Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 8 papers

Filter5

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 255papers have no tags yet and are not included in filtered results.

Attack technique：Encoding and obfuscation Attack surface / entry point：Web pages and interfaces Attack surface / entry point：Tool and skill descriptions Attack surface / entry point：Code repositories and dependencies Layer：Application layer Clear all

Another 255papers do not have category tags yet and are not included in filtered results.

AttacksarXiv 2610.12524Oct 8
An exploration of attacks on AI agent systems
重测并扩展对 AI Agent 的提示注入，并用 Agent Card 欺骗操纵 A2A 选择
arXiv
2610.12524
Published
Oct 8
Layer
Application layer
Setting
AI Agent
Evaluated models
Ollama Mistral 0.9.5, llama3-8b-8192, gemini-2.0-flash-lite and others5
- AttacksPrompt injection
- TechniqueEncoding and obfuscation
- ComponentMCP and skills
Abstract单智能体过滤与分类可被格式或措辞绕过，A2A 选卡还会偏向名称和描述。
作者在自建的 LangChain、AutoGen 和 A2A 系统上重测提示注入，并改 Agent Card 看选择是否偏移。摘要称试验主要凸显单智能体弱点，同时把攻击扩到多智能体。
Paper analysisRead analysis
AttacksarXiv 2609.36576Sep 29
AdaLCPI：让 Agent 从长上下文碎片中重建间接提示注入
提出 AdaLCPI，把恶意指令拆成碎片嵌入工具返回并诱导 Agent 越权执行
arXiv
2609.36576
Published
Sep 29
Layer
Application layer
Setting
AI Agent
Evaluated models
GPT-4.1, GPT-5.1, GPT-5.6-Luna and others7
- AttacksPrompt injection
- TechniqueEncoding and obfuscation
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.35912Sep 28
MMSkillRisk：多模态技能图像中的隐藏指令可诱导 Agent 执行未授权操作
提出 MMSkillRisk 基准，评测多模态技能图像中的隐藏指令诱导 Agent 越权操作
arXiv
2609.35912
Published
Sep 28
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-5.6-sol, Kimi-K2.6, Kimi-K3 and others6
- AttacksPrompt injection
- TechniqueCross-modal payloads
- ComponentMCP and skills
Abstract论文提出 MMSkillRisk 基准与 NCVA 攻击，揭示多模态技能中教学图像潜藏指令可引发未授权操作并与良性任务共存。
Paper analysisRead analysis
AttacksarXiv 2609.18217Sep 16
研究：跨通道碎片化攻击可绕过 MCP 单通道防御
提出跨通道分段攻击，利用 MCP 隐式信任外发敏感文件
arXiv
2609.18217
Published
Sep 16
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-4o, GPT-4o-mini, GPT-5.4 and others15
- AttacksPrompt injection
- TechniqueEncoding and obfuscation
- ComponentMCP and skills
Abstract论文揭示了 MCP 多通道隐式信任层级，通过跨通道分段与协议级利用突破现有防御，展示了严重的凭证外发风险。
Paper analysisRead analysis
AttacksarXiv 2604.03081Apr 3
Supply Chain Poisoning Attacks on the LLM Coding Agent Skill Ecosystem
提出 PoisonedSkills，评测编码 Agent 技能生态的文档投毒
arXiv
2604.03081
Published
Apr 3
Layer
Application layer
Setting
coding agent
Evaluated models
Claude Sonnet 4.6, GLM-4.7, MiniMax-M2.5 and others5
- AttacksPoisoning and backdoors
- TechniqueEncoding and obfuscation
- ComponentMCP and skills
Abstract作者称技能文档可成为系统操作攻击入口，但结果只评估加载后的阶段。
PoisonedSkills 研究编码智能体的技能供应链投毒，重点是文档内容如何进入实际系统操作。。
Paper analysisRead analysis
AttacksarXiv 2602.14211Feb 16
SkillJect: Automatically generating skill-based prompt injection for skill-based agents
提出 SkillJect，自动生成投毒 skill 诱导代码 Agent 执行隐藏脚本
arXiv
2602.14211
Published
Feb 16
Layer
Application layer
Setting
coding agent
Evaluated models
Claude-4.6-Sonnet, GPT-5-mini, GLM-4.7 and others10
- AttacksPrompt injection
- TechniqueAutomated search
- ComponentMCP and skills
AbstractSkillJect 用双通道和闭环精炼投毒 skill。
SkillJect 是针对可安装 agent skill 的自动化提示注入框架。作者要解决的是：公开或手工放入 skill 的恶意指令常常被拒绝或忽略，而 skill 一旦安装就会被反复当作可信指导加载。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2601.10923Jan 16
Hidden-in-Plain-Text：面向社交网络 RAG 间接提示注入的基准
用 OpenRAG-Soc 评测社交网页 RAG 的间接提示注入与检索投毒
arXiv
2601.10923
Published
Jan 16
Layer
Application layer
Setting
LLM applications
Evaluated models
Llama-3-8B-Instruct, Mistral-7B-Instruct, Qwen2.5-14B and others8
- AttacksPrompt injection
- TechniqueEncoding and obfuscation
- ComponentRAG
Paper analysisRead analysis
AttacksarXiv 2509.22040Sep 26, 2025
研究：通过编码规则文件对Cursor与GitHub Copilot实施提示注入
通过规则文件提示注入劫持编码编辑器并执行未授权终端命令
arXiv
2509.22040
Published
Sep 26, 2025
Layer
Application layer
Setting
coding agent
Evaluated models
Cursor, GitHub Copilot, Claude 4 Sonnet and others4
- AttacksPrompt injection
- TechniqueRole-play and persuasion
Abstract论文提出了针对代码编辑器的提示注入评估框架 AIShellJack，实验显示攻击能诱导 AI 执行未授权终端命令。
Paper analysisRead analysis

You have reached the end

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop

All papers

Attack type

Attack technique

Impact

System type

Attack surface / entry point

Layer

System component

An exploration of attacks on AI agent systems

AdaLCPI：让 Agent 从长上下文碎片中重建间接提示注入

MMSkillRisk：多模态技能图像中的隐藏指令可诱导 Agent 执行未授权操作

研究：跨通道碎片化攻击可绕过 MCP 单通道防御

Supply Chain Poisoning Attacks on the LLM Coding Agent Skill Ecosystem

SkillJect: Automatically generating skill-based prompt injection for skill-based agents

Hidden-in-Plain-Text：面向社交网络 RAG 间接提示注入的基准

研究：通过编码规则文件对Cursor与GitHub Copilot实施提示注入