Translation in progress Some entries still include text in the original language.

Oct 13 · Tuesday

All papers

Found 21 papers

Filter5

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 201papers have no tags yet and are not included in filtered results.

Attack technique：Gradient and representation optimization Attack technique：Encoding and obfuscation Attack technique：Selection manipulation Attack surface / entry point：Documents and messages Attack surface / entry point：Tool and skill descriptions Clear all

Another 201papers do not have category tags yet and are not included in filtered results.

AttacksarXiv 2610.12524Oct 8
An exploration of attacks on AI agent systems
Retest and extend prompt injection against AI agents, and use Agent Card deception to manipulate A2A selection
arXiv
2610.12524
Published
Oct 8
Layer
Application layer
Setting
AI Agent
Evaluated models
Ollama Mistral 0.9.5, llama3-8b-8192, gemini-2.0-flash-lite and others5
- AttacksPrompt injection
- TechniqueEncoding and obfuscation
- ComponentMCP and skills
AbstractSingle-agent filtering and classification can be bypassed by format or wording, and A2A card selection is also biased toward names and descriptions.
The authors retested prompt injection on their own LangChain, AutoGen, and A2A systems, and modified the Agent Card to see if choices shifted. The abstract states the experiments mainly highlight single-agent weaknesses while extending attacks to multi-agent.
Paper analysisRead analysis
AttacksarXiv 2610.08098Oct 6
CORSA：面向技能路由器的技能注入攻击可跨路由器与 LLM 迁移
提出 CORSA，按任务簇优化技能注入的检索与执行
arXiv
2610.08098
Published
Oct 6
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-5.4, DeepSeek-V4-Pro, Qwen3.8-27B and others5
- AttacksPoisoning and backdoors
- TechniqueSelection manipulation
- ComponentMCP and skills
Paper analysisRead analysis
AttacksarXiv 2609.36576Sep 29
AdaLCPI: Making agents reconstruct indirect prompt injection from long-context fragments
提出 AdaLCPI，把恶意指令拆成碎片嵌入工具返回并诱导 Agent 越权执行
arXiv
2609.36576
Published
Sep 29
Layer
Application layer
Setting
AI Agent
Evaluated models
GPT-4.1, GPT-5.1, GPT-5.6-Luna and others7
- AttacksPrompt injection
- TechniqueEncoding and obfuscation
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.35912Sep 28
MMSkillRisk：多模态技能图像中的隐藏指令可诱导 Agent 执行未授权操作
提出 MMSkillRisk 基准，评测多模态技能图像中的隐藏指令诱导 Agent 越权操作
arXiv
2609.35912
Published
Sep 28
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-5.6-sol, Kimi-K2.6, Kimi-K3 and others6
- AttacksPrompt injection
- TechniqueCross-modal payloads
- ComponentMCP and skills
Abstract论文提出 MMSkillRisk 基准与 NCVA 攻击，揭示多模态技能中教学图像潜藏指令可引发未授权操作并与良性任务共存。
Paper analysisRead analysis
AttacksarXiv 2609.30383Sep 25
研究者提出技能级联攻击
提出技能级联攻击，把有害目标拆散到多个技能里绕过单技能扫描
arXiv
2609.30383
Published
Sep 25
Layer
Application layer
Setting
AI Agent
Evaluated models
GPT-5.4, GPT-5.4 Mini, Claude Opus 4.6 and others11
- AttacksPoisoning and backdoors
- TechniqueDefense-targeted
- ComponentMCP and skills
Abstract论文探讨了多技能智能体系统面临的技能级联攻击风险，提出自动化红队框架与基准集，指出跨技能交互存在安全防护盲区。
Paper analysisRead analysis
AttacksarXiv 2609.26761Sep 23
A2M: A two-stage agent hijacking framework targeting the MCP ecosystem
提出两阶段框架 A2M，优化 MCP 工具元数据与返回载荷以劫持 Agent
arXiv
2609.26761
Published
Sep 23
Layer
Application layer
Setting
AI Agent
Evaluated models
GLM-4.6, Qwen3-Max, DeepSeek-V3.1 and others5
- AttacksPrompt injection
- TechniqueAutomated search
- ComponentMCP and skills
