Translation in progress Some entries still include text in the original language.
Oct 12 · Monday
Another 240 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
提出 AdaLCPI，把恶意指令拆成碎片嵌入工具返回并诱导 Agent 越权执行
Published Sep 29
Evaluated models GPT-4.1 , GPT-5.1 , GPT-5.6-Luna and others7 提出 MMSkillRisk 基准，评测多模态技能图像中的隐藏指令诱导 Agent 越权操作
Published Sep 28
Evaluated models GPT-5.6-sol , Kimi-K2.6 , Kimi-K3 and others6 Abstract 论文提出 MMSkillRisk 基准与 NCVA 攻击，揭示多模态技能中教学图像潜藏指令可引发未授权操作并与良性任务共存。
提出跨通道分段攻击，利用 MCP 隐式信任外发敏感文件
Published Sep 16
Evaluated models GPT-4o , GPT-4o-mini , GPT-5.4 and others15 Abstract 论文揭示了 MCP 多通道隐式信任层级，通过跨通道分段与协议级利用突破现有防御，展示了严重的凭证外发风险。
提出 SYNCHAIN，诱导计算机使用 Agent 自建跨任务持久攻击链
Published Aug 7
Evaluated models Qwen3.5-9B , Llama-3.1-8B , Ministral-3-8B Abstract 论文揭示了 CUA 自合成工件带来的内部供应链威胁，验证了潜伏载荷的跨任务传播能力与防御局限。
提出 PoisonedSkills，评测编码 Agent 技能生态的文档投毒
Published Apr 3
Evaluated models Claude Sonnet 4.6 , GLM-4.7 , MiniMax-M2.5 and others5 Abstract 作者称技能文档可成为系统操作攻击入口，但结果只评估加载后的阶段。PoisonedSkills 研究编码智能体的技能供应链投毒，重点是文档内容如何进入实际系统操作。 。
用简历中的不可见指令做间接提示注入，操纵招聘推荐
Published Feb 20
Evaluated models Qwen 3 30B A3B Instruct 2507 , Qwen 3 30B A3B Thinking 2507 Abstract 作者称推理在简单注入下会帮攻击圆谎，在不合逻辑的复杂注入下又会把欺骗漏出来。
提出 SkillJect，自动生成投毒 skill 诱导代码 Agent 执行隐藏脚本
Published Feb 16
Evaluated models Claude-4.6-Sonnet , GPT-5-mini , GLM-4.7 and others10 Abstract SkillJect 用双通道和闭环精炼投毒 skill。SkillJect 是针对可安装 agent skill 的自动化提示注入框架。作者要解决的是：公开或手工放入 skill 的恶意指令常常被拒绝或忽略，而 skill 一旦安装就会被反复当作可信指导加载。
提出 AST-ASIP ，把对抗指令植入编译器忽略区域以劫持代码评分
Published Jan 29
Evaluated models DeepSeek-V3.2 , Qwen3-235B , GPT-OSS-120B and others9 Abstract 作者称 RLHF 的服从性使评分脱离代码。这篇工作把自动代码评分中的失败称为 Compliance Paradox：评分模型可以离开提交逻辑，转而执行嵌在可编译代码里的隐藏指令。
Attacks arXiv 2512.10449 · Dec 11, 2025 提出 DSAAP，以不可见文本对科学审稿 PDF 做间接提示注入
Published Dec 11, 2025
Evaluated models gpt-oss-20B , tulu3-8B , Llama 3.1-8B and others13 You have reached the end