AI Agent Security

Follow this topic Ask about this topic

Momentum

43 papers in the last four weeks, up 258% on the four weeks before. 0.4% of all new papers.

Jul 13Week of Sep 28

Latest papers 311

All topics

Agent Name Collision Attacks in Multi-Agent Systems
Sep 23, 2026Adithyan Arun KumarAgent Communication Protocols AI Agent Security
Independent Security Researcher
The Like Trap: Multi-Stage Poisoning against Agents in Similarity-based Recommendation Systems
Sep 22, 2026Yue Xing, Pengfei He, Zitao LiAI Agent Security Recommender Systems
Michigan State University
A2M: Trace-Optimized Agent Hijacking in the MCP Ecosystem
Sep 22, 2026Laizhen Li, Xuan Wang, Peicheng Zhao +4MCP Security AI Agent Security
Shenzhen Institutes of Advanced Technology, Chinese Academy of Sciences · University of Chinese Academy of Sciences · Nanyang Technological University +3
Indirect tipping: a social attack surface in AI agent populations
Sep 21, 2026Ariel Flint, Luca Maria Aiello, Sara M. Constantino +2Multi-Agent Coordination AI Agent Security
Department of Mathematics, City St George’s, University of London, UK. · IT University of Copenhagen, Denmark. · Pioneer Centre for AI, Copenhagen, Denmark. +2
ClashBench: Conflicts Leading Agents to Seize and Harm
Sep 17, 2026Yuejin Xie, Yu Li, Dadi Guo +6AI Agent Security AI Agent Safety
Tsinghua University · Shanghai AI Lab · Fudan University +2
Red-Teaming Auto Mode: Improving Blocking Classifiers Against Malign Coding Agents
Sep 17, 2026Alex Remedios, Simon Storf, Fabien Roger +1AI Agent Security AI Agent Monitoring
Anthropic Fellows Program · Anthropic
Reputation as Community Memory for the Agentic Web
Sep 16, 2026Ryan Chard, Gus Ellerm, Alexander Brace +4Agent Memory AI Agent Security
University of Chicago & Argonne National Laboratory, Chicago, IL, USA
Securing quantum error correction against misleading advice from AI agents
Sep 16, 2026A. Barış ÖzgülerAI Agent Reliability Quantum Error Correction
Market Signal Injection: Adversarial Context Manipulation of LLM Pricing Agents
Sep 16, 2026Dohun Lee, Hyunwoo ParkAdversarial Attacks on LLMs AI Agent Security
Graduate School of Data Science, Seoul National University
Autonomy in Check: Governor-Mediated Adaptive Security at the Edge
Sep 16, 2026Ijaz Ahmad, Ijaz Ahmad, Flavio Esposito +1Autonomous Cyber Defense AI Agent Security
Centre for Wireless Communications, University of Oulu, Oulu, Finland · VTT Technical Research Centre of Finland, Espoo, Finland · Department of Computer Science, Saint Louis University, St. Louis, Missouri, USA
Reflections on Trusting Trust, Revisited: Contaminating Self-Modifying AI Coding Agents with Poisoned Benchmarks
Sep 15, 2026Franziska Roesner, Tadayoshi KohnoAI Coding Agents AI Agent Security
University of Washington · Georgetown University
Vulnerability Localization Benchmark: Measuring Agentic Security Analysis at Repository Scale
Sep 14, 2026Aman Priyanshu, Supriti Vijay, Kimia Majd +8Software Vulnerability Detection AI Agent Security
1Foundation AI–Cisco Systems Inc. · 3Carnegie Mellon University · †Work done while at Foundation AI +1
Universal Defenses for Tool-Integrated LLM Agents Against Adversarial Attacks
Sep 14, 2026Xiaoyan Li, Yunli WangAdversarial Attacks on LLMs Backdoor Defense in LLMs
Department of Computer Science University of Toronto Toronto, Ontario, Canada · Digital Technologies Research Centre National Research Council Canada Ottawa, Ontario, Canada
Empirical Evaluation of Task-Based Permission Scoping Architecture for AI Agents
Sep 14, 2026Halil Burak NoyanAI Agent Evaluation AI Agent Security
Independent Researcher
SoK: Rethinking Jailbreaking in the Era of Agentic AI: Attacks, Defenses, and Practical Consideration
Sep 14, 2026Md Jueal Mia, Yanzhao Wu, Selcuk Uluagac +1Language Model Safety Evaluation Jailbreak Robustness
Knight Foundation School of Computing and Information Sciences, Florida International University, USA · Security, Optimization, and Learning for InterDependent Networks (solid) Laboratory, Miami, Florida, USA
An Experimental Evaluation of Multimodal Prompt Injection Attacks on Agentic AI Frameworks
Sep 10, 2026Viet K. Nguyen, Mohammad I. HusainAI Agent Security AI Agent Security Benchmarks
California State Polytechnic University, Pomona Pomona, CA 91768, USA
Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Sep 10, 2026Divyanshu Kumar, Nitin Aravind Birur, Tanay Baswa +2AI Agent Security AI Agent Security Benchmarks
Enkrypt AI
AgentAudit: An Open, Extensible Framework for Full-Lifecycle Trust Evaluation of AI Agents
Sep 9, 2026Shrey Nag, Sachita, Abhishek Kumar Singh +2AI Agent Reliability AI Agent Auditing
TIET · IGDTUW · GTBIT +1
From Evidence to Effect: Authority Semantics and Runtime Infrastructure for Stateful Agents
Sep 8, 2026Yang Li, Zongsi Xu, Sergey Volkov +7AI Agent Security Tool Access Control for LLM Agents
The University of Hong Kong · School of Artificial Intelligence, Jiangxi Science and Technology Normal University · The Hong Kong University of Science and Technology +1
Do AI Coding Assistants Check Before They Install? A Pre-Registered Demand-Side Audit of Trust Signals in the Research Software Supply Chain
Sep 7, 2026Pengyin ShanAlgorithmic Auditing AI Coding Agents
National Center for Supercomputing Applications University of Illinois Urbana-Champaign Urbana, IL, USA
CoER: Defending against Adaptive Indirect Prompt Injection via Adversarial Co-Evolution and Refinement
Sep 7, 2026Boyang Zhang, Qingxin Xiao, Lingwei Dang +1Reinforcement Learning AI Agent Security
School of Software Engineering, South China University of Technology
Rethinking Indirect Prompt Injection as a Test-Time Search Problem
Sep 7, 2026Duong M. Nguyen, Joon Sik Kim, Blazej Manczak +1Inference-Time Search AI Agent Security
Dynamo AI · University of Illinois Urbana-Champaign
A Blind Trust, the Bloody Thrust: When Attacker-Controlled Hook Updates Steer AI Agent Harnesses towards Malicious Behaviors
Sep 3, 2026Pengxun Li, Litian Zhang, Jianwei Hou +4AI Agent Security LLM Agent Harnesses
Beijing University of Posts and Telecommunications · Data and Technology Support Center of the Cyberspace Administration of China · Beihang University +1
Defense-as-Skill: Evolving Runtime Guard Skill for Skill-Augmented Agents
Sep 1, 2026Xiaofang Yang, Ziqi Miao, Dianbo Sui +2AI Agent Security AI Agent Security Benchmarks
Shanghai Artificial Intelligence Laboratory · Harbin Institute of Technology, Weihai
EvoSkill Injection: Red-Teaming Autonomous Skill Generation and Evolution in Self-Evolving Agents
Aug 31, 2026Doyun Kim, Chanwoo Kim, Sugyeong Eo +2AI Agent Security AI Agent Security Benchmarks
Soongsil University · Yonsei University · Jeju National University
Zero-Knowledge Predicate Proofs Between AI Agents: A Measured, Cross-Protocol Gateway and the Source-Integrity Gap
Aug 30, 2026Ashok Subbabhatta GopalakrishnaAgent Communication Protocols MCP Security
independent researcher
Breaking Planner Integrity Boundary: Enviroment State-Text Injection Attack on LLM-Driven Embodied Agents
Aug 17, 2026Jiawei Liu, Jiacheng Guo, Tian Zhang +7Large Language Model-Based Robot Planning AI Agent Security
Wuhan University · University at Buffalo
InterSAGE: The Secure and Verifiable Interoperability Protocol for An Internet of Agents
Aug 13, 2026Zhenhua Zou, Sheng Guo, Qiuyang Zhan +3AI Accountability AI Agent Security
A Paper from the DeepKernel Lab
PIPES: Securing Agent Perception with Provenance and Priors
Aug 13, 2026Sanjay Kariyappa, Severin Klingler, G. Edward SuhData Provenance AI Agent Security
NVIDIA
Rethinking Agent Security as a Networking Problem
Aug 12, 2026Van Tran, Taveesh Sharma, Tajveer Singh Dhesi +1Cybersecurity AI Agent Security
University of Chicago Chicago, United States