Paper analysisRead analysis
AttacksarXiv 2609.18217Sep 16
研究：跨通道碎片化攻击可绕过 MCP 单通道防御
提出跨通道分段攻击，利用 MCP 隐式信任外发敏感文件
arXiv
2609.18217
Published
Sep 16
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-4o, GPT-4o-mini, GPT-5.4 and others15
- AttacksPrompt injection
- TechniqueEncoding and obfuscation
- ComponentMCP and skills
Abstract论文揭示了 MCP 多通道隐式信任层级，通过跨通道分段与协议级利用突破现有防御，展示了严重的凭证外发风险。
Paper analysisRead analysis
AttacksarXiv 2609.03884Sep 3
HookPry：利用插件生命周期钩子更新劫持 AI Agent 框架
提出 HOOKPRY，用插件钩子版本更新供应链劫持 Agent 框架
arXiv
2609.03884
Published
Sep 3
Layer
Application layer
Setting
AI Agent
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMCP and skills
Paper analysisRead analysis
AttacksarXiv 2609.02035Sep 2
ISM：通过语义匹配隐式操纵 LLM Agent 的技能选择
提出 ISM，用语义匹配隐式操纵 Agent 技能选择
arXiv
2609.02035
Published
Sep 2
Layer
Application layer
Setting
AI Agent
Evaluated models
Llama-2-7B, Llama-3-8B, Llama-3.1-8B and others8
- AttacksPoisoning and backdoors
- TechniqueSelection manipulation
- ComponentMCP and skills
Paper analysisRead analysis
AttacksarXiv 2608.27800Aug 28
ContextLeak：通过恶意工具窃取 LLM Agent 运行时上下文
提出 ContextLeak，用强化学习优化恶意工具描述，诱导 Agent 外泄运行时上下文
arXiv
2608.27800
Published
Aug 28
Layer
Application layer
Setting
AI Agent
Evaluated models
Qwen-3-8B, GPT-OSS-20B, Gemma-4-E4B-it and others11
- AttacksPrompt injection
- TechniqueSelection manipulation
- ComponentMCP and skills
Paper analysisRead analysis
AttacksarXiv 2608.25776Aug 26
EvoMal attack uses self-poisoning of self-evolving coding agents to achieve worm-like propagation
提出 EVOMAL，诱导自演化编码 Agent 在创建技能时自我投毒并蠕虫传播
arXiv
2608.25776
Published
Aug 26
Layer
Application layer
Setting
coding agent
Evaluated models
Devstral-Small-2, Gemma-4-31B-IT, Qwen3-Coder-Next and others7
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMCP and skills
Abstract论文指出了自演化智能体模仿检索代码的自我毒化漏洞，提出 EVOMAL 攻击与防御，阐明了供应链新风险。
Paper analysisRead analysis
AttacksarXiv 2608.12273Aug 13
研究者提出 Convergent Detour Hijacking 攻击，可让技能型 LLM Agent 绕路并放大资源消耗
提出 CDH 攻击，让技能型 Agent 绕路放大资源消耗
arXiv
2608.12273
Published
Aug 13
Layer
Application layer
Setting
AI Agent
Evaluated models
Claude-Haiku-4.5, DeepSeek-V4-Pro, DeepSeek-V4-Flash and others6
- AttacksPrompt injection
- TechniqueSelection manipulation
- ComponentMCP and skills
AbstractCDH 让静态技能在保持任务完成时拉高调用与 token，耗时则因后端而异。
CDH 是针对渐进披露技能智能体的发布者侧、纯文本攻击：一个静态协调器把本可正确完成的任务，拐进有界但更耗资源的技能绕路，再交还原任务。
Paper analysisRead analysis
AttacksarXiv 2607.12340Jul 14
Research: LLM agent skill-name hallucination rates reach up to 62%, which can be exploited via squatting for supply-chain attacks
提出技能名称抢注攻击，利用 Agent 虚构技能名实施供应链劫持
arXiv
2607.12340
Published
Jul 14
Layer
Application layer
Setting
coding agent
Evaluated models
GLM-4.5-Air, GPT-5.4-mini, Claude Sonnet 4.6 and others12
- AttacksPoisoning and backdoors
- RiskHallucination and fabrication
- TechniqueSelection manipulation
- ComponentMCP and skills
Abstract研究证实智能体虚构技能名具有高发生率与可预测性，现有防御难以兼顾安全与效用，亟需注册表结构性防护。
本研究系统揭示了大模型智能体技能推荐场景下的虚构技能名称安全风险，将其形式化为一种新型供应链抢注攻击。
Paper analysisRead analysis
AttacksarXiv 2606.12716Jun 11
PaperGuard：针对多模态 AI 同行评审的攻击与防御基准
提出 PaperGuard，用图文注入与梯度扰动抬高自动审稿分数并检测恶意指令
arXiv
2606.12716
Published
Jun 11
Layer
Application layer
Setting
LLM applications
Evaluated models
Claude-sonnet-4.5, GPT-4o, GPT-4.1 and others11
- AttacksPrompt injection
- TechniqueCross-modal payloads
- ComponentVision
AbstractPaperGuard 测到提示注入与白盒视觉抬分，并比较分块检索防御。
PaperGuard同时评测并检测多模态 AI 审稿中的评分操纵。
