Skip to content

Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 60 papers
Filter4

Attack type

Jailbreaks7Prompt injection44Poisoning and backdoors24Detection evasion6Denial of service3

Attack technique

Automated search32Encoding and obfuscation8Defense-targeted10Dormant triggers10Selection manipulation10

Defense type

Detection and filtering5Permissions and approval3

Impact

Harmful content3Unauthorized actions32Data and privacy leaks7Output manipulation14Availability and reliability4

System type

AI Agent58coding agent15

Attacker access

Black-box7White-box3

Attack surface / entry point

User input72Web pages and interfaces21Documents and messages30Tool responses33Tool and skill descriptions33Code repositories and dependencies16Retrieval corpus21Memory writes16Inter-agent messages10Images, audio and video16Training data3Weights and gradients26Distribution channels31Inference services and hardware5

Layer

Model layer0Application layer60

System component

MCP and skills31Memory7Guardrails and judges9Permissions and sandboxing5
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 240papers have no tags yet and are not included in filtered results.
Attack surface / entry point：Tool responsesAttack surface / entry point：Tool and skill descriptionsLayer：Model layerLayer：Application layerClear all

Another 240papers do not have category tags yet and are not included in filtered results.

  1. AttacksarXiv 2610.12292

    The paper proposes an option channel attack: changing one option label can make an agent guardrail allow a prohibited operation

    Proposing an option channel attack that renames option labels so that agent guardrails allow prohibited operations

    arXiv
    2610.12292
    Published
    Layer
    Application layer
    Setting
    LLM applications
    Attacker
    Black-box
    Evaluated models
    LAYA-TD, LAYA-EN, LAYA-ML and others5

    AbstractThe authors' evaluation indicates that typed models should not serve as final safety arbiters; they are susceptible to off-policy text and option name manipulation, and confidence filtering cannot resist attacks.

    Paper analysisRead analysis
  2. AttacksarXiv 2610.12524

    An exploration of attacks on AI agent systems

    重测并扩展对 AI Agent 的提示注入，并用 Agent Card 欺骗操纵 A2A 选择

    arXiv
    2610.12524
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    Ollama Mistral 0.9.5, llama3-8b-8192, gemini-2.0-flash-lite and others5
    Abstract单智能体过滤与分类可被格式或措辞绕过，A2A 选卡还会偏向名称和描述。

    作者在自建的 LangChain、AutoGen 和 A2A 系统上重测提示注入，并改 Agent Card 看选择是否偏移。摘要称试验主要凸显单智能体弱点，同时把攻击扩到多智能体。

    Paper analysisRead analysis
  4. AttacksarXiv 2610.10612

    PyCache Trap 利用 Python 缓存替换绕过七款 Agent Skill 扫描器

    提出 PyCache Trap，用字节码缓存替换绕过 Agent 技能扫描器

    arXiv
    2610.10612
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    CISCO, HSS, AUDITOR and others8
    Abstract论文剖析智能体技能审查与执行脱节盲区，提出 PyCache Trap 攻击并构建基于可信复现的 EAV 防御。

    这篇论文研究了智能体技能（Agent Skills）安全扫描中的“审查–执行脱节”问题，并提出了对应的攻击验证与防御方案。

    Paper analysisRead analysis
  5. AttacksarXiv 2610.08951

    ASPIRE：面向 LLM Agent 的开放式提示注入红队引擎

    提出 ASPIRE 行为图搜索，开放式发现 Agent 提示注入漏洞

    arXiv
    2610.08951
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    Gemini-3.7-Flash, DeepSeek-V4-Flash, Gemini-2.5-flash
    AbstractASPIRE 把提示注入红队从载荷优化改成行为图引导的开放式漏洞发现。

    ASPIRE 是给搭建方用的智能体提示注入红队引擎，目标是开放式画出可利用的行为路径，而不是在固定任务上打磨一条载荷。

    Paper analysisRead analysis
  7. AttacksarXiv 2610.05943

    CRIME 框架利用良性 Agent 技能组合诱发恶意行为

    提出 CRIME 框架，组合良性 Agent 技能诱发恶意行为

    arXiv
    2610.05943
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    DeepSeek-V4-Flash, GPT-4o-mini, GPT-4o and others6
    Abstract良性技能经 DCA 或 ACA 组合后可产生恶意环境后果，单独审查对不上。

