Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 22 papers

Filter3

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 240papers have no tags yet and are not included in filtered results.

Attack surface / entry point：Tool and skill descriptions Attack surface / entry point：Code repositories and dependencies Attack surface / entry point：Weights and gradients Clear all

Another 240papers do not have category tags yet and are not included in filtered results.

Evaluation and benchmarksarXiv 2610.07639Oct 6
HarnessSecurity-Bench horizontally evaluates the security mechanisms of six coding agent frameworks.
评测编码智能体 harness 安全机制在对抗任务中的防护效果
arXiv
2610.07639
Published
Oct 6
Layer
Application layer
Setting
coding agent
- AttacksPrompt injection
- ComponentPermissions and sandboxing
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.04378Oct 3
COPEX：面向 MCP 智能体的受控攻击评测基准发布
提出 COPEX 基准，评测 MCP 智能体对多入口攻击的抵抗力
arXiv
2610.04378
Published
Oct 3
Layer
Application layer
Setting
AI Agent
Evaluated models
Claude Opus 4.7, Claude Sonnet 4.6, GPT-5.5 and others9
- AttacksPrompt injection
- ComponentMCP and skills
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.03153Oct 2
EvoRiskBench: An evolutionary benchmark for runtime security risks of workspace agents
构建 EvoRiskBench 评测工作区 Agent 的运行时安全风险
arXiv
2610.03153
Published
Oct 2
Layer
Application layer
Setting
AI Agent
Evaluated models
GPT-5.6 Sol, DeepSeek-V4-Pro-0813, Claude Opus 5
- AttacksPrompt injection
- ComponentMCP and skills
Abstract论文构建了工作空间智能体运行时风险基准 EvoRiskBench，发现高执行力智能体在 IPI 下面临较高安全风险。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.36817Sep 29
pikit：面向间接提示注入研究与评测的可组合工具包
构建可组合工具包 pikit，评测编码智能体的间接提示注入
arXiv
2609.36817
Published
Sep 29
Layer
Application layer
Setting
coding agent
- AttacksPrompt injection
Abstractpikit 提供组合式间接注入评测。
pikit 是面向间接提示注入研究的组合式工具包，主要贡献是组织攻击、投递通道、防御和判定流程，而非提出新的攻击优化算法。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.35912Sep 28
MMSkillRisk：多模态技能图像中的隐藏指令可诱导 Agent 执行未授权操作
提出 MMSkillRisk 基准，评测多模态技能图像中的隐藏指令诱导 Agent 越权操作
arXiv
2609.35912
Published
Sep 28
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-5.6-sol, Kimi-K2.6, Kimi-K3 and others6
- AttacksPrompt injection
- TechniqueCross-modal payloads
- ComponentMCP and skills
Abstract论文提出 MMSkillRisk 基准与 NCVA 攻击，揭示多模态技能中教学图像潜藏指令可引发未授权操作并与良性任务共存。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.32635Sep 26
TrustFork：显示身份如何劫持 LLM 智能体编排的权限
提出 TRUSTFORK 基准，评测展示身份劫持多智能体编排权限
arXiv
2609.32635
Published
Sep 26
Layer
Application layer
Setting
Multi-agent systems, coding agent
Evaluated models
GPT-5.6-Sol, GPT-5.6-Luna, Kimi-K3 and others8
- AttacksPrompt injection
Abstract论文提出了多智能体安全基准 TRUSTFORK，揭示展示身份如何劫持操作权威，并证明事后验证无法弥补已发生的执行破坏。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.32616Sep 26
Cave-Bench：虚假指控下 LLM 智能体最高 60.06% 的运行会破坏正确工作
提出 CAVE-BENCH，评测智能体在虚假指责下破坏已完成的正确工作
arXiv
2609.32616
Published
Sep 26
Layer
Application layer
Setting
coding agent
Evaluated models
Claude-Sonnet-5, Claude-Opus-5, GPT-5.6-Sol and others14
- AttacksPrompt injection
- RiskDangerous agent actions
Abstract论文提出了评估智能体在虚假指责下破坏已有正确成果的 CAVE-BENCH，发现强模型易推翻已知证据，提出了门控缓解方案。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.30383Sep 25
研究者提出技能级联攻击
提出技能级联攻击，把有害目标拆散到多个技能里绕过单技能扫描
arXiv
2609.30383
Published
Sep 25
Layer
Application layer
Setting
AI Agent
Evaluated models
GPT-5.4, GPT-5.4 Mini, Claude Opus 4.6 and others11
- AttacksPoisoning and backdoors
- TechniqueDefense-targeted
- ComponentMCP and skills
Abstract论文探讨了多技能智能体系统面临的技能级联攻击风险，提出自动化红队框架与基准集，指出跨技能交互存在安全防护盲区。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.24662Sep 21
DUMA-Bench：评估 LLM Agent 安全的双控多智能体基准
提出双控多智能体基准 DUMA-Bench，测量对抗环境下的策略违反
arXiv
2609.24662
Published
Sep 21
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
GPT-5, GPT-5-mini, GPT-5-nano and others14
- AttacksPrompt injection
AbstractDUMA-Bench 用双控交互评测智能体安全。
DUMA-Bench 把 τ²-bench 的双控交互做成智能体安全评测，用来看策略违反如何随用户、模型和环境一起出现。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.08901Sep 8
论文揭示 BatchNorm 架构下机器遗忘评测的归一化伪影
诊断 BatchNorm 架构下机器遗忘评测的归一化伪影
arXiv
2609.08901
Published
Sep 8
Layer
Model layer
Setting
Models and APIs
Evaluated models
ResNet-18, ResNet-50, ViT-S/16 and others4
- DefensesModel hardening
- AttacksModel tampering
Abstract一次不改权重的 BN 重校准能翻转多数方法的表面遗忘，但不改变权重里的编码器泄露。
BN illusion 是作者对近似机器遗忘评测中一种 BatchNorm 测量伪影的命名：不改权重、只用 retain 数据重算运行统计，就可以把表面遗忘准确率翻过来。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2608.30441Aug 31
ECLIPSE：针对长程 Agent 系统的自演化隐蔽提示注入攻击
提出 ECLIPSE 双通道提示注入，劫持长程 Agent 的动作轨迹
arXiv
2608.30441
Published
Aug 31
Layer
Application layer
Setting
AI Agent
Evaluated models
DeepSeek, GPT-4o, Claude 4.8 Opus and others7
- AttacksPrompt injection
- TechniqueAutomated search
- ComponentMCP and skills
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2608.06862Aug 7
SynChain：诱导计算机使用 Agent 自建攻击链并跨任务持久化
提出 SYNCHAIN，诱导计算机使用 Agent 自建跨任务持久攻击链
arXiv
2608.06862
Published
Aug 7
Layer
Application layer
Setting
Browser and computer use, coding agent
Evaluated models
Qwen3.5-9B, Llama-3.1-8B, Ministral-3-8B
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMCP and skills
Abstract论文揭示了 CUA 自合成工件带来的内部供应链威胁，验证了潜伏载荷的跨任务传播能力与防御局限。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2607.20759Jul 23
IssueTrojanBench: evaluating AI coding agents against malicious issue requests
Proposes IssueTrojanBench to evaluate coding agents' execution of malicious issues
arXiv
2607.20759
Published
Jul 23
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-5.3 Codex, GPT-5.4, Sonnet 4.6
- AttacksPrompt injection
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2607.14611Jul 16
论文评测 Claude Code 与 Codex 记忆文件中的提示注入风险
评测编码 Agent 记忆文件中提示注入的跨会话影响
arXiv
2607.14611
Published
Jul 16
Layer
Application layer
Setting
coding agent
Evaluated models
Claude Haiku 4.5, Claude Opus 4.7, GPT-5.2 and others4
- AttacksPoisoning and backdoors
- ComponentMemory
Abstract已植入记忆文件的载荷可以跨会话影响 Claude Code 与 Codex，攻击成功与载荷是否留下是两种不同的失败。
Bad Memory 在沙箱合成工作区里评测文件型持久记忆上的提示注入，比较载荷能否改变当前会话，以及能否在后续会话中留下或叠加。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2607.13987Jul 16
Agent Skill Safety: Threat Models, Attacks, Defenses, and Evaluation
用 SkillSec-Eval 评测 Agent 技能全生命周期安全
arXiv
2607.13987
Published
Jul 16
Layer
Application layer
Setting
AI Agent
Evaluated models
Gemini 3.1 pro, Gemini 1.5 Flash
- AttacksPoisoning and backdoors
- ComponentMCP and skills
AbstractSkillSec-Eval 按五个信任边界评测可复用技能，作者称单点防御不足以覆盖全生命周期。
SkillSec-Eval 按信任边界评测可复用智能体技能，而不是只看提示注入或单次执行。技能被共享后，元数据、权限、工作流和版本可独立于底层模型变化。作者要回答的是：恶意技能能否在准入、检索、规划、执行或更新阶段穿过未经验证的信任边界。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2606.15899Jun 15
SkillVetBench：用 LLM-as-Judge 评估开源 LLM Agent 技能的多维安全风险
提出 SkillVetBench 评估开源 Agent 技能的多维安全风险
arXiv
2606.15899
Published
Jun 15
Layer
Application layer
Setting
AI Agent
Evaluated models
Qwen2.5-14B-Instruct, Qwen2.5-32B, Llama-3.1-70B and others6
- AttacksPoisoning and backdoors
- ComponentMCP and skills
Abstract公开排行榜用 LLM-as-Judge 给技能分列 SARS 与 CVSS，并对照市场官方审查。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2605.17380May 17
Uber proposes ADR enterprise-level agent detection system, deployed on 7,200 hosts for ten months
提出企业级检测系统 ADR，识别编程 Agent 的提示注入与恶意 MCP
arXiv
2605.17380
Published
May 17
Layer
Application layer
Setting
coding agent
- DefensesDetection and filtering
- AttacksPrompt injection
- ComponentMCP and skills
Abstract提出了端点因果遥测、两级在线分流与离线红队闭环的 ADR 系统，并在生产环境中验证了有效性。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2605.14605May 14
Study: malicious fine-tuning defenses fail under continued training, harmfulness rises across all 72 defense trajectories
用代价曲线评估恶意微调防御在持续训练下的衰减
arXiv
2605.14605
Published
May 14
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Llama-2-7B-chat, Qwen3-8B, Llama-3.1-8B-Instruct and others8
- DefensesModel hardening
- AttacksModel tampering
- ComponentFine-tuning and open weights
Abstract论文指出恶意微调防御在持续训练下均会衰减，表明基于有限攻击者假设的防御无法为开源模型提供持久保护。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2604.02947Apr 3
AgentHazard：评估计算机使用智能体有害行为的基准
提出 AgentHazard 基准，评测计算机使用智能体的执行层有害行为
arXiv
2604.02947
Published
Apr 3
Layer
Application layer
Setting
Browser and computer use, coding agent
Evaluated models
Qwen2.5-72B-Instruct, Qwen2.5-Coder-32B-Instruct, Qwen3-32B and others12
- AttacksMalicious use
AbstractAgentHazard 评估了计算机使用智能体的执行安全，作者认为模型层对齐无法可靠保障智能体层面的安全性。
AgentHazard 是针对计算机使用智能体执行层安全构建的评估基准，重点探究多步工具调用下局部合理动作累积引发的危害。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2604.01438Apr 2
ClawSafety: Safe LLM, Unsafe Agent
提出 ClawSafety，评测个人智能体读到对抗工件后是否执行有害动作
arXiv
2604.01438
Published
Apr 2
Layer
Application layer
Setting
AI Agent
Evaluated models
Claude Sonnet 4.6, GPT-5.1, Gemini 2.5 Pro and others5
- AttacksPrompt injection
- ComponentMCP and skills
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop

All papers

Attack type

Impact

System type

Attack surface / entry point

Layer

System component

HarnessSecurity-Bench horizontally evaluates the security mechanisms of six coding agent frameworks.

COPEX：面向 MCP 智能体的受控攻击评测基准发布

EvoRiskBench: An evolutionary benchmark for runtime security risks of workspace agents

pikit：面向间接提示注入研究与评测的可组合工具包

MMSkillRisk：多模态技能图像中的隐藏指令可诱导 Agent 执行未授权操作

TrustFork：显示身份如何劫持 LLM 智能体编排的权限

Cave-Bench：虚假指控下 LLM 智能体最高 60.06% 的运行会破坏正确工作

研究者提出技能级联攻击

DUMA-Bench：评估 LLM Agent 安全的双控多智能体基准

论文揭示 BatchNorm 架构下机器遗忘评测的归一化伪影

ECLIPSE：针对长程 Agent 系统的自演化隐蔽提示注入攻击

SynChain：诱导计算机使用 Agent 自建攻击链并跨任务持久化

IssueTrojanBench: evaluating AI coding agents against malicious issue requests

论文评测 Claude Code 与 Codex 记忆文件中的提示注入风险

Agent Skill Safety: Threat Models, Attacks, Defenses, and Evaluation

SkillVetBench：用 LLM-as-Judge 评估开源 LLM Agent 技能的多维安全风险

Uber proposes ADR enterprise-level agent detection system, deployed on 7,200 hosts for ten months

Study: malicious fine-tuning defenses fail under continued training, harmfulness rises across all 72 defense trajectories

AgentHazard：评估计算机使用智能体有害行为的基准

ClawSafety: Safe LLM, Unsafe Agent