Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 201papers have no tags yet and are not included in filtered results.

Attack technique：Multi-turn escalation Attack technique：Encoding and obfuscation Attack technique：Conversation structure manipulation Attack technique：Selection manipulation Layer：Application layer Clear all

Another 201papers do not have category tags yet and are not included in filtered results.

AttacksarXiv 2610.12524Oct 8
An exploration of attacks on AI agent systems
Retest and extend prompt injection against AI agents, and use Agent Card deception to manipulate A2A selection
arXiv
2610.12524
Published
Oct 8
Layer
Application layer
Setting
AI Agent
Evaluated models
Ollama Mistral 0.9.5, llama3-8b-8192, gemini-2.0-flash-lite and others5
- AttacksPrompt injection
- TechniqueEncoding and obfuscation
- ComponentMCP and skills
AbstractSingle-agent filtering and classification can be bypassed by format or wording, and A2A card selection is also biased toward names and descriptions.
The authors retested prompt injection on their own LangChain, AutoGen, and A2A systems, and modified the Agent Card to see if choices shifted. The abstract states the experiments mainly highlight single-agent weaknesses while extending attacks to multi-agent.
Paper analysisRead analysis
AttacksarXiv 2610.08098Oct 6
CORSA：面向技能路由器的技能注入攻击可跨路由器与 LLM 迁移
提出 CORSA，按任务簇优化技能注入的检索与执行
arXiv
2610.08098
Published
Oct 6
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-5.4, DeepSeek-V4-Pro, Qwen3.8-27B and others5
- AttacksPoisoning and backdoors
- TechniqueSelection manipulation
- ComponentMCP and skills
Paper analysisRead analysis
AttacksarXiv 2610.04985Oct 4
研究揭示 Jev 作为应用决策层的安全与隐私风险
评估应用决策层的输入注入与隐私推断风险
arXiv
2610.04985
Published
Oct 4
Layer
Application layer
Setting
LLM applications
Attacker
Black-box, Gray-box
Evaluated models
Jev, NanoJev
- AttacksPrompt injection
- TechniqueRole-play and persuasion
AbstractJev 的类型化决策可被输入与训练操纵，也会泄露信息，并同时支持检测与滥用。
Jev 是 TypeSafe 的 System One 模型，把应用 state 和固定问题变成 Choice、Noul 或 Score 的类型化决策与概率。作者用官方 API 和可改训练的 NanoJev，考察它作为决策层时的操纵、泄露与双重用途。
Paper analysisRead analysis
AttacksarXiv 2610.04589Oct 3
StegoMemory red team testing: agent persistent memory can be used as a cross-session covert channel
提出 StegoMemory，评测智能体持久记忆作为跨会话隐写信道
arXiv
2610.04589
Published
Oct 3
Layer
Application layer
Setting
AI Agent
Evaluated models
Llama 3.1 405B, Claude 3.5 Sonnet, GPT-4o and others13
- AttacksPoisoning and backdoors
- TechniqueEncoding and obfuscation
- ComponentMemory
Abstract研究揭示智能体持久记忆可作为隐蔽信道跨会话传输机密，写入持久化是主要防御瓶颈，呼吁建立记忆完整性防御。
Paper analysisRead analysis
AttacksarXiv 2610.00392Sep 30
A2A-TIBA：针对 A2A 协议 LLM 智能体的间接提示注入攻击与三层同构攻防模型
提出 A2A-TIBA，经 A2A 对等任务间接注入并植入常驻回调
arXiv
2610.00392
Published
Sep 30
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
MiniMax-M3, deepseek-v4-pro, glm-5.3 and others8
- AttacksPrompt injection
- TechniqueMulti-turn escalation
- ComponentMCP and skills
AbstractA2A-TIBA 一次植入后绕过智能体，GDA 用四类结果定位防线，ELA-ITL 把信封标注列为第三层。
A2A-TIBA 把间接提示注入和绕过放进 A2A：gray-box 攻击者已能投递任务，诱导目标部署常驻回调程序后，下令和外传不再经过智能体。