    CRIME 把公共技能库中各自通过审查的技能配成两两组合，看联合执行能否实现指定恶意任务。。

    Paper analysisRead analysis
  8. AttacksarXiv 2610.02432

    论文提出 LLM 输入扰动鲁棒性度量，并发布 ASA 攻击与 AttestMCP 防护

    提出 ASA 与 AttestMCP，度量并降低 LLM 对输入序列扰动的敏感

    arXiv
    2610.02432
    Published
    Layer
    Application layer
    Setting
    LLM applications, AI Agent
    Attacker
    Black-box
    Evaluated models
    Gemma-3-27B-Instruct, Gemma-3-4B-Instruct, Llama-3.2-3B-Instruct and others12
    Paper analysisRead analysis
  10. AttacksarXiv 2609.39607

    Pretext 攻击绕过 NVIDIA SkillSpector 等 Agent 技能扫描器

    提出 PRETEXT 攻击，迭代改写技能文本绕过技能扫描器并让 Agent 执行木马

    arXiv
    2609.39607
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Attacker
    White-box
    Evaluated models
    glm (z-ai/glm-5.1), qwen3t (qwen/qwen3-235b-a22b-thinking-2507), gpt-oss (openai/gpt-oss-120b)
    Abstract论文提出了针对多阶段技能检测器的白盒攻击，揭示了单纯依赖大模型自适应检测的局限。

    PRETEXT 是一项针对基于“静态规则加语义大模型”的智能体技能安全检测框架的白盒攻击与协同进化评估研究。

    Paper analysisRead analysis
  11. AttacksarXiv 2609.39352

    研究者提出解耦铺垫与执行的 LLM Agent 技能投毒攻击

    提出 CoordPoison，解耦技能投毒的借口与动作

    arXiv
    2609.39352
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    DeepSeek-V4-Flash, GLM-5.3-Flash, Claude-Sonnet-4.6 and others5
    AbstractCoordPoison 外置借口。

    CoordPoison 是一种 Skill 供应链投毒方法，把“为何执行”和“执行什么”拆到两个 Skill。。

    Paper analysisRead analysis
  14. AttacksarXiv 2609.35912

    MMSkillRisk：多模态技能图像中的隐藏指令可诱导 Agent 执行未授权操作

    提出 MMSkillRisk 基准，评测多模态技能图像中的隐藏指令诱导 Agent 越权操作

    arXiv
    2609.35912
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    GPT-5.6-sol, Kimi-K2.6, Kimi-K3 and others6

    Abstract论文提出 MMSkillRisk 基准与 NCVA 攻击，揭示多模态技能中教学图像潜藏指令可引发未授权操作并与良性任务共存。

    Paper analysisRead analysis
  15. AttacksarXiv 2609.33628

    用课程强化学习对前沿模型做提示注入红队测试

    用跨目标课程强化学习训练提示注入红队，攻破前沿智能体

    arXiv
    2609.33628
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    GPT-4o-mini, GPT-5-nano, GPT-5.6-Luna and others12
    Abstract提出跨目标模型课程强化学习，攻破前沿模型冷启动瓶颈并实现跨模型迁移。

    该研究针对强化学习自动化提示注入红队在攻击前沿大模型时的冷启动问题，提出了一种基于目标模型鲁棒性递进的课程强化学习方法。

    Paper analysisRead analysis
  18. AttacksarXiv 2609.30383

    研究者提出技能级联攻击

    提出技能级联攻击，把有害目标拆散到多个技能里绕过单技能扫描

    arXiv
    2609.30383
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    GPT-5.4, GPT-5.4 Mini, Claude Opus 4.6 and others11

    Abstract论文探讨了多技能智能体系统面临的技能级联攻击风险，提出自动化红队框架与基准集，指出跨技能交互存在安全防护盲区。

    Paper analysisRead analysis
  19. AttacksarXiv 2609.28613

    研究：提示注入可改变 Jev 决策模型的行动概率

    测量间接提示注入对类型化概率决策的动作劫持

    arXiv
    2609.28613
    Published
    Layer
    Application layer
    Setting
    Models and APIs
    Evaluated models
    jev-1.13.0
    Abstract封闭动作集改变提示注入的表现，但没有去掉概率被不可信内容移动的风险。

    作者在 jev-1.13.0 上研究 decision hijacking：不可信内容能否在用户任务和可选动作都不变时，把类型化决策推向攻击者目标。

    Paper analysisRead analysis
  20. AttacksarXiv 2609.28585

    论文提出持久计费状态概念，揭示工具调用 LLM Agent 的拒绝钱包攻击与防御

    定义工具调用 Agent 的持久计费状态，提出拒绝钱包攻击与防御

    arXiv
    2609.28585
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    GPT-4o, GPT-4o-mini, Mistral-Large and others7
    Abstract已准入工具返回的跨轮保留会重复计费。

    这篇工作把工具调用智能体里跨轮保留、并被提供商反复计费的外部工具返回定义为 persistent billable state，并把它的主机侧再次送入决定当作控制点。。

    Paper analysisRead analysis
Load more