Sep 23, 2026, cs.CRJ/K move · Enter open · S save

Agent Name Collision Attacks in Multi-Agent Systems

Adithyan Arun Kumar

Independent Security Researcher

Agent Communication Protocols AI Agent Security Multi-Agent System Security

Open paper AskPDF arXiv

Multi-agent hosts turn remote Agent Cards into local agents, tools, workflow targets, and broker routes. A2A defines the card's name as human-readable metadata, not as a stable identity, and specifies no collision semantics. The security failure begins when a host nevertheless uses that remote name as a local routing identifier. We traced registration through dispatch and ran isolated regression tests at seven pinned open-source revisions. Six client-style integrations selected an attacker-controlled peer's client or loopback endpoint for a request addressed to a trusted peer's name. A seventh, brokered implementation collapsed both peers onto one name-derived route; queue and access-control state determine whether the result is interception or denial. The common result is wrong-peer dispatch, not universal privilege inheritance. Synthetic credential and tool tests found no A-specific credential transfer in the tested client bindings and no direct transfer of A-owned tools. The broker path forwards a caller-configuration object; delegated identity or tokens reach B only if present and B can consume the route. Two other paths expose a later, model-mediated decision rather than direct execution authority. The necessary conditions assign different responsibilities to the protocol, implementations, and deployments. Hosts should route by an origin-bound stable identity, keep names presentational, and reject ambiguous aliases. The evidence establishes a recurring implementation vulnerability class, not a universal A2A protocol exploit or a count of vulnerable deployments.

Momentum

Related topics

Latest papers 311