Paper analysisRead analysis
AttacksarXiv 2609.36576Sep 29
AdaLCPI: Making agents reconstruct indirect prompt injection from long-context fragments
提出 AdaLCPI，把恶意指令拆成碎片嵌入工具返回并诱导 Agent 越权执行
arXiv
2609.36576
Published
Sep 29
Layer
Application layer
Setting
AI Agent
Evaluated models
GPT-4.1, GPT-5.1, GPT-5.6-Luna and others7
- AttacksPrompt injection
- TechniqueEncoding and obfuscation
Paper analysisRead analysis
AttacksarXiv 2609.35912Sep 28
MMSkillRisk：多模态技能图像中的隐藏指令可诱导 Agent 执行未授权操作
提出 MMSkillRisk 基准，评测多模态技能图像中的隐藏指令诱导 Agent 越权操作
arXiv
2609.35912
Published
Sep 28
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-5.6-sol, Kimi-K2.6, Kimi-K3 and others6
- AttacksPrompt injection
- TechniqueCross-modal payloads
- ComponentMCP and skills
Abstract论文提出 MMSkillRisk 基准与 NCVA 攻击，揭示多模态技能中教学图像潜藏指令可引发未授权操作并与良性任务共存。
Paper analysisRead analysis
AttacksarXiv 2609.30383Sep 25
研究者提出技能级联攻击
提出技能级联攻击，把有害目标拆散到多个技能里绕过单技能扫描
arXiv
2609.30383
Published
Sep 25
Layer
Application layer
Setting
AI Agent
Evaluated models
GPT-5.4, GPT-5.4 Mini, Claude Opus 4.6 and others11
- AttacksPoisoning and backdoors
- TechniqueDefense-targeted
- ComponentMCP and skills
Abstract论文探讨了多技能智能体系统面临的技能级联攻击风险，提出自动化红队框架与基准集，指出跨技能交互存在安全防护盲区。
Paper analysisRead analysis
AttacksarXiv 2609.27542Sep 23
Researchers use control token injection to delete gpt-oss-20b's reasoning chain and bypass chain-of-thought monitoring
提出控制标记注入，清空工具 Agent 的思维链以绕过推理监控
arXiv
2609.27542
Published
Sep 23
Layer
Application layer
Setting
AI Agent
Evaluated models
openai/gpt-oss-20b, google/gemma-4-26B-A4B-it, deepseek-ai/DeepSeek-R1-Distill-Qwen-7B and others4
- AttacksPrompt injection
- TechniqueConversation structure manipulation
- ComponentReasoning chains
Abstract论文阐明控制标记注入可抑制 CoT 使监控失效并促成拒绝绕过，且工具执行受解析器宽容度影响。
Paper analysisRead analysis
AttacksarXiv 2609.26761Sep 23
A2M: A two-stage agent hijacking framework targeting the MCP ecosystem
提出两阶段框架 A2M，优化 MCP 工具元数据与返回载荷以劫持 Agent
arXiv
2609.26761
Published
Sep 23
Layer
Application layer
Setting
AI Agent
Evaluated models
GLM-4.6, Qwen3-Max, DeepSeek-V3.1 and others5
- AttacksPrompt injection
- TechniqueAutomated search
- ComponentMCP and skills
Paper analysisRead analysis
AttacksarXiv 2609.24994Sep 22
BAM 反馈编码实现推理时隐蔽的智能体通信
提出 BAM 反馈编码，在 LLM 生成文本中实现隐蔽通信
arXiv
2609.24994
Published
Sep 22
Layer
Application layer
Setting
AI Agent
Evaluated models
Llama-3.1-8B, Qwen-3.5-9B-Base, Mistral-7B-v0.3 and others6
- TechniqueEncoding and obfuscation
Paper analysisRead analysis
AttacksarXiv 2609.18217Sep 16
研究：跨通道碎片化攻击可绕过 MCP 单通道防御
提出跨通道分段攻击，利用 MCP 隐式信任外发敏感文件
arXiv
2609.18217
Published
Sep 16
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-4o, GPT-4o-mini, GPT-5.4 and others15
- AttacksPrompt injection
- TechniqueEncoding and obfuscation
- ComponentMCP and skills
Abstract论文揭示了 MCP 多通道隐式信任层级，通过跨通道分段与协议级利用突破现有防御，展示了严重的凭证外发风险。
Paper analysisRead analysis
AttacksarXiv 2609.15383Sep 14
微软团队提出 capability laundering 攻击：弱模型拆分任务向对齐前沿模型套取能力
提出能力洗钱攻击，拆分任务向对齐模型套取能力
arXiv
2609.15383
Published
Sep 14
Layer
Application layer
Setting
AI Agent
Attacker
