254papers do not have category tags yet and are not included in filtered results.

AttacksarXiv 2610.12292Oct 9
The paper proposes an option channel attack: changing one option label can make an agent guardrail allow a prohibited operation
Proposing an option channel attack that renames option labels so that agent guardrails allow prohibited operations
arXiv
2610.12292
Published
Oct 9
Layer
Application layer
Setting
LLM applications
Attacker
Black-box
Evaluated models
LAYA-TD, LAYA-EN, LAYA-ML and others5
- AttacksDetection evasion
- ComponentGuardrails and judges
AbstractThe authors' evaluation indicates that typed models should not serve as final safety arbiters; they are susceptible to off-policy text and option name manipulation, and confidence filtering cannot resist attacks.
Paper analysisRead analysis
AttacksarXiv 2610.09973Oct 7
从期望危害到似然：LLM 智能体越狱的概率重构
提出 OPUR 攻击，用似然梯度优化对抗后缀越狱 LLM 智能体
arXiv
2610.09973
Published
Oct 7
Layer
Application layer
Setting
AI Agent
Attacker
White-box
Evaluated models
Llama-3.1-8B-Instruct, Ministral-8B-Instruct-2410
- AttacksJailbreaks
- TechniqueGradient and representation optimization
Paper analysisRead analysis
AttacksarXiv 2610.08951Oct 7
ASPIRE：面向 LLM Agent 的开放式提示注入红队引擎
提出 ASPIRE 行为图搜索，开放式发现 Agent 提示注入漏洞
arXiv
2610.08951
Published
Oct 7
Layer
Application layer
Setting
AI Agent
Evaluated models
Gemini-3.7-Flash, DeepSeek-V4-Flash, Gemini-2.5-flash
- AttacksPrompt injection
- TechniqueAutomated search
AbstractASPIRE 把提示注入红队从载荷优化改成行为图引导的开放式漏洞发现。
ASPIRE 是给搭建方用的智能体提示注入红队引擎，目标是开放式画出可利用的行为路径，而不是在固定任务上打磨一条载荷。
Paper analysisRead analysis
AttacksarXiv 2610.07510Oct 6
PersistBD: attackers can strengthen backdoors before release so that they maintain high attack success rates even after developer SFT and RL.
提出 PERSISTBD，发布前强化供应链后门使其经良性 SFT 与 RL 后仍外发凭据
arXiv
2610.07510
Published
Oct 6
Layer
Application layer
Setting
coding agent
Evaluated models
Qwen2.5-Coder-3B-Instruct, Qwen2.5-Coder-7B-Instruct, Qwen3-Coder-30B-A3B-Instruct
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentFine-tuning and open weights
Abstract总结了论文关于后门在 SFT/RL 中存活的发现、两因子机制、PERSISTBD 方法与核心数字。
本文研究第三方 LLM 智能体在开发者进行良性监督微调（SFT）和强化学习（RL）后训练时的后门持久性风险。
Paper analysisRead analysis
AttacksarXiv 2609.39788Sep 30
研究：多智能体系统潜在通信链路可被训练用于提升有害顺从
提出只训练或篡改多智能体潜在通信链路来提高有害遵从
arXiv
2609.39788
Published
Sep 30
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
Llama-3.2-3B-Instruct, Qwen2.5-3B-Instruct, Gemma-3-1B-IT and others7
- AttacksModel tampering
- TechniqueGradient and representation optimization
Abstract潜在链路本身即可改变冻结智能体系统的安全，奖励既能攻击也能修复。
学习得到的潜在通信链路会改变由冻结、对齐智能体组成的系统是否遵从有害请求。。作者研究三种拓扑：双智能体、三级顺序协作，以及双专家加汇总。
Paper analysisRead analysis
AttacksarXiv 2609.36576Sep 29
AdaLCPI：让 Agent 从长上下文碎片中重建间接提示注入
提出 AdaLCPI，把恶意指令拆成碎片嵌入工具返回并诱导 Agent 越权执行
arXiv
2609.36576
Published
Sep 29
Layer
Application layer
Setting
AI Agent
Evaluated models
GPT-4.1, GPT-5.1, GPT-5.6-Luna and others7
- AttacksPrompt injection
- TechniqueEncoding and obfuscation
Paper analysisRead analysis
AttacksarXiv 2609.33628Sep 27
用课程强化学习对前沿模型做提示注入红队测试
用跨目标课程强化学习训练提示注入红队，攻破前沿智能体
arXiv
2609.33628
Published
Sep 27
Layer
Application layer
Setting
AI Agent
Evaluated models
GPT-4o-mini, GPT-5-nano, GPT-5.6-Luna and others12
- AttacksPrompt injection
- TechniqueAutomated search
Abstract提出跨目标模型课程强化学习，攻破前沿模型冷启动瓶颈并实现跨模型迁移。
该研究针对强化学习自动化提示注入红队在攻击前沿大模型时的冷启动问题，提出了一种基于目标模型鲁棒性递进的课程强化学习方法。
Paper analysisRead analysis
AttacksarXiv 2609.37468Sep 26
论文提出针对 Agentic RAG 的检索器后门攻击与 DOU 隐藏方法
提出检索器后门攻击操纵智能体搜索，并用 DOU 逃避检测
arXiv
2609.37468
Published
Sep 26
Layer
Application layer
Setting
AI Agent
Evaluated models
E5, Contriever-MSMARCO
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentRAG
Abstract论文展示了通过恶意检索器操纵智能体多轮搜索并利用诱饵重塑表征隐蔽后门的可行性与系统风险。
Paper analysisRead analysis
AttacksarXiv 2609.31318Sep 25
AgentXploit：面向 AI Agent 的仓库到运行时自动化红队系统
提出 AgentXploit，从代码仓库发现攻击路径并在运行时验证利用
arXiv
2609.31318
Published
Sep 25
Layer
Application layer
Setting
AI Agent
Evaluated models
GPT-4.1
- AttacksPrompt injection
Paper analysisRead analysis
AttacksarXiv 2609.28613Sep 24
研究：提示注入可改变 Jev 决策模型的行动概率
测量间接提示注入对类型化概率决策的动作劫持
arXiv
2609.28613
Published
Sep 24
Layer
Application layer
Setting
Models and APIs
Evaluated models
jev-1.13.0
- AttacksPrompt injection
- TechniqueAutomated search
