Attack Surface
Security research involving application interfaces and API implementations
273 matching entries
Exposed retrieval embeddings can reveal source text. SHAQ evaluates indexing generated queries instead of direct document embeddings to reduce that leakage.
Source: arXiv
Untrusted document images can redirect vision-language agents across instruction and tool-authorization boundaries. Repeat-After-Me evaluates six victim models on constructed document tasks.
Source: arXiv
Deleting a memory record can leave its information in an agent's summaries, pending plans and KV cache. The paper evaluates revocation across this derived execution state.
Source: arXiv
Context assembly can promote repository, tool or skill content into higher-priority instructions or persistent state. The paper studies 12 pinned agent-harness versions.
Source: arXiv
Document-image PII detection can miss identifiers despite improving average localization scores. LeakageBench evaluates 500 pages with 11,954 annotations.
Source: arXiv
A stored interaction can later steer a memory-augmented agent's answer without direct memory-store access. The study evaluates persistent response manipulation in MemoryOS and MemGPT.
Source: arXiv
Third-party skills can inflate coding-agent resource use while an otherwise legitimate task remains functional.
Source: arXiv
Lower-trust tool content can assert facts beyond its authority and distort an agent's decisions. PIPES screens response units against source provenance and expected field meaning.
Source: arXiv
Shell-command screening can miss harmful actions generated by coding agents. CARE combines static checks with optional model review at the command-dispatch boundary.
Source: arXiv
Untrusted issue descriptions and tool responses can redirect privileged coding and tool agents. Twin Agent separates exploration from execution and restricts the information exchanged between them.
Source: arXiv