Translation in progress Some entries still include text in the original language.

Oct 13 · Tuesday

All papers

Found 20 papers

Filter4

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 213papers have no tags yet and are not included in filtered results.

Attack technique：Multi-turn escalation Attack technique：Selection manipulation Layer：Model layer Layer：Application layer Clear all

Another 213papers do not have category tags yet and are not included in filtered results.

AttacksarXiv 2610.12524Oct 8
An exploration of attacks on AI agent systems
Retest and extend prompt injection against AI agents, and use Agent Card deception to manipulate A2A selection
arXiv
2610.12524
Published
Oct 8
Layer
Application layer
Setting
AI Agent
Evaluated models
Ollama Mistral 0.9.5, llama3-8b-8192, gemini-2.0-flash-lite and others5
- AttacksPrompt injection
- TechniqueEncoding and obfuscation
- ComponentMCP and skills
AbstractSingle-agent filtering and classification can be bypassed by format or wording, and A2A card selection is also biased toward names and descriptions.
The authors retested prompt injection on their own LangChain, AutoGen, and A2A systems, and modified the Agent Card to see if choices shifted. The abstract states the experiments mainly highlight single-agent weaknesses while extending attacks to multi-agent.
Paper analysisRead analysis
AttacksarXiv 2610.08098Oct 6
CORSA：面向技能路由器的技能注入攻击可跨路由器与 LLM 迁移
提出 CORSA，按任务簇优化技能注入的检索与执行
arXiv
2610.08098
Published
Oct 6
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-5.4, DeepSeek-V4-Pro, Qwen3.8-27B and others5
- AttacksPoisoning and backdoors
- TechniqueSelection manipulation
- ComponentMCP and skills
Paper analysisRead analysis
AttacksarXiv 2610.00392Sep 30
A2A-TIBA：针对 A2A 协议 LLM 智能体的间接提示注入攻击与三层同构攻防模型
提出 A2A-TIBA，经 A2A 对等任务间接注入并植入常驻回调
arXiv
2610.00392
Published
Sep 30
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
MiniMax-M3, deepseek-v4-pro, glm-5.3 and others8
- AttacksPrompt injection
- TechniqueMulti-turn escalation
- ComponentMCP and skills
AbstractA2A-TIBA 一次植入后绕过智能体，GDA 用四类结果定位防线，ELA-ITL 把信封标注列为第三层。
A2A-TIBA 把间接提示注入和绕过放进 A2A：gray-box 攻击者已能投递任务，诱导目标部署常驻回调程序后，下令和外传不再经过智能体。
Paper analysisRead analysis
AttacksarXiv 2609.30383Sep 25
研究者提出技能级联攻击
提出技能级联攻击，把有害目标拆散到多个技能里绕过单技能扫描
arXiv
2609.30383
Published
Sep 25
Layer
Application layer
Setting
AI Agent
Evaluated models
GPT-5.4, GPT-5.4 Mini, Claude Opus 4.6 and others11
- AttacksPoisoning and backdoors
- TechniqueDefense-targeted
- ComponentMCP and skills
Abstract论文探讨了多技能智能体系统面临的技能级联攻击风险，提出自动化红队框架与基准集，指出跨技能交互存在安全防护盲区。
Paper analysisRead analysis
AttacksarXiv 2609.26761Sep 23
A2M: A two-stage agent hijacking framework targeting the MCP ecosystem
提出两阶段框架 A2M，优化 MCP 工具元数据与返回载荷以劫持 Agent
arXiv
2609.26761
Published
Sep 23
Layer
Application layer
Setting
AI Agent
Evaluated models
GLM-4.6, Qwen3-Max, DeepSeek-V3.1 and others5
- AttacksPrompt injection
- TechniqueAutomated search
- ComponentMCP and skills
Paper analysisRead analysis
AttacksarXiv 2609.15383Sep 14
微软团队提出 capability laundering 攻击：弱模型拆分任务向对齐前沿模型套取能力
提出能力洗钱攻击，拆分任务向对齐模型套取能力
arXiv
2609.15383
Published
Sep 14
Layer
Application layer
Setting
AI Agent
Attacker
Black-box
Evaluated models
GPT-5.5, Claude Opus 4.8, Grok-4.3 and others7
- AttacksJailbreaks
- TechniqueMulti-turn escalation
