Skip to content

Translation in progress Some entries still include text in the original language.

Oct 13 · Tuesday

All papers

Found 25 papers
Filter6

Attack type

Prompt injection20Poisoning and backdoors15

Attack technique

Gradient and representation optimization4Automated search28Encoding and obfuscation9Role-play and persuasion4Conversation structure manipulation3Cross-modal payloads5Defense-targeted9Dormant triggers12Selection manipulation10

Impact

Unauthorized actions14Data and privacy leaks5Output manipulation6

System type

LLM applications3AI Agent22coding agent9web agent5

Attack surface / entry point

User input85Web pages and interfaces12Documents and messages14Tool responses10Tool and skill descriptions10Code repositories and dependencies7Retrieval corpus10Memory writes19Inter-agent messages4Images, audio and video56Training data18Weights and gradients29Distribution channels24Inference services and hardware3

Layer

Application layer25

System component

MCP and skills10Memory5RAG3Vision5Multimodal5
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 215papers have no tags yet and are not included in filtered results.
Attack technique：Gradient and representation optimizationAttack technique：Encoding and obfuscationAttack technique：Dormant triggersAttack surface / entry point：Web pages and interfacesAttack surface / entry point：Tool and skill descriptionsAttack surface / entry point：Code repositories and dependenciesClear all

Another 215papers do not have category tags yet and are not included in filtered results.

  1. AttacksarXiv 2610.12524

    An exploration of attacks on AI agent systems

    Retest and extend prompt injection against AI agents, and use Agent Card deception to manipulate A2A selection

    arXiv
    2610.12524
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    Ollama Mistral 0.9.5, llama3-8b-8192, gemini-2.0-flash-lite and others5
    AbstractSingle-agent filtering and classification can be bypassed by format or wording, and A2A card selection is also biased toward names and descriptions.

    The authors retested prompt injection on their own LangChain, AutoGen, and A2A systems, and modified the Agent Card to see if choices shifted. The abstract states the experiments mainly highlight single-agent weaknesses while extending attacks to multi-agent.

    Paper analysisRead analysis
  2. AttacksarXiv 2610.09240

    WebMirage hijacks visual web agents' browser operations with adversarial images

    提出 WebMirage，用局部对抗图像劫持视觉网页 Agent 的浏览器操作

    arXiv
    2610.09240
    Published
    Layer
    Application layer
    Setting
    web agent
    Evaluated models
    LLaVA-v1.5-13B, LLaVA-v1.6-34B, MiniCPM-o-8B and others6
    Abstract论文提出了针对网络智能体的端到端视觉红队框架 WebMirage，揭示了从视觉定位到浏览器执行的安全脆弱性。

    WebMirage 是一个面向视觉定位网络智能体的流水线感知端到端红队攻击框架。

    Paper analysisRead analysis
  3. AttacksarXiv 2610.07510

    PersistBD: attackers can strengthen backdoors before release so that they maintain high attack success rates even after developer SFT and RL.

    提出 PERSISTBD，发布前强化供应链后门使其经良性 SFT 与 RL 后仍外发凭据

    arXiv
    2610.07510
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    Qwen2.5-Coder-3B-Instruct, Qwen2.5-Coder-7B-Instruct, Qwen3-Coder-30B-A3B-Instruct
    Abstract总结了论文关于后门在 SFT/RL 中存活的发现、两因子机制、PERSISTBD 方法与核心数字。

    本文研究第三方 LLM 智能体在开发者进行良性监督微调（SFT）和强化学习（RL）后训练时的后门持久性风险。

    Paper analysisRead analysis
  6. Evaluation and benchmarksarXiv 2609.35912

    MMSkillRisk：多模态技能图像中的隐藏指令可诱导 Agent 执行未授权操作

    提出 MMSkillRisk 基准，评测多模态技能图像中的隐藏指令诱导 Agent 越权操作

    arXiv
    2609.35912
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    GPT-5.6-sol, Kimi-K2.6, Kimi-K3 and others6

