Translation in progress Some entries still include text in the original language.

Oct 13 · Tuesday

All papers

Found 10 papers

Filter6

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 203papers have no tags yet and are not included in filtered results.

Attack technique：Gradient and representation optimization Attack technique：Multi-turn escalation Attack technique：Encoding and obfuscation Attack surface / entry point：Web pages and interfaces Attack surface / entry point：Memory writes Layer：Application layer Clear all

Another 203papers do not have category tags yet and are not included in filtered results.

AttacksarXiv 2610.12524Oct 8
An exploration of attacks on AI agent systems
Retest and extend prompt injection against AI agents, and use Agent Card deception to manipulate A2A selection
arXiv
2610.12524
Published
Oct 8
Layer
Application layer
Setting
AI Agent
Evaluated models
Ollama Mistral 0.9.5, llama3-8b-8192, gemini-2.0-flash-lite and others5
- AttacksPrompt injection
- TechniqueEncoding and obfuscation
- ComponentMCP and skills
AbstractSingle-agent filtering and classification can be bypassed by format or wording, and A2A card selection is also biased toward names and descriptions.
The authors retested prompt injection on their own LangChain, AutoGen, and A2A systems, and modified the Agent Card to see if choices shifted. The abstract states the experiments mainly highlight single-agent weaknesses while extending attacks to multi-agent.
Paper analysisRead analysis
AttacksarXiv 2610.09240Oct 7
WebMirage hijacks visual web agents' browser operations with adversarial images
提出 WebMirage，用局部对抗图像劫持视觉网页 Agent 的浏览器操作
arXiv
2610.09240
Published
Oct 7
Layer
Application layer
Setting
web agent
Evaluated models
LLaVA-v1.5-13B, LLaVA-v1.6-34B, MiniCPM-o-8B and others6
- AttacksPrompt injection
- TechniqueGradient and representation optimization
- ComponentVision
Abstract论文提出了针对网络智能体的端到端视觉红队框架 WebMirage，揭示了从视觉定位到浏览器执行的安全脆弱性。
WebMirage 是一个面向视觉定位网络智能体的流水线感知端到端红队攻击框架。
Paper analysisRead analysis
AttacksarXiv 2610.04589Oct 3
StegoMemory red team testing: agent persistent memory can be used as a cross-session covert channel
提出 StegoMemory，评测智能体持久记忆作为跨会话隐写信道
arXiv
2610.04589
Published
Oct 3
Layer
Application layer
Setting
AI Agent
Evaluated models
Llama 3.1 405B, Claude 3.5 Sonnet, GPT-4o and others13
- AttacksPoisoning and backdoors
- TechniqueEncoding and obfuscation
- ComponentMemory
Abstract研究揭示智能体持久记忆可作为隐蔽信道跨会话传输机密，写入持久化是主要防御瓶颈，呼吁建立记忆完整性防御。
Paper analysisRead analysis
AttacksarXiv 2603.17239Mar 18
LAAF: A Systematic Red-Teaming Method and Automated Attack Framework for LPCI Vulnerabilities in Agentic LLM Systems
Proposes LAAF, which automatically attacks LPCI vulnerabilities in agent systems in stages
arXiv
2603.17239
Published
Mar 18
Layer
Application layer
Setting
AI Agent
Evaluated models
gemini-2.0-flash-001, claude-3-haiku-20240307, meta-llama/llama-3.1-70b-instruct and others5
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMemory
AbstractLAAF does LPCI red teaming with taxonomy plus stage seeding.
The authors state that LAAF is an automated red-teaming framework built specifically for LPCI in agentic LLMs. The issue to address is that encoded, delayed, and conditionally triggered payloads can persist in memory or RAG and re-enter across sessions, whereas Garak and PyRIT do not use the previous round's breakthrough results to seed the next stage across the six stages.
Paper analysisRead analysis
AttacksarXiv 2603.16960Mar 17
Adversarial attacks against modern vision-language models
Conduct adversarial attacks on product images for open-source visual shopping agents and induce wrong purchases
arXiv
2603.16960
Published
Mar 17
Layer