Abstract作者提出了能力洗钱攻击，发现未对齐编排器分解咨询对齐模型可恢复能力差距，指出需建立跨会话防御。
Paper analysisRead analysis
AttacksarXiv 2609.03884Sep 3
HookPry：利用插件生命周期钩子更新劫持 AI Agent 框架
提出 HOOKPRY，用插件钩子版本更新供应链劫持 Agent 框架
arXiv
2609.03884
Published
Sep 3
Layer
Application layer
Setting
AI Agent
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMCP and skills
Paper analysisRead analysis
AttacksarXiv 2609.02035Sep 2
ISM：通过语义匹配隐式操纵 LLM Agent 的技能选择
提出 ISM，用语义匹配隐式操纵 Agent 技能选择
arXiv
2609.02035
Published
Sep 2
Layer
Application layer
Setting
AI Agent
Evaluated models
Llama-2-7B, Llama-3-8B, Llama-3.1-8B and others8
- AttacksPoisoning and backdoors
- TechniqueSelection manipulation
- ComponentMCP and skills
Paper analysisRead analysis
AttacksarXiv 2608.27800Aug 28
ContextLeak：通过恶意工具窃取 LLM Agent 运行时上下文
提出 ContextLeak，用强化学习优化恶意工具描述，诱导 Agent 外泄运行时上下文
arXiv
2608.27800
Published
Aug 28
Layer
Application layer
Setting
AI Agent
Evaluated models
Qwen-3-8B, GPT-OSS-20B, Gemma-4-E4B-it and others11
- AttacksPrompt injection
- TechniqueSelection manipulation
- ComponentMCP and skills
Paper analysisRead analysis
AttacksarXiv 2608.25776Aug 26
EvoMal attack uses self-poisoning of self-evolving coding agents to achieve worm-like propagation
提出 EVOMAL，诱导自演化编码 Agent 在创建技能时自我投毒并蠕虫传播
arXiv
2608.25776
Published
Aug 26
Layer
Application layer
Setting
coding agent
Evaluated models
Devstral-Small-2, Gemma-4-31B-IT, Qwen3-Coder-Next and others7
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMCP and skills
Abstract论文指出了自演化智能体模仿检索代码的自我毒化漏洞，提出 EVOMAL 攻击与防御，阐明了供应链新风险。
Paper analysisRead analysis
AttacksarXiv 2608.12273Aug 13
研究者提出 Convergent Detour Hijacking 攻击，可让技能型 LLM Agent 绕路并放大资源消耗
提出 CDH 攻击，让技能型 Agent 绕路放大资源消耗
arXiv
2608.12273
Published
Aug 13
Layer
Application layer
Setting
AI Agent
Evaluated models
Claude-Haiku-4.5, DeepSeek-V4-Pro, DeepSeek-V4-Flash and others6
- AttacksPrompt injection
- TechniqueSelection manipulation
- ComponentMCP and skills
AbstractCDH 让静态技能在保持任务完成时拉高调用与 token，耗时则因后端而异。
CDH 是针对渐进披露技能智能体的发布者侧、纯文本攻击：一个静态协调器把本可正确完成的任务，拐进有界但更耗资源的技能绕路，再交还原任务。
Paper analysisRead analysis
AttacksarXiv 2607.12340Jul 14
Research: LLM agent skill-name hallucination rates reach up to 62%, which can be exploited via squatting for supply-chain attacks
提出技能名称抢注攻击，利用 Agent 虚构技能名实施供应链劫持
arXiv
2607.12340
Published
Jul 14
Layer
Application layer
Setting
coding agent
Evaluated models
GLM-4.5-Air, GPT-5.4-mini, Claude Sonnet 4.6 and others12
- AttacksPoisoning and backdoors
- RiskHallucination and fabrication
- TechniqueSelection manipulation
- ComponentMCP and skills
Abstract研究证实智能体虚构技能名具有高发生率与可预测性，现有防御难以兼顾安全与效用，亟需注册表结构性防护。
本研究系统揭示了大模型智能体技能推荐场景下的虚构技能名称安全风险，将其形式化为一种新型供应链抢注攻击。
Paper analysisRead analysis
AttacksarXiv 2607.03968Jul 5
The study reveals workflow-level jailbreaks in IDE programming agents: GitHub Copilot generated harmful content across four backends at 816/816
提出工作流级越狱，让编程 Agent 在开发任务中写入有害示例
arXiv
2607.03968
Published
Jul 5
Layer
Application layer
Setting
coding agent
Evaluated models
Claude Sonnet 4.6, Claude Haiku 4.5, Gemini 3.1 Pro and others4
- AttacksJailbreaks
- TechniqueMulti-turn escalation
Abstract作者报告 Copilot 后端会在编码工作流中生成其在单轮条件下通常拒绝的有害答案。
这是一项生产 IDE 编码智能体的工作流越狱研究，受测对象是 Copilot 的四个模型后端，而非评测流水线中的名义目标。
Paper analysisRead analysis
AttacksarXiv 2607.00422Jul 1
KidnapRAG：黑盒投毒攻击劫持 Agentic RAG 的推理链
提出 KidnapRAG，用投毒文档黑盒劫持 Agentic RAG 的推理链
arXiv