    Abstract论文提出 MMSkillRisk 基准与 NCVA 攻击，揭示多模态技能中教学图像潜藏指令可引发未授权操作并与良性任务共存。

    Paper analysisRead analysis
  7. AttacksarXiv 2609.22510

    特拉维夫大学提出爆炸性提示词：条件触发的间接提示注入可绕过九款生产 Agent

    提出条件触发的爆炸提示词，并设计摄入期检测器 DeFuse

    arXiv
    2609.22510
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    Llama-3.1-8B-Instruct, Llama-3.1-70B-Instruct, Qwen2.5-32B-Instruct and others15
    Abstract论文揭示了条件触发使提示注入绕过防御并在触发时执行工具，提出轻量检测器并在摄入期有效防范。

    论文针对大语言模型智能体面临的间接提示注入威胁，研究了利用条件句式实现时间分离的爆炸提示词。

    Paper analysisRead analysis
  8. AttacksarXiv 2609.18217

    研究：跨通道碎片化攻击可绕过 MCP 单通道防御

    提出跨通道分段攻击，利用 MCP 隐式信任外发敏感文件

    arXiv
    2609.18217
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    GPT-4o, GPT-4o-mini, GPT-5.4 and others15

    Abstract论文揭示了 MCP 多通道隐式信任层级，通过跨通道分段与协议级利用突破现有防御，展示了严重的凭证外发风险。

    Paper analysisRead analysis
  10. AttacksarXiv 2609.02774

    CodePoisonRAG：针对检索增强代码生成的知识投毒攻击

    提出 CodePoisonRAG，对检索增强代码生成的知识库投毒以植入漏洞

    arXiv
    2609.02774
    Published
    Layer
    Application layer
    Setting
    LLM applications
    Evaluated models
    Qwen 3.5 9B, Code Llama 13B, DeepSeek-Coder-V2 16B

    AbstractCodePoisonRAG 展示了 RACG 外部知识库的新攻击面，在较低投毒率下可定向诱发指定漏洞并部分抵御防御。

    Paper analysisRead analysis
  12. AttacksarXiv 2608.25776

    EvoMal attack uses self-poisoning of self-evolving coding agents to achieve worm-like propagation

    提出 EVOMAL，诱导自演化编码 Agent 在创建技能时自我投毒并蠕虫传播

    arXiv
    2608.25776
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    Devstral-Small-2, Gemma-4-31B-IT, Qwen3-Coder-Next and others7

    Abstract论文指出了自演化智能体模仿检索代码的自我毒化漏洞，提出 EVOMAL 攻击与防御，阐明了供应链新风险。

    Paper analysisRead analysis
  13. AttacksarXiv 2608.09577

    ElasticBack：通过触发词与规则耦合在 LLM Agent 技能中植入条件后门

    提出 ElasticBack，在单个 Agent 技能中植入条件后门

    arXiv
    2608.09577
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    GLM-5.2, MiniMax-M3, GPT-5.4 and others4
    AbstractElasticBack 用冻结规则加遗传搜索演化 trigger，在单 skill 上做条件后门。

    ElasticBack 是放在 LLM agent 单个 skill 里的条件后门攻击。。

    Paper analysisRead analysis
  14. AttacksarXiv 2606.04329

    研究者系统研究 LLM 智能体记忆投毒攻击并提出 MPBench 基准

    系统研究 LLM 智能体记忆投毒并构建基准 MPBench

    arXiv
    2606.04329
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    Meta-Llama-3.1-70B-Instruct, Deberta-v3-base, Llama-3.1-8B-Instruct and others5