Application layer
Setting
web agent
Evaluated models
LLaVA-v1.5-7B, Qwen2.5-VL-7B
- AttacksPrompt injection
- TechniqueGradient and representation optimization
- ComponentVision
AbstractThe authors state that LLaVA is easily induced by three attacks to buy the wrong item, while Qwen's correct purchase rate remains close to its clean condition.
The authors compare the robustness of two open-source VLM shopping agents against image adversarial perturbations in a self-built e-commerce environment.
Paper analysisRead analysis
AttacksarXiv 2602.05484Feb 5
Masked Mirror: Covert Prompt Injection Attacks Against LLM-Based Phishing Detection
提出隐蔽提示注入攻击 LLM 钓鱼检测器，并给出防御 InjectDefuser
arXiv
2602.05484
Published
Feb 5
Layer
Application layer
Setting
LLM applications
Evaluated models
OpenAI GPT-5, xAI Grok 4 Fast (Non-Reasoning), Meta Llama 4 Maverick and others4
- DefensesInstruction–data separation
- AttacksPrompt injection
- TechniqueEncoding and obfuscation
- ComponentGuardrails and judges
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2601.10923Jan 16
Hidden-in-Plain-Text: A benchmark for indirect prompt injection in social network RAG
用 OpenRAG-Soc 评测社交网页 RAG 的间接提示注入与检索投毒
arXiv
2601.10923
Published
Jan 16
Layer
Application layer
Setting
LLM applications
Evaluated models
Llama-3-8B-Instruct, Mistral-7B-Instruct, Qwen2.5-14B and others8
- AttacksPrompt injection
- TechniqueEncoding and obfuscation
- ComponentRAG
Paper analysisRead analysis
AttacksarXiv 2507.10457Jul 15, 2025
论文提出 LPCI：针对 Agent 逻辑层与持久记忆的提示控制注入攻击
提出 LPCI，把延迟条件载荷写入记忆与检索库以跨会话触发
arXiv
2507.10457
Published
Jul 15, 2025
Layer
Application layer
Setting
AI Agent
Evaluated models
ChatGPT, Claude, LLaMA3 and others8
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMemory
Abstract作者定义 LPCI。
作者把LPCI定义为针对智能体逻辑执行、记忆留存和工具集成的跨阶段漏洞类，而不是单次输入上的提示改写。
Paper analysisRead analysis
AttacksarXiv 2505.11717May 17, 2025
WebInject：通过网页像素扰动对多模态网页 Agent 实施提示注入
提出 WebInject，用网页像素扰动诱导网页 Agent 执行指定动作
arXiv
2505.11717
Published
May 17, 2025
Layer
Application layer
Setting
web agent
Evaluated models
UI-TARS-7B-SFT, Phi-4-multimodal-instruct, Llama-3.2-11B-Vision-Instruct and others5
- AttacksPrompt injection
- TechniqueGradient and representation optimization
- ComponentVision
AbstractWebInject 经源码扰动原始像素。
WebInject 是对 MLLM 网页智能体的环境提示注入：修改网页源码，使原始像素上的扰动经过显示器映射后，诱导智能体执行攻击者指定动作。
Paper analysisRead analysis
AttacksarXiv 2406.12814Jun 19, 2024
论文提出 ARE 框架，在 VisualWebArena 上评估多模态 Agent 的对抗鲁棒性
提出 ARE 框架与图像文本攻击，评测多模态网页 Agent 的对抗鲁棒性
arXiv
2406.12814
Published
Jun 19, 2024
Layer
Application layer
Setting
web agent
Evaluated models
GPT-4o, GPT-4V, Claude-3-Opus and others4
- AttacksPrompt injection
- TechniqueGradient and representation optimization
- ComponentVision
Abstract系统评估多模态网页智能体的脆弱性，指出推理时计算组件被攻破会加剧系统风险。
Paper analysisRead analysis

You have reached the end

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop

All papers

Attack type

Attack technique

Impact

System type

Attack surface / entry point

Layer

System component

An exploration of attacks on AI agent systems

WebMirage hijacks visual web agents' browser operations with adversarial images

StegoMemory red team testing: agent persistent memory can be used as a cross-session covert channel

LAAF: A Systematic Red-Teaming Method and Automated Attack Framework for LPCI Vulnerabilities in Agentic LLM Systems

Adversarial attacks against modern vision-language models

Masked Mirror: Covert Prompt Injection Attacks Against LLM-Based Phishing Detection

Hidden-in-Plain-Text: A benchmark for indirect prompt injection in social network RAG

论文提出 LPCI：针对 Agent 逻辑层与持久记忆的提示控制注入攻击

WebInject：通过网页像素扰动对多模态网页 Agent 实施提示注入

论文提出 ARE 框架，在 VisualWebArena 上评估多模态 Agent 的对抗鲁棒性