2607.00422
Published
Jul 1
Layer
Application layer
Setting
AI Agent
Evaluated models
Qwen2.5-32B-Instruct, Llama-3.3-70B-Instruct, QwQ-32B and others5
- AttacksPoisoning and backdoors
- TechniqueSelection manipulation
- ComponentReasoning chains
Abstract顺序投毒可把多步推理拖向指定应答，作者称关键在持续引导而非单次注入。
KidnapRAG 是针对 Agentic RAG 的 black-box 语料投毒：攻击者不能访问模型、提示词、检索器或私有轨迹，只能发布可能被检索的文档，并利用公开界面上的推理与搜索查询。
Paper analysisRead analysis
AttacksarXiv 2605.30883May 29
TRACE：面向 LLM Agent 的任务感知自适应自进化越狱框架
提出 TRACE 框架，用分解与可演化多轮策略诱导智能体执行有害工作流
arXiv
2605.30883
Published
May 29
Layer
Application layer
Setting
coding agent
Evaluated models
Codex, Claude Code, GPT-5.5 and others6
- AttacksJailbreaks
- TechniqueMulti-turn escalation
Paper analysisRead analysis
AttacksarXiv 2603.25164Mar 26
PIDP-Attack: Combining Prompt Injection and Database Poisoning to Attack RAG Systems
Proposes PIDP-Attack, which manipulates RAG answers using query suffixes and corpus poisoning
arXiv
2603.25164
Published
Mar 26
Layer
Application layer
Setting
LLM applications
Evaluated models
qwen/qwen2.5-7b-instruct, qwen/qwen2-7b-instruct, meta/llama-3.1-8b-instruct and others8
- AttacksPrompt injection
- TechniqueSelection manipulation
- ComponentRAG
Paper analysisRead analysis
AttacksarXiv 2602.07379Feb 7
Aegis: Governance, Integrity, and Security for AI Voice Agents
Proposes the Aegis red-teaming framework for multi-turn attacks on high-risk voice agents.
arXiv
2602.07379
Published
Feb 7
Layer
Application layer
Setting
AI Agent
Evaluated models
GPT-4o, GPT-4o-mini, Gemini-1.5 Pro and others7
- AttacksDenial of service
- TechniqueMulti-turn escalation
- ComponentAudio
AbstractAegis red-teams three types of voice agents: query-based access eliminates authentication and leakage successes, but behavioral attacks remain.
Aegis uses multi-turn red-teaming evaluation on ALLM voice agents already integrated into business systems. The authors call this the first systematic red-teaming framework in this setting.
Paper analysisRead analysis
AttacksarXiv 2601.05466Jan 9
Jailbreaking large language models through reinforcement learning with iterative tool disguise attacks
提出 iMIST，用工具伪装和 PPO 迭代越狱大语言模型
arXiv
2601.05466
Published
Jan 9
Layer
Application layer
Setting
AI Agent
Attacker
Black-box
Evaluated models
DeepSeek-V3, Qwen3-32B, GPT-OSS-120B
- AttacksJailbreaks
- TechniqueAutomated search
AbstractiMIST 用工具伪装和在线 PPO 做黑盒越狱，Table I 中 JADES 高于同格基线。
iMIST是黑盒越狱方法：把恶意查询伪装成合法工具调用，再用在线强化学习把响应的有害性分数往上推。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2512.19016Dec 22, 2025
DREAM 框架用跨环境长链攻击评测 12 个 LLM Agent
提出 DREAM 框架，评测 Agent 的跨环境长链攻击脆弱性
arXiv
2512.19016
Published
Dec 22, 2025
Layer
Application layer
Setting
AI Agent
Evaluated models
Gemini-2.5-Flash-NT, o4-mini, Gemini-2.5-Flash and others12
- AttacksPrompt injection
- TechniqueMulti-turn escalation
AbstractDREAM 提出基于知识图谱与策略搜索的动态红队框架，分析了长链跨环境攻击对当前主流智能体的系统性威胁。
Paper analysisRead analysis
AttacksarXiv 2509.25624Sep 30, 2025
STAC：看似无害的工具调用链如何攻破 LLM Agent
提出 STAC 框架，把恶意目标拆成多轮看似无害的工具调用链
arXiv
2509.25624
Published
Sep 30, 2025
Layer
Application layer
Setting
AI Agent
Attacker
Black-box
Evaluated models
GPT-4.1-2025-04-14, GPT-4.1-mini-2025-04-14, Qwen3-32B and others8
- AttacksJailbreaks
- TechniqueMulti-turn escalation
Abstract作者提出并验证了智能体在序列化工具攻击下的普遍脆弱性，指出针对累积动作序列防御的必要性。
Paper analysisRead analysis