    Abstract系统研究了智能体记忆投毒风险，揭示了写入渠道漏洞，构建了 MPBench 基准并指出提示注入防御的局限。

    Paper analysisRead analysis
  15. AttacksarXiv 2605.15338

    Hidden in Memory: Latent Memory Poisoning of LLM Agents

    提出潜伏记忆投毒，诱导 Agent 把外部文档写成持久伪造记忆

    arXiv
    2605.15338
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    GPT-5.4, GPT-5.5, Claude Sonnet 4.6 and others12
    Abstract持久记忆成为跨会话攻击面：通用载荷可写入伪造记忆，并在相关后续任务中影响行为。

    sleeper memory poisoning 研究带持久记忆的 LLM 助手：外部文档能否让助手存下一则伪造的用户记忆，并在原文档消失后的新会话里被取回、用来改变回复或动作。

    Paper analysisRead analysis
  16. AttacksarXiv 2604.03081

    Supply Chain Poisoning Attacks on the LLM Coding Agent Skill Ecosystem

    提出 PoisonedSkills，评测编码 Agent 技能生态的文档投毒

    arXiv
    2604.03081
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    Claude Sonnet 4.6, GLM-4.7, MiniMax-M2.5 and others5
    Abstract作者称技能文档可成为系统操作攻击入口，但结果只评估加载后的阶段。

    PoisonedSkills 研究编码智能体的技能供应链投毒，重点是文档内容如何进入实际系统操作。。

    Paper analysisRead analysis
  17. AttacksarXiv 2604.02623

    论文提出 eTAMP 攻击：网页内容注入可跨会话污染 Web Agent 记忆

    提出 eTAMP，用网页内容跨会话投毒 Web Agent 轨迹记忆并诱导越权操作

    arXiv
    2604.02623
    Published
    Layer
    Application layer
    Setting
    web agent
    Evaluated models
    GPT-5-mini, GPT-5.2, GPT-OSS-120B and others6
    Abstract论文提出了基于环境注入的跨任务记忆投毒攻击 eTAMP，作者报告智能体在环境压力下易感性增加且能力与安全并不协同。

    该论文评估了基于大语言模型的 Web 智能体在利用历史交互轨迹进行记忆增强时的安全脆弱性。

    Paper analysisRead analysis
  18. AttacksarXiv 2603.16960

    Adversarial attacks against modern vision-language models

    Conduct adversarial attacks on product images for open-source visual shopping agents and induce wrong purchases

    arXiv
    2603.16960
    Published
    Layer
    Application layer
    Setting
    web agent
    Evaluated models
    LLaVA-v1.5-7B, Qwen2.5-VL-7B
    AbstractThe authors state that LLaVA is easily induced by three attacks to buy the wrong item, while Qwen's correct purchase rate remains close to its clean condition.

    The authors compare the robustness of two open-source VLM shopping agents against image adversarial perturbations in a self-built e-commerce environment.

    Paper analysisRead analysis
  19. AttacksarXiv 2602.15654

    Zombie Agent: Persistent Control of Self-Evolving LLM Agents via Self-Reinforcing Injection

    提出 Zombie Agent 攻击，经网页间接注入将载荷写入长期记忆并跨会话触发

    arXiv
    2602.15654
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    Gemini-2.5-Flash, GLM-4.7-Flash
    Abstract记忆写入把一次网页间接注入变成跨会话控制。

    Zombie Agent 把自进化 LLM 智能体的跨会话记忆当成攻击面：攻击者只发布网页，良性任务读入后，正常记忆更新留下载荷，并在以后无关会话里触发未授权工具行为。

    Paper analysisRead analysis
  20. AttacksarXiv 2602.14211

    SkillJect: Automatically generating skill-based prompt injection for skill-based agents

    Proposes SkillJect, which automatically generates poisoned skills to induce code agents to execute hidden scripts

    arXiv
    2602.14211
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    Claude-4.6-Sonnet, GPT-5-mini, GLM-4.7 and others10
    AbstractSkillJect poisons skills using dual channels and closed-loop refinement.

    SkillJect is an automated prompt injection framework targeting installable agent skills. The authors address the problem that malicious instructions placed in publicly available or manually installed skills are often rejected or ignored, yet once a skill is installed, it is repeatedly loaded as trusted guidance.

    Paper analysisRead analysis
Load more