Black-box
Evaluated models
GPT-5.5, Claude Opus 4.8, Grok-4.3 and others7
- AttacksJailbreaks
- TechniqueMulti-turn escalation
Abstract作者提出了能力洗钱攻击，发现未对齐编排器分解咨询对齐模型可恢复能力差距，指出需建立跨会话防御。
Paper analysisRead analysis
AttacksarXiv 2609.03884Sep 3
HookPry：利用插件生命周期钩子更新劫持 AI Agent 框架
提出 HOOKPRY，用插件钩子版本更新供应链劫持 Agent 框架
arXiv
2609.03884
Published
Sep 3
Layer
Application layer
Setting
AI Agent
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMCP and skills
Paper analysisRead analysis
AttacksarXiv 2609.02035Sep 2
ISM：通过语义匹配隐式操纵 LLM Agent 的技能选择
提出 ISM，用语义匹配隐式操纵 Agent 技能选择
arXiv
2609.02035
Published
Sep 2
Layer
Application layer
Setting
AI Agent
Evaluated models
Llama-2-7B, Llama-3-8B, Llama-3.1-8B and others8
- AttacksPoisoning and backdoors
- TechniqueSelection manipulation
- ComponentMCP and skills
Paper analysisRead analysis
AttacksarXiv 2608.27800Aug 28
ContextLeak：通过恶意工具窃取 LLM Agent 运行时上下文
提出 ContextLeak，用强化学习优化恶意工具描述，诱导 Agent 外泄运行时上下文
arXiv
2608.27800
Published
Aug 28
Layer
Application layer
Setting
AI Agent
Evaluated models
Qwen-3-8B, GPT-OSS-20B, Gemma-4-E4B-it and others11
- AttacksPrompt injection
- TechniqueSelection manipulation
- ComponentMCP and skills
Paper analysisRead analysis
AttacksarXiv 2608.25776Aug 26
EvoMal attack uses self-poisoning of self-evolving coding agents to achieve worm-like propagation
提出 EVOMAL，诱导自演化编码 Agent 在创建技能时自我投毒并蠕虫传播
arXiv
2608.25776
Published
Aug 26
Layer
Application layer
Setting
coding agent
Evaluated models
Devstral-Small-2, Gemma-4-31B-IT, Qwen3-Coder-Next and others7
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMCP and skills
Abstract论文指出了自演化智能体模仿检索代码的自我毒化漏洞，提出 EVOMAL 攻击与防御，阐明了供应链新风险。
Paper analysisRead analysis
AttacksarXiv 2608.12273Aug 13
研究者提出 Convergent Detour Hijacking 攻击，可让技能型 LLM Agent 绕路并放大资源消耗
提出 CDH 攻击，让技能型 Agent 绕路放大资源消耗
arXiv
2608.12273
Published
Aug 13
Layer
Application layer
Setting
AI Agent
Evaluated models
Claude-Haiku-4.5, DeepSeek-V4-Pro, DeepSeek-V4-Flash and others6
- AttacksPrompt injection
- TechniqueSelection manipulation
- ComponentMCP and skills
AbstractCDH 让静态技能在保持任务完成时拉高调用与 token，耗时则因后端而异。
CDH 是针对渐进披露技能智能体的发布者侧、纯文本攻击：一个静态协调器把本可正确完成的任务，拐进有界但更耗资源的技能绕路，再交还原任务。
Paper analysisRead analysis
AttacksarXiv 2608.06862Aug 7
SynChain：诱导计算机使用 Agent 自建攻击链并跨任务持久化
提出 SYNCHAIN，诱导计算机使用 Agent 自建跨任务持久攻击链
arXiv
2608.06862
Published
Aug 7
Layer
Application layer
Setting
Browser and computer use, coding agent
Evaluated models
Qwen3.5-9B, Llama-3.1-8B, Ministral-3-8B
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMCP and skills
Abstract论文揭示了 CUA 自合成工件带来的内部供应链威胁，验证了潜伏载荷的跨任务传播能力与防御局限。
Paper analysisRead analysis
AttacksarXiv 2607.14493Jul 16
LogInject 框架披露 LLM 日志分析中的被动提示注入
提出 LogInject 框架，评测日志分析中的被动提示注入及缓解
arXiv
2607.14493
Published
Jul 16
Layer
Application layer
Setting
LLM applications
Evaluated models
GPT-4o, Claude 3.5 Sonnet, Llama-3-70B-Instruct
- AttacksPrompt injection
- TechniqueEncoding and obfuscation
- ComponentGuardrails and judges
Abstract论文评估了 LLM 日志分析中的上下文污染风险，提出分片拼接等攻击与三层防御，指出必须结合架构隔离与人工介入。
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop