Skip to content

Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 5 papers
Filter4

Attack type

Prompt injection3Poisoning and backdoors4

Attack technique

Gradient and representation optimization0Automated search13Encoding and obfuscation5Defense-targeted7Dormant triggers7Selection manipulation9

Impact

Unauthorized actions4

System type

AI Agent5coding agent5

Attack surface / entry point

User input9Web pages and interfaces6Documents and messages6Tool responses5Tool and skill descriptions5Retrieval corpus7Memory writes3Inter-agent messages3Images, audio and video8Distribution channels5

Layer

Application layer5

System component

MCP and skills5
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 261papers have no tags yet and are not included in filtered results.
Attack technique：Gradient and representation optimizationAttack technique：Encoding and obfuscationAttack surface / entry point：Distribution channelsLayer：Application layerClear all

Another 261papers do not have category tags yet and are not included in filtered results.

  1. Evaluation and benchmarksarXiv 2609.35912

    MMSkillRisk：多模态技能图像中的隐藏指令可诱导 Agent 执行未授权操作

    提出 MMSkillRisk 基准，评测多模态技能图像中的隐藏指令诱导 Agent 越权操作

    arXiv
    2609.35912
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    GPT-5.6-sol, Kimi-K2.6, Kimi-K3 and others6

    Abstract论文提出 MMSkillRisk 基准与 NCVA 攻击，揭示多模态技能中教学图像潜藏指令可引发未授权操作并与良性任务共存。

    Paper analysisRead analysis
  2. AttacksarXiv 2609.18217

    研究：跨通道碎片化攻击可绕过 MCP 单通道防御

    提出跨通道分段攻击，利用 MCP 隐式信任外发敏感文件

    arXiv
    2609.18217
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    GPT-4o, GPT-4o-mini, GPT-5.4 and others15

    Abstract论文揭示了 MCP 多通道隐式信任层级，通过跨通道分段与协议级利用突破现有防御，展示了严重的凭证外发风险。

    Paper analysisRead analysis
  3. AttacksarXiv 2608.06862

    SynChain：诱导计算机使用 Agent 自建攻击链并跨任务持久化

    提出 SYNCHAIN，诱导计算机使用 Agent 自建跨任务持久攻击链

    arXiv
    2608.06862
    Published
    Layer
    Application layer
    Setting
    Browser and computer use, coding agent
    Evaluated models
    Qwen3.5-9B, Llama-3.1-8B, Ministral-3-8B

    Abstract论文揭示了 CUA 自合成工件带来的内部供应链威胁，验证了潜伏载荷的跨任务传播能力与防御局限。

    Paper analysisRead analysis
  4. AttacksarXiv 2604.03081

    针对 LLM 编码 Agent 技能生态的供应链投毒攻击

    提出 PoisonedSkills，评测编码 Agent 技能生态的文档投毒

    arXiv
    2604.03081
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    Claude Sonnet 4.6, GLM-4.7, MiniMax-M2.5 and others5
    Abstract作者称技能文档可成为系统操作攻击入口，但结果只评估加载后的阶段。

    PoisonedSkills 研究编码智能体的技能供应链投毒，重点是文档内容如何进入实际系统操作。。

    Paper analysisRead analysis
  5. AttacksarXiv 2602.14211

    SkillJect: Automatically generating skill-based prompt injection for skill-based agents

    提出 SkillJect，自动生成投毒 skill 诱导代码 Agent 执行隐藏脚本

    arXiv
    2602.14211
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    Claude-4.6-Sonnet, GPT-5-mini, GLM-4.7 and others10
    AbstractSkillJect 用双通道和闭环精炼投毒 skill。

    SkillJect 是针对可安装 agent skill 的自动化提示注入框架。作者要解决的是：公开或手工放入 skill 的恶意指令常常被拒绝或忽略，而 skill 一旦安装就会被反复当作可信指导加载。

    Paper analysisRead analysis
You have reached the end