Abstract封闭动作集改变提示注入的表现，但没有去掉概率被不可信内容移动的风险。
作者在 jev-1.13.0 上研究 decision hijacking：不可信内容能否在用户任务和可选动作都不变时，把类型化决策推向攻击者目标。
Paper analysisRead analysis
AttacksarXiv 2609.28585Sep 23
论文提出持久计费状态概念，揭示工具调用 LLM Agent 的拒绝钱包攻击与防御
定义工具调用 Agent 的持久计费状态，提出拒绝钱包攻击与防御
arXiv
2609.28585
Published
Sep 23
Layer
Application layer
Setting
AI Agent
Evaluated models
GPT-4o, GPT-4o-mini, Mistral-Large and others7
- DefensesInstruction–data separation
- AttacksDenial of service
Abstract已准入工具返回的跨轮保留会重复计费。
这篇工作把工具调用智能体里跨轮保留、并被提供商反复计费的外部工具返回定义为 persistent billable state，并把它的主机侧再次送入决定当作控制点。。
Paper analysisRead analysis
AttacksarXiv 2609.27542Sep 23
Researchers use control token injection to delete gpt-oss-20b's reasoning chain and bypass chain-of-thought monitoring
提出控制标记注入，清空工具 Agent 的思维链以绕过推理监控
arXiv
2609.27542
Published
Sep 23
Layer
Application layer
Setting
AI Agent
Evaluated models
openai/gpt-oss-20b, google/gemma-4-26B-A4B-it, deepseek-ai/DeepSeek-R1-Distill-Qwen-7B and others4
- AttacksPrompt injection
- TechniqueConversation structure manipulation
- ComponentReasoning chains
Abstract论文阐明控制标记注入可抑制 CoT 使监控失效并促成拒绝绕过，且工具执行受解析器宽容度影响。
Paper analysisRead analysis
AttacksarXiv 2609.26761Sep 23
A2M: A two-stage agent hijacking framework targeting the MCP ecosystem
提出两阶段框架 A2M，优化 MCP 工具元数据与返回载荷以劫持 Agent
arXiv
2609.26761
Published
Sep 23
Layer
Application layer
Setting
AI Agent
Evaluated models
GLM-4.6, Qwen3-Max, DeepSeek-V3.1 and others5
- AttacksPrompt injection
- TechniqueAutomated search
- ComponentMCP and skills
Paper analysisRead analysis
AttacksarXiv 2609.18217Sep 16
研究：跨通道碎片化攻击可绕过 MCP 单通道防御
提出跨通道分段攻击，利用 MCP 隐式信任外发敏感文件
arXiv
2609.18217
Published
Sep 16
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-4o, GPT-4o-mini, GPT-5.4 and others15
- AttacksPrompt injection
- TechniqueEncoding and obfuscation
- ComponentMCP and skills
Abstract论文揭示了 MCP 多通道隐式信任层级，通过跨通道分段与协议级利用突破现有防御，展示了严重的凭证外发风险。
Paper analysisRead analysis
AttacksarXiv 2609.11757Sep 11
Researchers disclose a Whisper prompt injection attack on the AP2 payment protocol and propose the A-VIP defense
提出 AP2 支付协议的 Whisper 攻击与 A-VIP 绑定防御
arXiv
2609.11757
Published
Sep 11
Layer
Application layer
Setting
AI Agent
Evaluated models
gemini-2.5-flash-lite, gemini-3.1-flash-lite, gemini-3-flash-preview and others15
- DefensesPermissions and approval
- AttacksPrompt injection
- ComponentPermissions and sandboxing
Abstract论文揭示了 AP2 协议决策层受操纵的风险，提出结构化与权能绑定防御 A-VIP，并发布评测基准。
Paper analysisRead analysis
AttacksarXiv 2609.04495Sep 4
研究将间接提示注入重新表述为测试时搜索问题
提出 Search Harness，把间接提示注入做成测试时搜索并自适应利用
arXiv
2609.04495
Published
Sep 4
Layer
Application layer
Setting
AI Agent
Evaluated models
Claude Opus 4.8, GPT-5.5
- AttacksPrompt injection
- TechniqueAutomated search
Paper analysisRead analysis
AttacksarXiv 2608.30441Aug 31
ECLIPSE：针对长程 Agent 系统的自演化隐蔽提示注入攻击
提出 ECLIPSE 双通道提示注入，劫持长程 Agent 的动作轨迹
arXiv
2608.30441
Published
Aug 31
Layer
Application layer
Setting
AI Agent
Evaluated models
DeepSeek, GPT-4o, Claude 4.8 Opus and others7
- AttacksPrompt injection
- TechniqueAutomated search
- ComponentMCP and skills
Paper analysisRead analysis
AttacksarXiv 2608.29381Aug 30
Researchers propose five categories of safety failures in agent checkpoint rollback and implement three attacks on Hermes, Cline, and LangGraph
提出利用检查点回滚破坏 Agent 执行连续性的攻击
arXiv
2608.29381
Published
Aug 30
Layer
Application layer
Setting
AI Agent
- ComponentPermissions and sandboxing
Abstract论文系统研究了智能体 C/R 的安全性，分析了合法回滚破坏执行连续性的机理，并实证评估了其普遍性与危害。
Paper analysisRead analysis
AttacksarXiv 2608.23858Aug 25
Researchers conduct a systematic security analysis of Google AP2 v0.2, identifying 48 threats
系统分析智能体支付协议的前置上下文操纵与授权威胁
arXiv
2608.23858
Published
Aug 25
Layer
Application layer
Setting
AI Agent
- AttacksPrompt injection
- ComponentMCP and skills
Paper analysisRead analysis
AttacksarXiv 2608.23471Aug 25
InjecMEM: Memory Injection Attacks against LLM Agent Memory Systems
提出 InjecMEM，一次注入 Agent 记忆使后续查询输出预设内容
arXiv
2608.23471
Published
Aug 25
Layer
Application layer
Setting
AI Agent
Evaluated models
Qwen2.5-7B-Instruct, Llama-3.1-8B-Instruct, Mistral-7B-Instruct-v0.3 and others6
- AttacksPoisoning and backdoors
- TechniqueGradient and representation optimization
- ComponentMemory
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop

All papers

Attack type

Attack technique

Impact

System type

Attacker access

Attack surface / entry point

Layer

System component

The paper proposes an option channel attack: changing one option label can make an agent guardrail allow a prohibited operation

从期望危害到似然：LLM 智能体越狱的概率重构

ASPIRE：面向 LLM Agent 的开放式提示注入红队引擎

PersistBD: attackers can strengthen backdoors before release so that they maintain high attack success rates even after developer SFT and RL.

研究：多智能体系统潜在通信链路可被训练用于提升有害顺从

AdaLCPI：让 Agent 从长上下文碎片中重建间接提示注入

用课程强化学习对前沿模型做提示注入红队测试

论文提出针对 Agentic RAG 的检索器后门攻击与 DOU 隐藏方法

AgentXploit：面向 AI Agent 的仓库到运行时自动化红队系统

研究：提示注入可改变 Jev 决策模型的行动概率

论文提出持久计费状态概念，揭示工具调用 LLM Agent 的拒绝钱包攻击与防御

Researchers use control token injection to delete gpt-oss-20b's reasoning chain and bypass chain-of-thought monitoring

A2M: A two-stage agent hijacking framework targeting the MCP ecosystem

研究：跨通道碎片化攻击可绕过 MCP 单通道防御

Researchers disclose a Whisper prompt injection attack on the AP2 payment protocol and propose the A-VIP defense

研究将间接提示注入重新表述为测试时搜索问题

ECLIPSE：针对长程 Agent 系统的自演化隐蔽提示注入攻击

Researchers propose five categories of safety failures in agent checkpoint rollback and implement three attacks on Hermes, Cline, and LangGraph

Researchers conduct a systematic security analysis of Google AP2 v0.2, identifying 48 threats

InjecMEM: Memory Injection Attacks against LLM Agent Memory Systems