You have reached the end

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop

All papers

Attack type

Attack technique

Impact

System type

Attacker access

Attack surface / entry point

Layer

System component

An exploration of attacks on AI agent systems

CORSA：面向技能路由器的技能注入攻击可跨路由器与 LLM 迁移

A2A-TIBA：针对 A2A 协议 LLM 智能体的间接提示注入攻击与三层同构攻防模型

研究者提出技能级联攻击

A2M: A two-stage agent hijacking framework targeting the MCP ecosystem

微软团队提出 capability laundering 攻击：弱模型拆分任务向对齐前沿模型套取能力

HookPry：利用插件生命周期钩子更新劫持 AI Agent 框架

ISM：通过语义匹配隐式操纵 LLM Agent 的技能选择

ContextLeak：通过恶意工具窃取 LLM Agent 运行时上下文

EvoMal attack uses self-poisoning of self-evolving coding agents to achieve worm-like propagation

研究者提出 Convergent Detour Hijacking 攻击，可让技能型 LLM Agent 绕路并放大资源消耗

Research: LLM agent skill-name hallucination rates reach up to 62%, which can be exploited via squatting for supply-chain attacks

The study reveals workflow-level jailbreaks in IDE programming agents: GitHub Copilot generated harmful content across four backends at 816/816

KidnapRAG：黑盒投毒攻击劫持 Agentic RAG 的推理链

TRACE：面向 LLM Agent 的任务感知自适应自进化越狱框架

PIDP-Attack: Combining Prompt Injection and Database Poisoning to Attack RAG Systems

Aegis: Governance, Integrity, and Security for AI Voice Agents

Jailbreaking large language models through reinforcement learning with iterative tool disguise attacks

DREAM 框架用跨环境长链攻击评测 12 个 LLM Agent

STAC：看似无害的工具调用链如何攻破 LLM Agent