Paper analysisRead analysis
AttacksarXiv 2604.03081Apr 3
Supply Chain Poisoning Attacks on the LLM Coding Agent Skill Ecosystem
提出 PoisonedSkills，评测编码 Agent 技能生态的文档投毒
arXiv
2604.03081
Published
Apr 3
Layer
Application layer
Setting
coding agent
Evaluated models
Claude Sonnet 4.6, GLM-4.7, MiniMax-M2.5 and others5
- AttacksPoisoning and backdoors
- TechniqueEncoding and obfuscation
- ComponentMCP and skills
Abstract作者称技能文档可成为系统操作攻击入口，但结果只评估加载后的阶段。
PoisonedSkills 研究编码智能体的技能供应链投毒，重点是文档内容如何进入实际系统操作。。
Paper analysisRead analysis
AttacksarXiv 2602.18514Feb 20
招聘中的特洛伊木马：标准模型与推理模型间接提示注入的红队测试案例研究
用简历中的不可见指令做间接提示注入，操纵招聘推荐
arXiv
2602.18514
Published
Feb 20
Layer
Application layer
Setting
LLM applications
Evaluated models
Qwen 3 30B A3B Instruct 2507, Qwen 3 30B A3B Thinking 2507
- AttacksPrompt injection
- TechniqueEncoding and obfuscation
- ComponentReasoning chains
Abstract作者称推理在简单注入下会帮攻击圆谎，在不合逻辑的复杂注入下又会把欺骗漏出来。
Paper analysisRead analysis
AttacksarXiv 2602.14211Feb 16
SkillJect: Automatically generating skill-based prompt injection for skill-based agents
Proposes SkillJect, which automatically generates poisoned skills to induce code agents to execute hidden scripts
arXiv
2602.14211
Published
Feb 16
Layer
Application layer
Setting
coding agent
Evaluated models
Claude-4.6-Sonnet, GPT-5-mini, GLM-4.7 and others10
- AttacksPrompt injection
- TechniqueAutomated search
- ComponentMCP and skills
AbstractSkillJect poisons skills using dual channels and closed-loop refinement.
SkillJect is an automated prompt injection framework targeting installable agent skills. The authors address the problem that malicious instructions placed in publicly available or manually installed skills are often rejected or ignored, yet once a skill is installed, it is repeatedly loaded as trusted guidance.
Paper analysisRead analysis
AttacksarXiv 2602.00364Jan 31
"Someone hid it": Query-agnostic black-box attacks against LLM retrieval
提出查询无关黑盒攻击 DQ-A，用可迁移文末后缀降低文档检索排名
arXiv
2602.00364
Published
Jan 31
Layer
Application layer
Setting
LLM applications
Evaluated models
Qwen-1.5-7B-Instruct, SFR-Embedding-Mistral, E5-Mistral-7B-Instruct and others10
- AttacksPoisoning and backdoors
- TechniqueGradient and representation optimization
- ComponentRAG
AbstractDQ-A 以无查询黑盒后缀压低 LLM 检索排名，并在 BRIGHT 上比较三种基线。
DQ-A 是一种 query-agnostic、complete black-box 的文档隐藏攻击，对象是用最后隐层相似度匹配的 LLM 检索。
Paper analysisRead analysis
AttacksarXiv 2601.21360Jan 29
Compliance Paradox: Semantic-Instruction Decoupling in Automated Academic Code Evaluation
提出 AST-ASIP ，把对抗指令植入编译器忽略区域以劫持代码评分
arXiv
2601.21360
Published
Jan 29
Layer
Application layer
Setting
LLM applications
Evaluated models
DeepSeek-V3.2, Qwen3-235B, GPT-OSS-120B and others9
- AttacksPrompt injection
- TechniqueEncoding and obfuscation
- ComponentGuardrails and judges
Abstract作者称 RLHF 的服从性使评分脱离代码。
这篇工作把自动代码评分中的失败称为 Compliance Paradox：评分模型可以离开提交逻辑，转而执行嵌在可编译代码里的隐藏指令。
Paper analysisRead analysis
AttacksarXiv 2601.20283Jan 28
One word is enough: Minimal adversarial perturbations for neural text ranking
提出查询中心词的单次插入或替换攻击，操纵神经排序名次
arXiv
2601.20283
Published
Jan 28
Layer
Application layer
Setting
LLM applications
Evaluated models
BERT-base-mdoc-BM25, monoT5-base-MSMARCO
- TechniqueGradient and representation optimization
Abstract作者称单词扰动即可抬升名次、中段文档最脆弱，且比白盒 PRADA 更少编辑。
单个与查询对齐的词，就可能改掉神经重排结果。要做的是少改原文，仍把目标文档在 NRM 列表里的名次抬高。
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop

All papers

Attack type

Attack technique

Impact

System type

Attack surface / entry point

Layer

System component

An exploration of attacks on AI agent systems

CORSA：面向技能路由器的技能注入攻击可跨路由器与 LLM 迁移

AdaLCPI: Making agents reconstruct indirect prompt injection from long-context fragments

MMSkillRisk：多模态技能图像中的隐藏指令可诱导 Agent 执行未授权操作

研究者提出技能级联攻击

A2M: A two-stage agent hijacking framework targeting the MCP ecosystem

研究：跨通道碎片化攻击可绕过 MCP 单通道防御

HookPry：利用插件生命周期钩子更新劫持 AI Agent 框架

ISM：通过语义匹配隐式操纵 LLM Agent 的技能选择

ContextLeak：通过恶意工具窃取 LLM Agent 运行时上下文

EvoMal attack uses self-poisoning of self-evolving coding agents to achieve worm-like propagation

研究者提出 Convergent Detour Hijacking 攻击，可让技能型 LLM Agent 绕路并放大资源消耗

Research: LLM agent skill-name hallucination rates reach up to 62%, which can be exploited via squatting for supply-chain attacks

PaperGuard：针对多模态 AI 同行评审的攻击与防御基准

Supply Chain Poisoning Attacks on the LLM Coding Agent Skill Ecosystem

招聘中的特洛伊木马：标准模型与推理模型间接提示注入的红队测试案例研究

SkillJect: Automatically generating skill-based prompt injection for skill-based agents

"Someone hid it": Query-agnostic black-box attacks against LLM retrieval

Compliance Paradox: Semantic-Instruction Decoupling in Automated Academic Code Evaluation

One word is enough: Minimal adversarial perturbations for neural text ranking