SEAL: Towards Persistent Tool Poisoning Attack against LLM Agents via Prefix-Eliciting Trigger
Tool poisoning has emerged as a critical security threat to LLM agents, where adversaries embed malicious instructions i
2026-10-20 归档
今日共收录 730 条安全情报，包含 0 个 CVE，352 篇安全通告，以及 100 篇研究论文。
← 返回归档列表Many Repairs, One Direction: Steering Code Models Toward Safer Cryptographic API Use
Cryptographic API misuse in large language model-generated code can compromise software security. While many existing ap
Locate, Then Reason: End-to-End Patch Presence Testing in Stripped Binaries
Binary patch presence testing (PPT) determines whether a security fix is present in a stripped binary. Prior systems oft
Don't Judge an Agent by Its Messages: Private-State Leakage under Passive Monitoring of Agent Communication
An AI agent can reproduce the distribution of its messages and of the receiver's task outcomes while disclosing private
Peer Pressure: Execution-Verified Co-Evolution of Attacker and Defender Populations for Code Security
LLM code agents increasingly ship code with little oversight, yet defenders trained on static vulnerability datasets fal
The One-Pixel of Reasoning: One Truthful Relation Is Enough to Mislead LLM Agents
Can one sentence manipulate an agent's belief by targeting a single implicit warrant linking evidence to a conclusion? I
The Missing Compliance Class: LLM Graders That Collapse Jailbreak Success, and a Free Check
Jailbreak papers report an attack success rate, the share of responses that deliver the harmful request, and read it as
LLM Trojans that Increase Response Lengths and Cost
Management of the token-based costs of using LLMs has emerged as a significant problem. Some frontier-model providers ch
Narratives Mislead: An Empirical Study of How LLMs Misjudge CVSS Severity in Bug Bounty Reports
Bug bounty platforms receive vulnerability reports faster than vendors can triage them, and Large Language Models (LLMs)
When Code Becomes an LLM Call: An Empirical Study of Call-Site Contracts in Agentic Systems
Software quality has long rested on specifications that state what code must do, and on testing and verification that ch
Unbounded Losses, Unchecked Inputs: Measuring the Safeguards of LLM Options-Trading Agents
Large language model (LLM) agents now place options orders at retail brokers, and developers publish open-source options
SPIDES: Information-Flow Control for Browser Agents
Browser agents automate complex workflows by reading and acting on arbitrary page content, but this flexibility exposes
Under the Skin: Backdoor Infection in Multimodal Large Language Models
Multimodal Large Language Models (MLLMs) have achieved impressive performance in generating text conditioned on inputs f
The Window Is in the Reasoning: When LLM Agents Decide to Follow Prompt Injections
LLM agents that read untrusted content can be hijacked by prompt injections. Runtime monitors that try to catch a hijack
Token-Level Attribution of Multi-Mode LLM Watermarks: Optimal Rule and Belief Weighting
A watermark verifier may hold many modes, i.e., secret keys, and a document may mix spans of different modes with unwate
Monitor-Validity Failures: LLM Safety Evidence Paths at Evolving Framework Boundaries
Modern LLM applications rely on runtime monitors that inspect tool calls, traces, streams, detector outputs, and verifie
MobileInject: Evaluating Reasoning-to-Action Security of MLLM-Based Mobile Agents under Cross-Modal Consistency Injection
Multimodal large language model (MLLM)-based mobile agents are rapidly evolving from conversational assistants into auto
MobileJailBench: Red Queen Jailbreak Benchmarking for Mobile Agents
MLLM-based mobile agents are rapidly gaining autonomy in perception, planning, and closed-loop execution in dynamic mobi
Ignored, Not Refused: What Low Prompt-Injection Success Rates Hide in Small Tool-Using Agents
Tool-using agents read untrusted external content, which exposes them to indirect prompt injection (IPI), where hidden i
AgentLoupe: Kernel-Resident Semantic Causal Labels for AI Agent Observability
AI agents translate user intents into system actions via tool invocations. Accurately attributing these actions to their